Attachment_J-12_-_NN-801_AOR_Optional_IT_Cert.pdf

OFFICIAL USE ONLY

Bechtel Marine Propulsion Corporation

Bettis Atomic Power Laboratory P. O. Box 79 West Mifflin, PA 15122-0079

Knolls Atomic Power Laboratory P. O. Box 1072 Schenectady, NY 12301-1072

Bechtel Plant Machinery, Inc.

3500 Technology Drive Monroeville, PA 15146-2459

P. O. Box 1021 Schenectady, NY 12301-1021

SD-SSO-00848

June 25, 2014

Manager, Naval Reactors Laboratory Field Office U. S. Department of Energy Post Office Box 109 West Mifflin, Pennsylvania 15122-0109

Subject: Release of Revision 2 of the NN-801 Additional Ordering Requirements; For Purchase

Order Use and NR Information

Dear Sir:

PURPOSE

This letter releases Revision 2 of the Additional Ordering Requirements (AOR) for NN-801 to Support the Development, Modification, and Generation of Unclassified Naval Nuclear Propulsion Information (U-NNPI), provided as Enclosure (1), for purchase order use and NR information.

BACKGROUND

In reference (a), the BPMI/BMPC Security Department (SD) recommended NR approval of:

1. The business case for applying the NN-801, Control and Protection of U-NNPI, AOR (reference (b)) to selected suppliers as well as the logic for excluding the other suppliers.

2. Supplier requests for exceptions to the AOR requirements.

as well as concurrence to the following:

3. The estimated cost impact of implementing the AOR.

4. A cost allocation methodology to use to fund the implementation cost.

In reference (c), SD supplemented reference (a) to request NR approval to SD’s recommendation for Lockheed Martin Missiles and Fire Control (LMMFC) to implement the AOR. In reference (d), SD recommended NR approval of NN-801 Revision 5, which was revised to include select AOR requirements in the base NN-801.

In reference (e), NR dispositioned references (a), (c), and (d) and requested several actions including updating reference (b) to incorporate NR comments.

In reference (f), SD resolved the reference (e) NR comments and provided a markup of the changes between Revision 1 and Revision 2 of the AOR.

Manager, NRLFO - 2 - SD-SSO-00848

DISCUSSION

This letter releases Revision 2 of the AOR for NN-801 to Support the Development, Modification, and Generation of U-NNPI, provided as Enclosure (1), for purchase order use and NR information.

Enclosure (1) will be contractually invoked on the following suppliers approved in reference (e):

• Babcock & Wilcox (B&W) Sites o Nuclear Fuel Services (NFS) o Nuclear Operations Group - Lynchburg o Nuclear Operations Group - Barberton o Nuclear Operations Group - Mt. Vernon o Nuclear Operations Group - Euclid

• Curtiss-Wright Flow Control (CWFC) Sites o Electro-Mechanical Corporation (EMD) o Engineered Pump Division (EPD) o Target Rock (TR) o Peerless Instrument Company (PIC)

• L-3 Communications Sites o Power Paragon (PPI) o SPD Electrical Systems (SPD)

• DRS Sites o Consolidated Controls, Inc (CCI) o Power & Control Technologies, Inc (PCT)

• Northrop Grumman Systems Corporation (NGSC)

• LMMFC

• Hebco, Inc

CONCLUSION

Enclosure (1) releases Revision 2 of the NN-801 AOR to Support the Development, Modification, and Generation of U-NNPI to support purchase orders per the schedule outlined in reference (f). There are no outstanding comments to the NN-801 AOR.

Very truly yours, Reviewed by:

S.W. Iams Supplier Security Section Security Department

R.E. Shades Supplier Security Section Security Department

Manager, NRLFO - 3 - SD-SSO-00848

References:

(a) SD Letter, SD-SSO-00596 dated August 29, 2013

(b) Additional Ordering Requirements for NN-801 to Support the Development, Modification, and

Generation of Unclassified Naval Nuclear Propulsion Information, AOR-NN-801-U-NNPI Standalone Network; Revision 1, dated June 11, 2013

(c) SD Letter, SD-SSO-00706 dated January 31, 2014

(d) SD Letter, SD-SSO-00648 dated October 31, 2013

(e) NR Letter, NR:DD:JMEaster B#14-00577 dated May 22, 2014

(f) SD Telecon, SD-SSO-00835 dated June 23, 2014

Enclosures:

(1) Additional Ordering Requirements for NN-801 to Support the Development, Modification, and

Generation of Unclassified Naval Nuclear Propulsion Information, AOR-NN-801-U-NNPI Standalone Network; Revision 2, dated June 11, 2014

Enclosure (1) to

SD-SSO-00848

Additional Ordering Requirements for NN-801 to Support the Development, Modification, and Generation of Unclassified Naval Nuclear Propulsion Information, AOR-NN-801-U-NNPI Standalone Network;

Revision 2, dated June 11, 2014

AOR-NN-801-

U-NNPI STANDALONE NETWORK

June 11, 2014

ADDITIONAL ORDERING REQUIREMENTS FOR

NN-801

TO SUPPORT

THE DEVELOPMENT, MODIFICATION, AND GENERATION OF

UNCLASSIFIED

NAVAL NUCLEAR PROPULSION PROGRAM INFORMATION

Bechtel Plant Machinery, Inc.

3500 Technology Drive Monroeville, PA 15146

Page ii

RECORD OF REVISIONS

REVISION DATE

PREPARED

BY

Description of Changes

Original 2/18/2013 KM Rossetti Original Release 1 6/14/2013 KM Rossetti Revised to incorporate comments in B#13-01434 2 6/11/2014 ML Stevenson Revised to incorporate comments in B#14-00577

ADDITIONAL ORDERING REQUIREMENTS FOR NN-801 TO

SUPPORT THE DEVELOPMENT, MODIFICATION, AND GENERATION OF UNCLASSIFIED

NAVAL NUCLEAR PROPULSION INFORMATION (U-NNPI)

Reference: (a) Federal Information Processing Standards (FIPS) Publication 140-2, Security

Requirements for Cryptographic Modules

1. PURPOSE

The purpose of this document is to provide requirements in addition to those in NN-801 for the development, modification, and generation of unclassified Naval Nuclear Program Information (U- NNPI) on a standalone U-NNPI network.

1.1. Definitions

1. Media Center – Collection of one or more computers that are operated for the purpose of loading or offloading of files or transferring files between systems that are physically separate.

2. Remediation – The act of correcting a vulnerability. There are three primary methods of remediation: installation of a software security patch, adjustment of a configuration setting, and removal of affected software.

3. Site – All buildings within the documented facility boundary at a single geographic location.

4. Standalone network – Self contained network with no physical or logical connections to any other network or the Internet.

5. Two-person Controls – Controls in place to prevent one person, acting alone, from removing information from the U-NNPI system.

2. REQUIREMENTS

2.1. Information systems used to store and process U-NNPI shall either meet all of the requirements identified in paragraphs 2.1.1 through 2.1.26 or shall be accredited and certified to store and process Confidential Restricted Data (CRD) as specified in NN-802 for Control and Protection of Classified Naval Nuclear Propulsion Information (NNPI) and meet the requirements of paragraphs 2.1.2, 2.1.18, 2.1.21 through 2.1.26.

2.1.1. The information systems, hereafter referred to as the U-NNPI system, shall be certified and approved to store and process Unclassified Naval Nuclear Propulsion Information

(U-NNPI or NOFORN) as specified in NN-801 for Control of U-NNPI except as identified herein.

2.1.1.1. The requirements of NN-801 and this AOR for control of U-NNPI data apply to all electronic U-NNPI data stored or processed at the Seller’s facility regardless of which contractor, supplier or customer provided the U-NNPI to the Seller.

2.1.2. Enclosure (1) to this document shall be completed for the U-NNPI system and submitted for Buyer approval along with the NN-801 Enclosure (2) checklist and documentation specified in NN-801 and this AOR.

2.1.3. NN-801 Section 10.b.1. shall be replaced with the following:

(a) Malicious code protection - Seller’s information systems that process or store U- NNPI must be configured with current anti-malware software and anti-malware signature files. For purposes of this requirement, the term “current” means the anti-malware software and signatures must be updated as new program revisions and signature files become available from the manufacturer, not to exceed every thirty days. The anti-malware software must be actively monitoring the systems for viruses and malicious code by periodically scanning system hard drives and scanning files as they are introduced to the system.

All removable media including but not limited to CDs, DVDs, memory sticks/cards and floppies including media shrink wrapped from the manufacturer must be scanned for viruses and malware per the Security Plan. The scanned media must be clearly marked that it has been scanned and initialed by the individual who performed the scan. In those cases where the physical size of the media does not support the application of markings, the media shall be placed in a container that is initialed and marked as scanned. Backup tapes are not required to be scanned.

Malware scan logs shall be periodically audited in accordance with the Seller’s Security Plan to identify potential unscheduled activity, failure to upload new signature files to a device, or any other unusual events.

Each checklist and Security Plan shall identify malware scanning schedules, a schedule for updating signatures (recommended daily but not to exceed every 7 days), schedule for checking for anti-malware program updates (recommended weekly but not to exceed every thirty days), schedule for reviewing scan logs, and a response plan to be implemented in the event that viruses are detected on the Seller’s system.

(b) Operating System updates - Seller’s information systems that process or store U- NNPI must be configured with current security related Operating System updates, patches and hotfixes, hereafter simply called patches. The applicable security related system patches must be downloaded and installed on a schedule not to exceed every thirty days and documented in the Security Plan. This guidance applies to but is not limited to all servers, workstations, laptops, routers, switches and any other devices utilizing a programmable operating system. System or application log files or other documentation indicating security patches are being installed shall be provided to the Buyer on request.

(c) Application software updates - Application programs such as Microsoft Office, Exchange, Outlook and any other application software shall be configured with the current security related application patches. The applicable security related application patches shall be downloaded and installed on a schedule not to exceed every thirty days and documented in the Security Plan. System or application log files or other documentation indicating the patches are being installed shall be provided to the Buyer on request.

(d) Special use systems: Computer systems used for special or unique purposes (i.e.

CNC machine controllers or design analysis computers that require recertification after patching) may be granted an exception to the requirements identified in requirements 2.1.3 a-c. The exception must include detailed information regarding the special use system, the reason why the system cannot meet the requirements of 2.1.3 a-c, the security controls in place to mitigate vulnerabilities, and the schedule that will be followed to update the operating system patches, virus definitions, and application software updates. The exception shall be included in the Seller’s Security Plan and approved by the Buyer.

Each checklist shall identify a schedule for checking for new patches (shall not exceed every thirty days) and method of applying the patches.

Systems and applications required to support development or troubleshooting of legacy equipment, where the current patched versions of the systems or applications will not interface correctly with the legacy systems, may be configured and used without the application of current patches, hotfixes and updates. This shall be documented in the Security Plan.

2.1.4. NN-801 Section 10.b.2.(c) shall be replaced with the following:

The individual administrator account must be used only for system administration. The Security Plan shall define how each facility will enforce this requirement.

2.1.5. NN-801 Section 10.b.2.(d) shall be replaced with the following:

Users with administrative access to their workstations (local administrators) must be controlled and documented. The use of a local administrator accounts should be restricted to cases when it is not possible to perform normal job functions without administrative rights. Users with local administrator rights must have a separate local administrator account and use that account only for administrative actions. The Security Plan shall define how each facility will enforce this requirement.

2.1.6. NN-801 Section 10.b.2.(i) shall be replaced with the following:

If the device allows equipment passwords such as but not limited to those used on routers and switches must adhere to the same password policies as user passwords except that the minimum password length should be fifteen (15) characters. (See NN- 801 Section 10.b.2.(e) for standard password policies.) Equipment account passwords shall be addressed separately in the Security Plan.

2.1.7. The following shall be added to NN-801 Section 10.b.2.:

(k) Passwords on the U-NNPI system shall be different than passwords on other non- U-NNPI systems. This includes but is not limited to users, administrators, routers, and switches.

2.1.8. In lieu of NN-801 Section 10.b.3 in NN-801, the U-NNPI system shall be standalone:

There shall be no physical or logical connections to any other network as well as the Internet.

There shall be no wireless connections to other information systems or between components on the U-NNPI system.

Any wireless connection capabilities shall be removed from the information system if possible or disabled in a password protected BIOS.

There shall be no shared infrastructure (switches, storage area networks, virtual server infrastructure, etc.) between the U-NNPI system and any other system.

2.1.9. NN-801 Section 10.b.5.(g) shall be replaced with the following:

Access to U-NNPI data must be controlled based on Need-to-Know (NTK), ensuring that only authorized personnel have access:

Data must be reviewed and a NTK established by data owners.

All user NTK needs to be established, documented, and approved by a supervisor.

The user will be permitted to access the data when the user NTK matches the data NTK.

Terminated users shall have system access removed within one workday of their termination.

NTK assignments will be reviewed when user work assignments change and will be removed or modified as required.

2.1.10. NN-801 Section 10.b.6.(a) shall be replaced with the following:

All U-NNPI system users must review, agree to, and sign an Acceptable Use Policy that reflects the requirements of NN-801 and this AOR. The Acceptable Use Policy shall be made available for routine review by users. Signed versions of the Acceptable

Use Policy will be made available to the Buyer upon request.

2.1.11. NN-801 Section 10.b.9 shall be replaced with the following:

1. A confirmed incident must be reported to the Buyer as soon as practical but no more than 24 hours from the discovery of the incident.

2. Reportable incidents include any act that fails to comply with the contract security requirements or local information security policy and has resulted in: (1) a confirmed or suspected compromise (e.g., inadvertent release, exposure or loss) of U-NNPI, (2) malicious code (e.g., computer virus, worm, or Trojan) that executed on the system, (3) confirmed or suspected incidents of fraud involving a system processing U-NNPI, or (4) U-NNPI on a system not approved to process U-NNPI.

3. Sellers shall resolve or close U-NNPI incidents within 30 calendar days of the initial reporting whenever possible. If resolution or closure is not possible within 30 days, written status reports shall be provided to the Buyer every 30 days until the incident is closed or resolved.

4. A written procedure to track, document and report U-NNPI incidents is required and shall be documented in the Buyer approved Security Plan. The procedure must define preparation, detection, analysis, containment, recovery and the process for documenting and reporting the incident to appropriate organizational officials and Buyer security personnel.

2.1.12. NN-801 Section 10.b.12 shall be replaced with the following:

FIPS-140-2 or later certified (at the time of installation) encryption must be used for:

(unless otherwise approved by the Buyer)

Data in transit between sites on the U-NNPI system.

Data at rest on all desktop hard drives included with the U-NNPI system.

Data at rest on mobile devices included with the U-NNPI system. All removable media containing U-NNPI including but not limited to, CDs, DVDs, USB thumb drives, media cards, and external hard drives. Any exceptions such as backup tapes and camera memory cards shall be documented in the Buyer approved Security Plan.

2.1.13. Site to site communication shall be conducted using a dedicated line and shall be encrypted according to section 2.1.12.

2.1.14. Electronic (log-on) access to the U-NNPI system shall be limited to those with NTK.

No foreign nationals may have electronic access to the U-NNPI system without prior written justification and formal Buyer approval. Dual citizens with a need to have electronic access the U-NNPI system must be reported to the Buyer prior to being provided access.

2.1.14.1. The Seller shall verify annually that all users on the U-NNPI system have a need to access the system.

2.1.14.2. The Seller shall verify annually that all users on the U-NNPI system have the correct NTK.

2.1.14.3. The Seller shall submit a written request for Buyer approval to expand use of the U-NNPI system to support other projects as conditions warrant. All other changes shall be submitted in accordance with NN-801.

2.1.14.4. If Buyer approval is provided to expand electronic access to other projects, then the access to the files on the system related to a specific project must be limited to those with NTK for that specific project.

2.1.15. Physical access to the U-NNPI system shall be limited in accordance with NN-801

Section 10.b.4.

2.1.15.1. Mobile devices included with the U-NNPI system shall be configured to connect only to the U-NNPI system and are to be dedicated for use with authorized NNPP projects.

2.1.15.2. Mobile devices included with the U-NNPI system shall be maintained under the direct custody of the individual authorized to use them, who must exercise the protection needed to prevent detailed visual or physical access by individuals without the required NTK.

2.1.15.3. The data transmitted between buildings within the site shall be via optical fiber connections or other transmission media provided the data is encrypted with FIPS 140-2 or later certified algorithms while traveling between buildings within a site.

2.1.16. Protections shall be in place to notify the system administrator and preclude access to the U-NNPI system if an unapproved computer/device attempts to gain access to the U-NNPI system by plugging into an open network connection point.

2.1.17. Vulnerability management shall be conducted using a vulnerability management procedure documented in the Buyer approved Security Plan. The procedure shall address: (1) the method used to conduct vulnerability scans, (2) frequency the scans will be performed, (3) methods and timeframes for remediation, (4) methods and timeframes for validation, (5) procedure for requesting exceptions.

2.1.17.1. Frequency of vulnerability scans shall not exceed every thirty days.

2.1.17.2. Remediation of identified vulnerabilities shall not exceed every thirty days.

2.1.17.3. Vulnerability management documentation shall be provided to the Buyer on request.

2.1.18. Each information system must employ port/peripheral lockdown policies preventing unapproved devices (i.e. USB flash drives or other serial interface devices) from being recognized by the operating system.

2.1.19. All media creation and data transfers to and from the U-NNPI system shall be conducted using a media center process.

2.1.19.1. A media center process shall be documented in the Buyer approved Security Plan.

2.1.19.2. The media center process shall implement two-person controls for controlling uploading and offloading of information on the U-NNPI system.

2.1.19.3. The media center process shall restrict media creation to a subset of users.

2.1.19.4. The media center process shall restrict media creation to a subset of devices.

2.1.19.5. The media center process, including the users and devices authorized to create media, shall be reviewed annually.

2.1.20. Removable IT media generated from the U-NNPI system containing U-NNPI data must be encrypted using FIPS-140-2 or later certified encryption. All IT media generated from the U-NNPI system shall be reviewed by a knowledgeable reviewer prior to the media being created to determine if U-NNPI data is present. IT media includes but is not limited to, optical media (such as CDs or DVDs), USB thumb drives, media cards, and external hard-drives. Any exceptions such as backup tapes and camera memory cards shall be documented in the Buyer approved Security Plan.

2.1.21. Source files for the updates to operating system patches and anti-virus software definitions must come from reliable and reputable sources that have been verified by the Seller prior to downloading the files.

2.1.21.1. Source files for operating system patches and anti-virus software definitions may be obtained from a commercial software manufacturer’s website or from media provided by the commercial software manufacturer or their authorized distributor and integrity shall be validated where applicable (i.e. SHA-256 hash sum) The Seller shall not use unapproved third party software distribution websites (such as tucows.com) in obtaining operating system update files or antivirus definition files.

2.1.21.2. Source files for operating system patches and anti-virus software definitions may be obtained through authorized and trusted third party vendors/websites (such as Lumension) that provide professional system maintenance services provided the Seller has a contract or license with the third party to receive patches and updates.

2.1.21.3. Updates from websites must be applied to the U–NNPI network via an off-line process that maintains the air gapped network.

2.1.22. Access to the e-Commerce website shall be conducted using the approved guidelines for the e-Commerce system and the approved e-Commerce user agreement. This computer shall not be part of the U-NNPI system.

2.1.23. Access to U-NNPI information via CipherShare, or equivalent system approved for the secure communication of U-NNPI data, shall be conducted using a dedicated computer with an Internet connection and boundary defenses that meet the requirements of NN-

801. This dedicated computer shall not be part of the U-NNPI system or be able to communicate with the corporate network. U-NNPI files shall not be stored or processed on the dedicated computer outside of the CipherShare application. The process for accessing CipherShare, or equivalent system approved for the secure communication of U-NNPI data, shall be documented in the Buyer approved Security Plan.

2.1.23.1. U-NNPI uploads to the CipherShare application shall be conducted directly from encrypted media to the CipherShare application.

2.1.23.2. U-NNPI downloads from the CipherShare application shall be saved directly to encrypted media and transferred to the U-NNPI system for processing.

2.1.24. The requirements of this AOR shall not be invoked by the Seller on Seller’s subcontracted suppliers being used for the development, modification, and generation of U-NNPI. NN-801 shall be invoked as identified within NN-801.

2.1.25. All deviations from the requirements contained herein shall be submitted for approval to the Buyer and documented in the Security Plan. The submittal shall include sufficient justification for the deviation including a business case, risk analysis, cost analysis, alternate configuration, compensating security measures, etc.

2.1.26. No government furnished equipment shall be provided. The Buyer shall not be responsible for any maintenance costs associated with the information systems described herein.

U-NNPI STANDALONE NETWORK

Enclosure (1)

SITE:

DATE PREPARED AND AUTHOR:

SITE ACRONYM

and LOCATION:

U-NNPI System Protection Requirements Checklist AOR-NN-801-U-NNPI STANDALONE NETWORK dated June 11, 2014

This checklist must be completed to confirm compliance with the applicable contract security requirements.

Description of Information Systems / Network Responsible Security & Management Personnel (List Names, Titles, Phone Numbers)

Buyer expectations are that all requirements listed in AOR-NN-801-U-NNPI-STANDALONE NETWORK dated June 11, 2014 will be fully met by the Seller and documented via this checklist. All policies and procedures referenced in the checklist will be documented in the Security Plan. Prior to implementing a change to any item on this checklist, the Seller shall notify the Buyer of the change, provide the information required in NN-801, Revision 4, Section 10.a.3, and resubmit the Checklist for Buyer approval.

Requirements Y or N

2.1.3 Malicious code protection

1. The U-NNPI system is configured with current anti-malware software and anti-malware signature files.

2. The anti-malware software is kept up to date and updates do not exceed every thirty days.

3. The anti-malware software actively monitors the systems for viruses and malicious code by periodically scanning system hard drives and scanning files as they are introduced to the system.

4. All removable media including but not limited to CDs, DVDs, memory sticks/cards and floppies including media shrink wrapped from the manufacturer is scanned for viruses and malware per the Security Plan.

5. The scanned media is clearly marked that it has been scanned and initialed by the individual who performed the scan.

6. If the physical size of the media does not support the application of markings, the media is placed in a container that is initialed and marked as scanned.

7. Malware scan logs are periodically audited in accordance with the Security Plan to identify potential unscheduled activity, failure to upload new signature files to a device, or any other unusual events.

8. The NN-801 checklist and the Security Plan identify malware scanning schedules, a schedule for updating signatures, schedule for checking for anti-malware program updates, schedule for reviewing scan logs, and a response plan in the event that viruses are detected on the Seller’s system.

Operating System updates

1. The U-NNPI system is configured with current operating system updates, patches and hotfixes.

2. The operating system is kept up to date and updates do not exceed every thirty days.

3. System or application log files or other documentation indicating security patches are being installed will be provided to the Buyer on request.

U-NNPI STANDALONE NETWORK

DATE PREPARED AND AUTHOR:

This checklist must be completed to confirm compliance with the applicable contract security requirements.

Application software updates

1. The U-NNPI system is configured with current security related application updates, patches and hotfixes.

2. The applications are kept up to date and updates do not exceed every thirty days.

3. System or application log files or other documentation indicating security patches are being installed will be provided to the Buyer on request.

2.1.4 The individual administrator account is used only for system administration. The Security Plan defines how this requirement is met.

2.1.5 1. Users with administrative access to their workstations (local administrators) are controlled and documented.

2. The use of local administrator accounts is restricted to cases when it is not possible to perform normal job functions without administrative rights.

3. Users with local administrator rights have a separate local administrator account and use that account only for administrative actions.

4. The Security Plan defines how this requirement is met.

2.1.6 1. If the device allows equipment passwords such as but not limited to those used on routers and switches adhere to the same password policies as user passwords except that the minimum password length is fifteen (15) characters. (See NN-801 Section 10.b.2.(e) for standard password policies.)

2. Equipment account passwords are addressed separately in the Security Plan.

2.1.7 Passwords on the U-NNPI system are different than passwords on other non-U-NNPI systems.

2.1.8 1. The U-NNPI system is standalone

2. There are no physical or logical connections to any other network as well as the Internet.

3. There are no wireless connections to other information systems or between components on the U-NNPI system.

4. Wireless connection capabilities are removed from the information system if possible or disabled in a password protected BIOS.

5. There is no shared infrastructure (switches, storage area networks, virtual server infrastructure, etc.)

between the U-NNPI system and any other system.

2.1.9 1. Access to U-NNPI data is controlled based on Need-to-Know (NTK), ensuring that only authorized personnel have access.

2. Data is reviewed and a NTK established by data owners.

3. All user NTK is established, documented, and approved by a supervisor.

4. The user is permitted to access the data when the user NTK matches the data NTK.

5. Terminated users have system access removed within one workday of their termination.

6. NTK assignments are reviewed when user work assignments change and are removed or modified as required.

2.1.10 All U-NNPI system users review, agree to, and sign an Acceptable Use Policy that reflects the requirements of NN-801 and this AOR. The Acceptable Use Policy is available for routine review by users. Signed versions of the Acceptable Use Policy are made available to the Buyer upon request.

U-NNPI STANDALONE NETWORK

DATE PREPARED AND AUTHOR:

This checklist must be completed to confirm compliance with the applicable contract security requirements.

2.1.11 1. Confirmed incidents are reported to the Buyer as soon as practical but no more than 24 hours from the discovery of the incident.

2. Reportable incidents include any act that fails to comply with the contract security requirements or local information security policy and has resulted in: (1) a confirmed or suspected compromise (e.g., inadvertent release, exposure or loss) of U-NNPI, (2) malicious code (e.g., computer virus, worm, or Trojan) that executed on the system, (3) confirmed or suspected incidents of fraud involving a system processing U-NNPI, or (4) U-NNPI on a system not approved to process U-NNPI.

3. U-NNPI incidents are resolved or closed within 30 calendar days of the initial reporting whenever possible. If resolution or closure is not possible within 30 days, written status reports are provided to the Buyer every 30 days until the incident is closed or resolved.

4. A written procedure to track, document and report U-NNPI incidents is documented in the Buyer approved Security Plan. The procedure defines preparation, detection, analysis, containment, recovery and the process for documenting and reporting the incident to appropriate organizational officials and Buyer security personnel.

2.1.12 FIPS-140-2 (or later) certified encryption is used for: (unless otherwise approved by the Buyer)

1. Data in transit between sites on the U-NNPI system.

2. Data at rest on all desktop hard drives included with the U-NNPI system.

3. Data at rest on mobile devices included with the U-NNPI system. All removable media containing U-NNPI including but not limited to, CDs, DVDs, USB thumb drives, media cards, and external hard drives.

2.1.13 Site to site communication is conducted using a dedicated line and is encrypted according to section 2.1.12.

2.1.14 1. Electronic (log-on) access to the U-NNPI system is limited to those with NTK.

2. All foreign nationals that have electronic access to the U-NNPI system have been formally approved by the Buyer.

3. All dual citizens with a need to have electronic access the U-NNPI system have been reported to the

Buyer prior to being provided access.

4. All users on the U-NNPI system have a need to access the system. This is verified annually.

5. All users on the U-NNPI system have the correct NTK. This is verified annually.

2.1.15 1. Physical access to the U-NNPI system is limited in accordance with NN-801 Section 10.b.4.

2. Mobile devices included with the U-NNPI system have been configured to connect only to the U-NNPI system and are dedicated for use with authorized NNPP projects.

3. Mobile devices included with the U-NNPI system are maintained under the direct custody of the individual authorized to use them, who must exercise the protection needed to prevent detailed visual or physical access by individuals without the required NTK.

4. Data transmitted between buildings within the site is via optical fiber connections or other transmission media provided the data is encrypted with FIPS 140-2 or later certified algorithms while traveling between buildings within a site.

2.1.16 Protections are in place to notify the system administrator and preclude access to the U-NNPI system if an unapproved computer/device attempts to gain access to the U-NNPI system by plugging into an open network connection point.

U-NNPI STANDALONE NETWORK

DATE PREPARED AND AUTHOR:

This checklist must be completed to confirm compliance with the applicable contract security requirements.

2.1.17 1. Vulnerability management is conducted using a vulnerability management procedure documented in the Buyer approved Security Plan. The procedure addresses: (1) the method used to conduct vulnerability scans, (2) frequency the scans will be performed, (3) methods and timeframes for remediation, (4) methods and timeframes for validation, (5) procedure for requesting exceptions.

2. Vulnerability scanning does not exceed every thirty days.

3. Vulnerability remediation does not exceed every thirty days.

4. Vulnerability management documentation is provided to the Buyer on request.

2.1.18 Each information system employs port/peripheral lockdown policies preventing unapproved devices (i.e. USB flash drives or other serial interface devices) from being recognized by the operating system.

2.1.19 1. All media creation and data transfers to and from the U-NNPI system are conducted using a media center process.

2. A media center process is documented in the Buyer approved Security Plan.

3. The media center process implements two-person controls for controlling uploading and offloading of information on the U-NNPI system.

4. The media center process restricts media creation to a subset of users.

5. The media center process restricts media creation to a subset of devices.

6. The media center process, including the users and devices authorized to create media, is reviewed annually.

2.1.20 1. Removable IT media generated from the U-NNPI system containing U-NNPI data is encrypted using FIPS-140-2 certified encryption.

2. All IT media generated from the U-NNPI system is reviewed by a knowledgeable reviewer prior to the media being created to determine if U-NNPI data is present.

IT media includes but is not limited to, optical media (such as CDs or DVDs), USB thumb drives, media cards, and external hard-drives. Any exceptions such as backup tapes and camera memory cards are documented in the Buyer approved Security Plan.

2.1.21 1. The Seller does not use unapproved third party software distribution websites (such as tucows.com) in obtaining operating system update files or antivirus definition files.

2. Source files for the updates to operating system and anti-virus software definitions that the Seller installs are obtained from commercial software manufacturer’s website or from media provided by the commercial software manufacturer or their authorized distributor.

3. Integrity is validated where applicable (i.e. SHA-256 hash sum).

2.1.22 Access to the e-Commerce website is conducted using the approved guidelines for the e-Commerce system and the approved e-Commerce user agreement. This computer is not a part of the U-NNPI system.

2.1.23 1. Access to U-NNPI information via CipherShare, or equivalent system approved for the secure communication of U-NNPI data, is conducted using a dedicated computer with an internet connection and boundary defenses that meet the requirements of NN-801.

2. The dedicated computer is not part of the U-NNPI system or able to communicate with the corporate network.

3. U-NNPI files are not stored or processed on the dedicated computer outside of the CipherShare application.

U-NNPI STANDALONE NETWORK

DATE PREPARED AND AUTHOR:

This checklist must be completed to confirm compliance with the applicable contract security requirements.

4. U-NNPI uploads to the CipherShare application are conducted directly from encrypted media to the CipherShare application.

5. U-NNPI downloads from the CipherShare application are saved directly to encrypted media and transferred to the U-NNPI system for processing.

6. The process for accessing CipherShare, or equivalent system approved for the secure communication of U-NNPI data, is documented in the Buyer approved Security Plan.

Notes / Comments

Seller Acknowledgement The undersigned certifies that the IT system referenced on this checklist meets the requirements in AOR-NN-801-U-NNPI- STANDALONE NETWORK dated June 11, 2014 and the specific U-NNPI Information System Protection Requirements as indicated by this completed checklist.

This checklist is submitted for Buyer Approval

This checklist is submitted as the yearly self-assessment for Buyer information

<Insert Name, Title> Date

U-NNPI STANDALONE NETWORK

DATE PREPARED AND AUTHOR:

This checklist must be completed to confirm compliance with the applicable contract security requirements.

BUYER APPROVAL OF THE CHECKLIST

I approve the checklist and the IT system may process U-NNPI information.

I DO NOT approve the checklist and the IT system may NOT process U-NNPI

COMMENTS

Buyer Acknowledgement The undersigned Buyer representative certifies that the IT system information referenced on this checklist meets the requirements as listed in AOR-NN-801-U-NNPI-STANDALONE NETWORK dated June 11, 2014 and the specific U-NNPI Information System Protection Requirements as indicated by this completed checklist. Based on the information provided in this checklist the Buyer approves the IT system to process U-NNPI data.

RETAIN A COPY AND FORWARD THE COMPLETED CHECKLIST TO THE SECURITY OFFICE AT BUYER

CONCURRENCE RECORD SHEET: Document No. SD-SSO-00848 ADSARS Yes x No

*NTK AND KEY WORDS ARE MANDATORY FOR ADSARS DOCUMENTS AND ARE TO BE COMPLETED BY MANAGER OR AUTHOR

NTK Site – Category

PRNR-GEN

Key Words: (i.e., Doc. Type, Plant, Core, Product, etc): NN-801, AOR, Revision 2

NR Program: LSN Key Words:

Licensing Support Network (LSN) Related: (APPLIES TO YUCCA MOUNTAIN WORK) Yes No X

Check the one(s) that applies

LSN - Relevant LSN - Segregate and Retain Retain for Waste Acceptance LSN - Not Relevant

Check here if this document invokes a legal privilege

RELATED SUBJECTS (Check only those that apply)

Subject Subject

Design Basis Information Prior NR Program Experience Discussed

NR Commitments Made Drawing Change(s) Required

NR Commitment Completed Manual Change Required

Bettis/BPMI Input Required Reactor Safety Review Applicable

Equipment Change(s) Required or Potentially Required ROSC, RDSC, NFSC, etc. Reviews

Were Lessons Learned, Design Notes, etc. reviewed Design Reviews

Previous NR Comments Resolved Other

DESIGN CHECKS:

a. Check by comparison with previous results h. Comparison with results from other groups n. Review of design consideration

b. Hand calculation of selected points i. Brief review that no major discrepancies exist o. Review of assumptions used

c. Check of computer output for selected problem j. Check by calculation using different methods p. Final results appear consistent

d. Check of computer input for selected problems k. Complete audit by reviewer q. No check considered necessary

e. Independent computer calculation l. Review of data with author to determine adequacy of methods and results

r. Walkthrough of procedure

f. Separate audit by assigned engineer s. Certification status of computer codes

g. Comparison with experimental results m. Review changes from last time t. Other

Type of check Classification Check Peer Check 1 Managerial Check

(if applicable) Author Final Check

Signature

Name Robert E. Shades Carina B. Defloria Anthony J. Bradfield Robert E. Shades

Date June 25, 2014 June 25, 2014 June 25, 2014 June 25, 2014

Design Check(s)

Comments

Type of check Admin Review

Signature

Name Nancy Zeglen

Date June 25, 2014

Design Check(s)

Comments

For Action from by x For Information Only

Document No. SD-SSO-00848

Subject:

Release of Revision 2 of the NN-801 Additional Ordering Requirements; For Purchase Order Use and NR Information

ELECTRONIC DISTRIBUTION

(Use for Prime Contractor Personnel & Customer Electronic Mailboxes)

(Consult the Electronic Correspondence NR Distribution Requirements Site)

Bettis KAPL BPMI

K. M. Andreos G. V. Hogan M. L. Stevenson

T. Bradfield E. L. Reinsel R. E. Shades

R. N. Edwards-Gressem D. L. Smith M. J. Ferrero

D. J. Bonanno H. J. Cichon

B. W. Trottier J. E. Tirpak

R. E. Boyer

D. D. Horne

D. A. Hein

F. T. Chen

D. R. Lackey

J. A. Coll

R. N. Balta

R. E. Owens

B. A. Campitella

S. W. Iams

C. B. DeFloria

T. J. McDonald

ANSTR

T. M. Stuhldreher

NRLFO-PGH NRLFO-SCH NR

J. C. Stone S. Bowen V. R. Foulk

M. T. Filipiak G. Waldron S. M. Boaman

J. P. Maletta R. Brown J. M. Easter

E. O. Dias J. Reville J. W. Melone

T. A. Pietrowski

T. M. Weis

PAPER DISTRIBUTION

No. of Copies

No. of Copies

Manager, NRLFO 1

S. Trautman – NAVSEA 08B 1

R. A. Glas – NAVSEA 08H 1