NRC And The North American Electric Reliability Corporation Coordinate Their Responsibilities For Cyber Security Requirements
– By Stephen Heiser –
The U.S. Nuclear Regulatory Commission (NRC) and the North American Electric Reliability Corporation (NERC) have signed a Memorandum of Understanding (MOU) that outlines each organization’s responsibility for applying cyber security requirements to nuclear power plants. The MOU was developed to ensure consistent regulation since the NRC and NERC have overlapping authority over cyber security at these commercial facilities.
The MOU acknowledges the NRC’s regulatory responsibility for inspecting digital systems that can affect safety, security and emergency preparedness of a nuclear power plant as well as NERC’s responsibility for regulating digital systems related to continuity of electric power generation. As part of the MOU, the NRC and NERC agree to share information discovered during respective inspections that they believe may be relevant to any digital system governed by the other organization. Since under this provision NERC may need access to sensitive information or Safeguards Information, NERC has agreed to comply with NRC requirements related to protecting this information.
Each entity is responsible for taking enforcement action consistent with its own statutory authority. To ensure consistent regulation, both organizations agree in the MOU to coordinate on any enforcement actions that might be necessary should a cyber security incident result in a violation of both NRC and NERC requirements.
The MOU is in addition to a Memorandum of Agreement signed in July 2007 that generally outlines the relationship between the two organizations. It will be effective for five years unless terminated by either of the organizations.
The NRC and NERC will hold a series of workshops to help U.S. nuclear power plants define which of their cyber systems and assets must comply with each organization’s requirements.
A Federal Register notice outlining the details of the MOU was published today and is available at: http://edocket.access.gpo.gov/2010/2010-229.htm.