Text

License Amendment Withdrawal and Request - Cyber Security Plan
	ML102240483
Person / Time
Site:	Arkansas Nuclear
Issue date:	07/09/2010
From:	Walsh K; Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	0CAN071001
	Download: ML102240483 (19)
	v • d • e

En tergy Entergy Operations, Inc.

1448 S.R. 333 Russellville, AR 72802 Tel 479-858-3110 Kevin T. Walsh Vice President, Operations Arkansas Nuclear One OCAN071 001 July 9, 2010 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

License Amendment Withdrawal and Request - Cyber Security Plan Arkansas Nuclear One - Units 1 and 2 Docket Nos. 50-313 and 50-368 License Nos. DPR-51 and NPF-6

Reference:

1. Entergy letter dated November 18, 2009 (OCAN110901), License Amendment Request - Cyber Security Plan

2. NRC letter dated May 14, 2010 (OCNA051001), License Amendment Request for Approval of the Cyber Security Plan (TAC Nos. ME2727 and ME2728)

3. NRC letter to Nuclear Energy Institute (NEI) dated June 7, 2010, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors"

Dear Sir or Madam:

In accordance with the 60-day request provided in Reference 2, Entergy Operations, Inc.

(Entergy) is hereby withdrawing the request for an amendment to each of the operating licenses for Arkansas Nuclear One (ANO), Units 1 and 2 as submitted in Reference 1, and in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Entergy is submitting a new request for an amendment to each of the operating licenses for ANO-1 and ANO-2. The proposed amendments request NRC approval of the common ANO Cyber Security Plan, provides an implementation schedule, and revises the existing operating licenses' Physical Protection license condition to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan for each unit. Entergy utilized NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, in development of the ANO Cyber Security Plan which resolves the NRC's generic issues (Reference 2) with the previous submittal (Reference 1). In addition, Entergy is also providing a detailed milestone implementation schedule as requested. Therefore, this submittal supersedes, in its entirety, the previous submittal (Reference 1).

This lettor eanteins seeurfity sensitivoifrmto Attachmon~tc 4, 5, and 6 EIrc Withhcld frcm publia.islesurc- p. r 10CFR2.390

OCAN071 001 Page 2 of 3 provides an evaluation of the proposed change. Attachment 2 provides the existing ANO-1 and ANO-2 operating license pages marked-up to show the proposed change. Attachment 3 provides the proposed operating license changes in final typed format for both of the ANO units. Attachment 4 provides the list of new regulatory commitments made in this submittal. Attachment 5 provides the ANO Cyber Security Plan implementation schedule. Attachment 6 provides a copy of the ANO Cyber Security Plan which is a standalone document that has been incorporated by reference into the ANO Security Plan.

In addition, Entergy is utilizing the definition of "cyber attack" as delineated in Reference 3.

Entergy requests that Attachments 4, 5, and 6, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

The proposed changes have been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration. The bases for these determinations are included in .

Entergy requests this license amendment be effective as of its date of issuance. Once approved, the amendment will be implemented in accordance with the approved implementation schedule. Although this request is neither exigent nor emergency, your review is requested within approximately one year of this submittal.

If you have any questions or require additional information, please contact David Bice at 479.858.5338.

I declare under penalty of perjury that the foregoing is true and correct. Executed on July 9, 2010.

Sincerely, Originalsigned by Kevin T. Walsh KTW/nbm Attachments: 1. Analysis of Proposed Operating License Change

2. Proposed ANO-1 and ANO-2 Operating License Changes (mark-up)

3. Revised ANO-1 and ANO-2 Operating License Pages

4. List of Regulatory Commitments

5. Implementation Schedule

6. ANO Cyber Security Plan Th-is letter eamteims seetrit' sensitive information Mtachmonts 41, 5, and- 6-aro-withhed 49 public diSGloSuro per 1OCF=R2 2300

OCAN071001 Page 3 of 3 cc: Mr. Elmo Collins Regional Administrator U. S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 NRC Senior Resident Inspector Arkansas Nuclear One P.O. Box 310 London, AR 72847 U. S. Nuclear Regulatory Commission Attn: Mr. Kaly Kalyanam MS 0-8 B1 One White Flint North 11555 Rockville Pike Rockville, MD 20852 Mr. Bernard R. Bevill Arkansas Department of Health Radiation Control Section 4815 West Markham Street Slot #30 Little Rock, AR 72205

,,*mI 4* i

A JJ I I A

I

n1 cuor ocntoinAS sccuriffl cone11V !R;Gvo :RAGmonts A.fo-mAtton 4, 5, andi 6 are 'w-ithhold from publie dicolocuro per IOCFR2.390

Attachment 1 OCAN071001 Analysis of Proposed Operating License Change to 0CAN071 001 Page 1 of 4 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed Arkansas Nuclear One (ANO) Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed ANO Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition for both ANO units to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved ANO Cyber Security Plan as required by 10 CFR 73.54. Federal Register notice dated March 27, 2009, issued the final rule that amended 10 CFR Part 73. The regulations in 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74FR1 3926 (Reference 1).

3.0 TECHNICAL EVALUATION

FederalRegister notice 74FR1 3926 issued the final rule that amended 10 CFR Part 73.

Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v). These requirements are more in depth than the requirements imposed by NRC Order EA-02-026 (Reference 2).

This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, dated April 2010, for use by licensees in development of their own cyber security plans. A deviation to Appendix B of NEI 08-09, Revision 6 is the use of a revised definition of "cyber attack" as delineated in NRC letter dated June 7, 2010 (Reference 3). The revised definition of cyber attack is "any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a critical digital asset."

This LAR includes the proposed ANO Cyber Security Plan (Attachment 6) that conforms to the template provided in Appendix A of NEI 08-09, Revision 6. In addition, the LAR includes the proposed change to the existing operating license condition for "Physical Protection" (Attachments 2 and 3) for both of the ANO units. The LAR contains the proposed implementation schedule (Attachment 5) as required by 10 CFR 73.54. The LAR also provides a list of regulatory commitments (Attachment 4).

to OCAN071 001 Page 2 of 4

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria This license amendment request is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a cyber security plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 Significant Safety Hazards Consideration Entergy Operations, Inc. (Entergy) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for Arkansas Nuclear One (ANO), Units 1 and 2. The ANO Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The ANO Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents. The ANO Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection. Both of these changes are administrative in nature and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for ANO. The ANO Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected.

The ANO Cyber Security Plan does not require any plant modifications which affect to OCAN071 001 Page 3 of 4 the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents. The ANO Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection. Both of these changes are administrative in nature and do not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for ANO. Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. Because there is no change to these established safety margins as result of the implementation of the ANO Cyber Security Plan, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection. Both of these changes are administrative in nature and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10CFR50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Conclusion In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

to OCAN071 001 Page 4 of 4

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Cyber Security Program for ANO and will be a part of the ANO Cyber Security Plan. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(1 2). Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74FR13926'

2. Federal EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002

3. NRC letter to NEI dated June 7, 2010, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors"

Attachment 2 OCAN071 001 Proposed ANO-1 and ANO-2 Operating License Changes (mark-up)

EOI shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved ANO Cyber Security Plan submitted by letter dated July 9, 2010.

(5) Implementation of the Improved Technical Specifications (ITS)

The licensee is authorized to relocate certain Technical Specification requirements previously included in Appendix A to licensee controlled documents, as described in Table R, Relocated Specifications, and Table LA, Removal of Details, attached to the Safety Evaluation for Amendment No. 215. These requirements shall be relocated to the appropriate documents as part of the implementation of the ITS.

The schedule for performing Surveillance Requirements (SRs) that are new or revised in Amendment No. 215 shall be as follows:

1. For SRs that are new in this amendment, the first performance shall be due at the end of the first surveillance interval, which begins on the date of implementation of this amendment.

2. For SRs that existed prior to this amendment whose intervals of performance are being reduced, the first reduced surveillance interval shall begin upon completion of the first surveillance performed after implementation of this amendment.

3. For SRs that existed prior to this amendment that contained modified acceptance criteria, the performance shall be due at the end of the first surveillance interval that began on the date the surveillance was last performed prior to the implementation of this amendment.

4. For SRs that existed prior to this amendment whose interval of performance are being extended, the first extended surveillance interval shall begin upon completion of the last surveillance performed prior to the implementation of this amendment.

(6) Deleted (7) Deleted Renewed License No. DPR-51 Amendment No. 245-Revised by letto, r datodO too*r 28, 2004, November 22, 200,1,ebruar,' 7, 2007,

8 D. Physical Protection EOI shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans, including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Arkansas Nuclear One Physical Security, Safeguards Contingency and Training & Qualification Plan," as submitted on May 4, 2006.

EOI shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved ANO Cyber Security Plan submitted by letter dated July 9, 2010.

E. This renewed license is subject to the following additional condition for the protection of the environment:

Before engaging in additional construction or operational activities which may result in an environmental impact that was not evaluated by the Commission, EOI will prepare and record an environmental evaluation for such activity. When the evaluation indicates that such activity may result in a significant adverse environmental impact that was not evaluated, or that is significantly greater than that evaluated, in the Final Environmental Statement (NUREG-0254) or any addendum thereto, and other NRC environmental impact assessments, EOI shall provide a written evaluation of such activities and obtain prior approval from the Director, Office of Nuclear Reactor Regulation.

F. Updated Final Safety Analysis Report Supplement The Final Safety Analysis Report supplement, as revised, shall be included in the next scheduled update to the Final Safety Analysis Report required by 10 CFR 50.71 (e)(4) following issuance of this renewed license. Until that update is complete, ANO-2 may make changes to the programs and activities described in the supplement without prior Commission approval, provided that ANO-2 evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements of that section.

The ANO-2 Final Safety Analysis Report supplement, submitted pursuant to 10 CFR 54.21(d), describes certain future activities to be completed prior to the period of extended operation. ANO-2 shall complete these activities no later than July 17, 2018, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

G. Reactor Vessel Material Surveillance Capsules Moved All capsules in the reactor vessel that are removed and tested must meet the test to procedures and reporting requirements of American Society for Testing and Page 9 Materials (ASTM) E 185-82 to the extent practicable for the configuration of the specimens in the capsule. Any changes to the capsule withdrawal schedule, including spare capsules, must be approved by the NRC prior to implementation.

All capsules placed in storage must be maintained for future insertion.

Renewed License No. NPF-6 Amendment No. 2-8k,

9 G. Reactor Vessel Material Surveillance Capsules Moved All capsules in the reactor vessel that are removed and tested must meet the test from procedures and reporting requirements of American Society for Testing and Page 8 Materials (ASTM) E 185-82 to the extent practicable for the configuration of the specimens in the capsule. Any changes to the capsule withdrawal schedule, including spare capsules, must be approved by the NRC prior to implementation.

All capsules placed in storage must be maintained for future insertion.

4. This renewed license is effective as of the date of issuance and shall expire at midnight, July 17, 2038.

FOR THE NUCLEAR REGULATORY COMMISSION Originalsigned by J. E. Dyer J. E. Dyer, Director Office of Nuclear Reactor Regulation Attachments:

1. Appendix A - Technical Specifications

2. Preoperational Tests, Startup Tests and other items which must be completed by the indicated Operational Mode Date of Issuance: June 30, 2005 Renewed License No. NPF-6 Amendment No. 288,

Attachment 3

OCAN071001 Revised ANO-1 and ANO-2 Operating License Pages