BVY 10-036, Technical Specifications Proposed Change No. 292, License Amendment Withdrawal and Request - Cyber Security Plan

Technical Specifications Proposed Change No. 292, License Amendment Withdrawal and Request - Cyber Security Plan

ML102010393
Person / Time
Site:	Vermont Yankee
Issue date:	07/16/2010
From:	Michael Colomb Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation, Office of Nuclear Security and Incident Response
References
BVY 10-036, TAC ME2138, TAC ME2744, TAC ME2745, TAC ME2747, TAC ME2802, TAC ME2743
Download: ML102010393 (12)

Text

Entergy Nuclear Operations, Inc.

Entergy Vermont Yankee 320 Governor'Hunt Rd Vernon, VT 05354 Tel 802 257 7711 This letter contains Security-Related Information Attachments 4, 5, and 6 are withheld from public disclosure under 10CFR2.390 Michael J. Colomb Site Vice President BVY 10-036 July 16, 2010 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555

SUBJECT:

Technical Specifications Proposed Change No. 292 License Amendment Withdrawal and Request - Cyber Security Plan Vermont Yankee Nuclear Power Station Docket No. 50-271 License No. DPR-28

REFERENCE:

1. Letter, Entergy Nuclear Operations, Inc. to USNRC, "Proposed Change 286 - Vermont Yankee Cyber Security Plan Submittal," BVY 09-064, dated November 19, 2009.

2. Letter, USNRC to Entergy Nuclear Operations, Inc., "Entergy Nuclear Operations, Inc. Cyber Security Plan - James A. Fitzpatrick Nuclear Power Plant, Indian Point Generating Unit Nos. 1, 2, and 3, Pilgrim Nuclear Power Station, and Vermont Yankee Nuclear Power Station (TAC Nos. ME2802, ME2743, ME 2744, ME 2745, ME2747, and ME2138)," dated May 17, 2010.

3. Letter, USNRC to Nuclear Energy Institute, "Nuclear Energy Institute 08-09, Cyber Security Plan Template, Rev. 6," dated June 7, 2010.

Dear Sir or Madam:

In accordance with the 60-day request provided in Reference 2, Entergy Nuclear Operations, Inc. (Entergy) is hereby withdrawing the request for an amendment to the operating license for Vermont Yankee Nuclear Power Station (VY) as submitted in Reference 1, and in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Entergy is submitting a new request for an amendment to the operating license for VY. The proposed amendment requests NRC approval of the VY Cyber Security Plan, provides an implementation schedule, and revises the existing operating license Physical Protection license condition to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan. Entergy utilized NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, in development of the VY Cyber Security Plan which resolves the NRC's generic issues (Reference 2) with the previous amendment request (Reference 1). In addition, Entergy is

BVY 10-036 / Page 2 of 3 This letter contains Security-Related Information Attachments 4, 5, and 6 are withheld from public disclosure under 10CFR2.390 providing a detailed milestone implementation schedule as requested. Therefore, this submittal supersedes, in its entirety, the previous amendment request (Reference 1). provides an evaluation of the proposed change. Attachment 2 provides the existing VY operating license page marked-up to show the proposed change. Attachment 3 provides the proposed operating license changes in final typed format. Attachment 4 provides the list of regulatory commitments. Attachment, 5 provides the VY Cyber Security Plan implementation schedule. Attachment 6 provides a copy of the VY Cyber Security Plan which is a stand alone document that has been incorporated by reference into the VY Security Plan. In addition, Entergy is utilizing the definition of "cyber attack" as delineated in Reference 3.

Entergy requests that Attachments 4, 5, and 6, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

The proposed changes have been evaluated in accordance with 10 CFR 50.91(a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration. The bases for these determinations are included in Attachment 1.

Entergy requests this license amendment be effective as of its date of issuance. Once approved, the amendment will be implemented in accordance with the approved implementation schedule. Although this request is neither exigent nor emergency, your review is requested within approximately one year.

In accordance with 10 CFR 50.91, a copy of this application, without Attachments 4, 5 and 6, is being provided to the designated Vermont Official.

A new regulatory commitment is identified in Attachment 4.

If you should have any questions regarding this submittal, please contact Mr. James DeVincentis at 802-451-3150.

I declare under penalty of perjury that the foregoing is true and correct. Executed on July 16, 2010.

Sincerely,

[MJC/PLC] : Evaluation of the Proposed Change : 'Marked up Facility Operating License Pages : Retyped Facility Operating License Pages : List of Regulatory Commitments : Implementation Schedule : Vermont Yankee Cyber Security Plan

BVY 10-036 / Page 3 of 3 cc: Regional Administrator, Region 1 (w/o Attachments)

U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, PA 19406-1415 Mr. James S. Kim, Project Manager Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop O-8-C2 Washington, DC 20555 USNRC Resident Inspector (w/o Attachments)

Entergy Nuclear Vermont Yankee, LLC 320 Governor Hunt Road Vernon, Vermont 05354 Mr. David O'Brien, Commissioner (w/o Attachments 4, 5 and 6)

Vermont Department of Public Service 112 State Street - Drawer 20 Montpelier, Vermont 05620-2601

BVY 10-036 Docket No. 50-271 Attachment 1 Vermont Yankee Nuclear Power Station Proposed Change 292 Evaluation of the Proposed Change

BVY 10-036 / Attachment 1 / Page 1 of 4 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed Vermont Yankee Cyber Security Plan (Plan), an Implementation Schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed Plan, an Implementation Schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition to require Entergy Nuclear Operations Inc. (Entergy) to fully implement and maintain in effect all provisions of the Commission approved cyber security plan as required by 10 CFR 73.54. FederalRegister notice, dated March 27, 2009 issued the final rule that amended 10 CFR Part 73. The regulations in 10 CFR 73.54, "Protection of digital computer and communication systems and networks," establish the requirements for a cyber security program.

This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1).

3.0 TECHNICAL EVALUATION

Federal Register notice 74 FR 13926 issued the final rule that amended 10 CFR Part 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer, communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v). These requirements are more in depth than the requirements imposed by EA-02-026 (Reference 2).

This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors,"

Revision 6, dated April 2010, for use by licensees in development of their own cyber security plans. A deviation to Appendix B of NEI 08-09, Revision 6 is the use of a revised definition of "cyber attack" as delineated in NRC letter dated June 7, 2010 (Reference 3). The revised definition of cyber attack is "any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a critical digital asset."

This LAR includes the proposed Plan (Attachment 6) that conforms to the template provided in NEI 08-09. In addition the LAR includes the proposed change to the existing operating license condition for "Physical Protection" (Attachments 2 and 3). Finally, the LAR contains the proposed implementation schedule (Attachment 5) as required by 10 CFR 73.54.

BVY 10-036 / Attachment 1 / Page 2 of 4

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS / CRITERIA This LAR is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 SIGNIFICANT HAZARDS CONSIDERATION Entergy Nuclear Operations, Inc. (Entergy) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for Vermont Yankee Nuclear Power Station (VY). The VY Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents. The VY Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The VY Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for VY. The VY Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigates the consequences of postulated accidents. The VY Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated,

BVY 10-036 / Attachment 1 / Page 3 of 4 maintained, modified, tested, or inspected. The VY Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and do not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility, of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for VY. Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. Because there is no change to these established safety margins as result of the implementation of the VY Cyber Security Plan, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 1 OCFR50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

BVY 10-036 / Attachment 1 / Page 4 of 4

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Cyber Security Program for VY and will be a part of the VY Cyber Security Plan. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(1 2). Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

3. Letter, USNRC to Nuclear Energy Institute, "Nuclear Energy Institute 08-09, Cyber Security Plan Template, Rev. 6," dated June 7, 2010.

BVY 10-036 Docket No. 50-271 Attachment 2 Vermont Yankee Nuclear Power Station Proposed Change 292 Marked up Facility Operating License Pages

c. A verification or coding system for emergency messages between Entergy Nuclear Operations, Inc. and the state police headquarters of the respective states and the Commonwealth.

14. Entergy Nuclear Operations, Inc. shall furnish advance notification to MDPH, or to another Commonwealth agency designated by MDPH, of the time, method and proposed route through the Commonwealth of any shipments of nuclear fuel and wastes to and from the Vermont Yankee facility which will utilize railways or roadways in the Commonwealth.

F. Entergy Nuclear Operations, Inc. shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated January 13, 1978, and supplemental SERs, dated 9/12/79, 2/20/80, 4/15/80, 7/3/80, 10/24/80, 11/10/81, 1/13/83, 7/24/84, 3/25/86, 12/1/86, 12/8/89, 11/29/90, 8/30/95, 3/23/97, 6/9/97, 8/12/97, 3/6/98, 3/31/98, 9/2/98, and 2/24/99, subject to the following provisions:

Entergy Nuclear Operations, Inc. may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G. Security Plan Entergy Nuclear Operations, Inc. shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans 1 , which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Vermont Yankee Nuclear Power Station Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan,

. Revision 0," submitted by letter dated October 18, 2004, as supplemented by letter dated May 16, 2006.

/ Entergy Nuclear Operations, Inc. shall fully implement and maintain in effect all provisions of the KCommission-approved Vermont Yankee Cyber Security Plan submitted by letter dated July 16, The Training and Qualification Plan and Safeguards Contingency Plan are Appendices to the Security Plan.

Amendrient No. 1n07, -68, 206,208 Revised by Iettor dated Oc5tober 28, 2004 Revised by letter dated F.b.u.. 18, 20 Revi!! edted ApI U, F

BVY 10-036 Docket No. 50-271 Attachment 3 Vermont Yankee Nuclear Power Station Proposed Change 292 Retyped Facility Operating License Pages

c. A verification or coding system for emergency messages between Entergy Nuclear Operations, Inc. and the state police headquarters of the respective states and the Commonwealth.

14. Entergy Nuclear Operations, Inc. shall furnish advance notification to MDPH, or to another Commonwealth agency designated by MDPH, of the time, method and proposed route through the Commonwealth of any shipments of nuclear fuel and wastes to and from the Vermont Yankee facility which will utilize railways or roadways in the Commonwealth.

F. Entergy Nuclear Operations, Inc. shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated January 13, 1978, and supplemental SERs, dated 9/12/79, 2/20/80, 4/15/80, 7/3/80, 10/24/80, 11/10/81, 1/13/83, 7/24/84, 3/25/86, 12/1/86, 12/8/89, 11/29/90, 8/30/95, 3/23/97, 6/9/97, 8/12/97, 3/6/98, 3/31/98, 9/2/98, and 2/24/99, subject to the following provisions:

Entergy Nuclear Operations, Inc. may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G. Security Plan Entergy Nuclear Operations, Inc. shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10.CFR 50.90 and 10 CFR 50.54(p). The combined set of plans 1 , which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Vermont Yankee Nuclear Power Station Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision 0," submitted by letter dated October 18, 2004, as supplemented by letter dated May 16, 2006.

Entergy Nuclear Operations, Inc. shall fully implement and maintain in effect all provisions of the Commission-approved Vermont Yankee Cyber Security Plan submitted by letter dated July 16, 2010.

'The Training and Qualification Plan and Safeguards Contingency Plan are Appendices to the Security Plan.

Amendment No..07.,168, 206.. 28 Revised by letter dated October 28, 2004 Revised by Ictter dated FebFUa~' 18, 2005 Revised by IctteF dated April 5, 2007