Draft Methodology for Cybersecurity Analysis for Adoption of Wireless Technology in Nuclear Power Plants

Abstract

The report is delivered as DOE-NE Cybersecurity Program Milestone M2CT-22IN1104014-Industry cybersecurity guidance adoption status. The milestone is specifically to document the process and the status of the efforts towards developing guidance in support of industry's adoption of wireless communication technologies. To transform the operation of nuclear power plants, including domestic light-water reactors, advanced reactors, microreactors, and fission battery, for grid and non-grid applications, secure and resilient wireless capabilities are required. In addition, to realize new operational concepts such as autonomous operation and remote monitoring, advanced sensor, and instrumentation, wireless technology is essential. However, industry implementation is low, and there is no technical basis for how to understand and address potential risks for wireless communications for critical plant functions. A methodology with a technical basis for implementing secure wireless communication is crucial. This wireless adoption methodology is intended to assist a licensee in identifying an appropriate technological approach for securing wireless communications in nuclear power plant. However, this methodology does not provide guidance for addressing wireless design criteria or for addressing all the cybersecurity commitments in licensees' cybersecurity plans (CSPs) including addressing security impact analysis that a licensee must perform before an update to a Critical Digital Asset (CDA). This methodology guides a licensee through a process of evaluating a proposed wireless implementation and drafting a plant change notification for an example use case. The example is a generic/nonproprietary version of the first test case of the methodology, which, if successfully implemented, is part of the consideration for protecting other functions' use of wireless in a cybersecure manner.Disclaimer: Neither INL, NRC, nor any of its employees, members, supporting organizations, contractors, or consultants make any warranty, expressed or implied, or assume any legal responsibility that the method provided in this document meets the NRC cyber or completeness of NRC requirements. Blanc for coordinating important critical reviews of the methodology within the DOE-NE Cybersecurity team. The team of researchers that provided comments that contributed to this report during the program reviews are listed below. Idaho National Laboratory had multiple technical exchanges with the NRC staff through the Office of Nuclear Regulatory Research under the DOE-NRC Memorandum of Understanding (MOU) on Nuclear Energy Innovation, Amendment 4, Research Related to Light Water Reactor Sustainability (ML21083A072). We are grateful to the NRC staff colleagues who provided their insights and expertise under the LWRS MOU as part of this effort. However, these exchanges should not be interpreted as NRC endorsement, acceptance, or concurrence with this report. This work would not have been possible without the commitment of the Nuclear Energy Institute (NEI) Cybers...