POWER April 2014 - 44

NUCLEAR POWER
EPRI and Luminant Collaborate to
Create Common Understanding of
Cybersecurity Requirements
A collaborative effort between the Electric Power Research Institute and the
Comanche Peak Nuclear Power Plant confirms that vendors and nuclear
plant owners who understand and address cybersecurity requirements
up front will avoid costs on the back end. The best practices developed
also apply to non-nuclear plants.
Matt Gibson and Jay Amin
N
uclear utilities are facing stringent
cybersecurity requirements for plant
digital assets that fulfill safety-related,
important-to-safety, security, and emergency
preparedness functions or that are associated
with continuity of power. Such requirements
are intended to protect plant digital computer
systems, communications systems, and networks
from cyber attacks that could affect
reactor safety or generation reliability.
Determining the applicable cybersecurity
requirements and factoring these requirements
into modifications at project inception
will avoid costly redesigns and rework.
In addition, nuclear plant owners must consider
cybersecurity requirements throughout
the life cycle of a plant digital asset and account
for these requirements during the design phase.
The Electric Power Research Institute (EPRI)
has collaborated with Luminant and other
nuclear utilities to help suppliers understand
exactly what utilities need to establish effective
cybersecurity requirements, and also to provide
utility engineers with the technical guidance
needed to meet those requirements by properly
implementing the right vendor solutions.
EPRI has issued two key guideline documents
aimed at improving the way all power
generation plants, not just nuclear power
facilities, tackle cybersecurity challenges:
Cyber Security Procurement Methodology
(Product 3002001824) and Technical
Guideline for Cyber Security Requirements
and Life Cycle Implementation Guidelines
for Nuclear Plant Digital Systems (Product
1019187). And although control system cybersecurity
technology will evolve over time,
cybersecurity requirements largely will remain
the same, which means the approaches
defined in these guidelines are expected to
provide a dependable, standard approach to
cybersecurity that will last over time.
44
Luminant implemented the guidance
from both documents at its Comanche Peak
Nuclear Power Plant in Texas by early 2013.
Using the guidance to clearly interpret the
nuclear industry's cybersecurity procurement
controls and integrate them into
purchase specifications and contracts, Luminant
expects to save more than $600,000
in avoided cost overruns on digital system
upgrade modifications for a plant computer
replacement and a security system video
capture at Comanche Peak.
Cybersecurity Requirements
Ramp Up
Prior to 2001, plant digital systems included
basic physical and information security
requirements in specification and design
documents. In general, however, these cybersecurity
requirements were not based on information
security industry standards. After
Sept. 11, 2001, the U.S. Nuclear Regulatory
Commission (NRC) and the Federal Energy
Regulatory Commission (FERC) began issuing
orders on the subject.
In March 2009, the NRC issued 10 CFR
73.54, which requires plants to provide assurance
that the digital computer and communication
systems and networks associated with
the following functions are protected against
cyber attacks: safety-related and importantto-safety
functions; security functions; and
emergency preparedness functions, including
off-site communications. Support systems
and equipment that would adversely affect
these functions if compromised are also covered
by this set of requirements.
Comanche Peak's cybersecurity program
also addresses cybersecurity requirements
established through a memorandum of understanding
between the NRC and the North
American Electric Reliability Corp.
www.powermag.com
Guidance Throughout the Life
Cycle
The Technical Guideline for Cyber Security
Requirements and Life Cycle Implementation
Guidelines for Nuclear Plant Digital Systems
gives plant operators guidance on how to build
cybersecurity into new critical digital assets.
Written in a procedural format that can be immediately
incorporated into a plant's existing
digital design control procedures, the guidelines
cover 138 areas of security in detail-everything
from passwords and wireless connections
to encryption and intrusion detection.
The cybersecurity requirements and
guidelines are structured according to the life
cycles of digital instrumentation and control
systems and equipment. In that way, the
guidance not only provides engineers with
what requirements need to be included in a
requirements specification but also includes
what engineers should look for during various
phases of the design's life cycle.
The document discusses the cybersecurity
threats that plants face and the compliance
standards for those plants. It contains
two appendices. The first, based on Comanche
Peak's own procedures to avoid failure
events, contains a checklist and a methodology
to address technical and regulatory issues
involving plant digital systems and devices
regulated by the NRC. The checklist recommends
steps to ensure cybersecurity in all
life-cycle phases (Table 1).
For example, during the conceptual phase,
the design engineer determines if the modification
contains digital assets, and what
specific functions the digital assets will perform.
The design engineer completes a form
describing the digital features of the design.
This form, and an accompanying simple network
diagram, will facilitate a conversation
with the station cybersecurity subject matPOWER
| April 2014
http://www.powermag.com
POWER April 2014

Table of Contents for the Digital Edition of POWER April 2014
