DCL-10-002, License Amendment Request 09-05, Request for Approval of the Cyber Security Plan and Revision to the Facility Operating Licenses

License Amendment Request 09-05, Request for Approval of the Cyber Security Plan and Revision to the Facility Operating Licenses

ML100270224
Person / Time
Site:	Diablo Canyon
Issue date:	01/20/2010
From:	Becker J Pacific Gas & Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
DCL-10-002, LAR 09-005, OL-DPR-80, OL-DPR-82
Download: ML100270224 (11)

Text

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED SENSITIVE INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Pacific Gas and Electric Company James R.Becker Diablo Canyon Power Plant Site Vice President Mail Code 104/5/601 P.0. Box 56 Avila Beach, CA 93424 805.545.3462 Internal: 691.3462 Fax: 805.545.6445 January 20, 2010 PG&E Letter DCL-10-002 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Diablo Canyon Units 1 and 2 Docket No. 50-275, OL-DPR-80 Docket No. 50-323, OL-DPR-82

SUBJECT:

License Amendment Request 09-05, Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan and Revision to the Facility Operating Licenses On November 20, 2009, Pacific Gas and Electric Company (PG&E) submitted PG&E Letter DCL-09-082, "License Amendment Request 09-05, Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan and Revision to the Facility Operating Licenses."

As a result of subsequent discussions between the NRC Staff and the Nuclear Energy Institute on December 9, 2009, concerning information in the No Significant Hazards Consideration (NSHC), PG&E has revised the NSHC in Enclosure 1.

Additionally, Enclosure 1 of DCL-09-082 was marked such that it could be withheld from public disclosure in accordance with 2.390. Enclosure 1 is no longer marked to be withheld from public disclosure. This letter and license amendment request supersede DCL-09-082 in its entirety.

In accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, PG&E hereby requests approval of the enclosed proposed amendment to Facility Operating License (FOL) Nos. DPR-80 and DPR-82 for Units 1 and 2 of the Diablo Canyon Power Plant (DCPP) respectively. The enclosed license amendment requests NRC approval of the DCPP Cyber Security Plan, provides an implementation schedule, and adds a sentence to the existing DCPP Composite FOL Physical Protection license condition to require PG&E to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan.

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED C)

SENSITIVE INFORMATION -WITHHOLD UNDER 10 CFR 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• DiabloCanyon

• PaloVerde

• San Onofre

• South Texas Project

• Wolf Creek

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Document Control Desk PG&E Letter DCL-10-002 January 20, 2010 Page 2 Enclosure 1 provides an evaluation of the proposed change. Enclosure 1 also contains the following attachment:

Attachment 1 provides the existing FOL pages marked up to show the proposed change.

Enclosure 2 provides a copy of the DCPP Cyber Security Plan Implementation Schedule. The actions and dates on the schedule are regulatory commitments.

Enclosure 3 provides a copy of the DCPP Cyber Security Plan, which is a standalone document that will be incorporated by reference into the DCPP Physical Security Plan upon approval.

Enclosures 2 and 3 contain security-related sensitive information, which could reasonably be expected to be useful to potential adversaries. PG&E requests that Enclosures 2 and 3 be withheld from public disclosure in accordance with 10 CFR 2.390.

PG&E requests a period of 90 days for license amendment implementation following NRC approval of the license amendment.

If you have any questions, or require additional information, please contact Mr. Thomas Baldwin at (805) 545-4720.

I state under penalty of perjury that the foregoing is true and correct.

Executed on January 20, 2010.

ASincere y, James R. ,ker Site Vice President Enclosure 1 - Evaluation of Proposed Change Enclosure 2 - DCPP Cyber Security Plan Implementation Schedule Enclosure 3 - DCPP Cyber Security Plan ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• San Onofre

• South Texas Project

• Wolf Creek

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Document Control Desk PG&E Letter DCL-10-002 January 20, 2010 Page 3 mjrm/4557/N50280795/N50287698 Enclosure cc: Gary W. Butner, Acting Branch Chief, California Department of Public Health Elmo E. Collins, NRC Region IV Michael S. Peck, NRC, Senior Resident Inspector Diablo Distribution cc/enc: Alan B. Wang, Project Manager, Office of Nuclear Reactor Regulation ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway Comanche Peak

• DiabloCanyon

• PaloVerde - San Onofre - South Texas Project

• Wolf Creek

Enclosure 1 PG&E Letter DCL-10-002 Evaluation of Proposed Change Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan 1.0 Summary Description 2.0 Detailed Description 3.0 Technical Evaluation 4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements / Criteria 4.2 Significant Hazards Consideration 5.0 Environmental Consideration 6.0 References ATTACHMENT: - Marked-up Facility Operating License (FOL) pages 1

Enclosure I PG&E Letter DCL-10-002 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed DCPP Cyber Security Plan (Plan), an Implementation Schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed Plan, an Implementation Schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition to require PG&E to fully implement and maintain in effect all provisions of the Commission-approved Plan as required by 10 CFR 73.54. The regulations in 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks," establish the requirements for a cyber security program (Program). This regulation specifically requires each licensee currently licensed to~operate a nuclear power plant under Part 50 of this chapter to submit a Plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's Program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1).

3.0 TECHNICAL EVALUATION

FederalRegister notice 74 FR 13926 issued the final rule that amended 10 CFR 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat (DBT) established by 10 CFR 73.1 (a)(1)(v).

These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

This LAR includes the proposed Plan (Enclosure 3) that is consistent with the template provided in industry document NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 3, dated September 2009. In addition the LAR includes the proposed change to the existing FOL condition for "Physical Protection" (Attachment 1). Finally, the LAR contains the proposed Implementation Schedule (Enclosure 2) as required by 10 CFR 73.54.

2

Enclosure 1 PG&E Letter DCL-10-002

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS I CRITERIA This LAR is submitted pursuant to 10 CFR 73.54, which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 SIGNIFICANT HAZARDS CONSIDERATION Pacific Gas and Electric Company (PG&E) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:-

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment incorporates a new requirement in the Facility Operating License (FOL) to implement and maintain a Cyber Security Plan as part of the facility's overall program for physical protection.

Inclusion of the Cyber Security Plan in the FOL itself does not involve any modifications to the safety-related structures, systems or components (SSCs). Rather, the Cyber Security Plan describes how the requirements of 10 CFR 73.54 are to be implemented to identify, evaluate, and mitigate cyber attacks up to and including the design basis cyber attack threat, thereby achieving high assurance that the facility's digital computer and communications systems and networks are protected from cyber attacks.

The Cyber Security Plan (Plan) will not alter previously evaluated Final Safety Analysis Report (FSAR) design basis accident analysis assumptions, add any accident initiators, or affect the function of the plant safety-related SSCs as to how they are operated, maintained, modified, tested, or inspected. Any plant modifications necessary to implement the Plan will be evaluated pursuant to 10 CFR 50.59 to assure they will not alter previously evaluated Final Safety Analysis Report (FSAR) design basis accident analysis assumptions, add any accident initiators, or affect the function of the plant safety-related SSCs as to how they are operated, maintained, modified, tested, or inspected. Further amendments to the operating licenses will be pursued as necessary based on the results of these evaluations.

3

Enclosure 1 PG&E Letter DCL-10-002 Therefore, the proposed amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different accident. from any accident previously evaluated?

Response: No.

This proposed amendment provides assurance that safety-related SSCs are protected from cyber attacks. Implementation of 10 CFR 73.54 and the inclusion of a plan in the FOL do not result in the need of any new or different FSAR design basis accident analysis. As noted above, any plant modifications necessary to implement the Plan will be evaluated pursuant to 10 CFR 50.59 to assure they do not introduce new equipment that could create a new or different kind of accident, and no new equipment failure modes are created. Further amendments to the operating licenses will be pursued as necessary based on the results of these evaluations.

As a result, no new accident scenarios, failure mechanisms, or limiting single failures will be introduced as a result of this proposed amendment.

Therefore, the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The margin of safety is associated with the confidence in the ability of the fission product barriers (i.e., fuel cladding, reactor coolant pressure boundary, and containment structure) to limit the level of radiation to the public. The proposed amendment would not alter the way any safety-related SSC functions and would not alter the way the plant is operated.

The amendment provides assurance that safety-related SSCs are protected from cyber attacks. The proposed amendment would not introduce any new uncertainties or change any existing uncertainties associated with any safety limit. The proposed amendment would have no impact on the structural integrity of the fuel cladding, reactor coolant pressure boundary, or containment structure. Based -on the above considerations, the proposed amendment would not degrade the confidence in the ability of the fission product barriers to limit the level of radiation to the public.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

4

Enclosure 1 PG&E Letter DCL-1 0-002 Based on the above, PG&E concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Program for DCPP and will be a part of the Physical Security Plan. This proposed amendment will not involve any significant construction impacts. PG&E has evaluated the proposed amendment and has determined that the proposed amendment does not involve: (1) a significant hazards consideration, (2) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (3) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

5

Enclosure 1 PG&E Letter DCL-10-002.

Attachment I Proposed Facility Operating License Change (Mark-Up)

Insert the following text within the current FOL condition for Physical Protection and after its existing text:

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated January 20, 2010, and withheld from public disclosure in accordance with10 CFR 2.390.

I

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the. Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and, 27822) and to the authority of, 10 CFR 50.90 and 10 CFR 50.54 (p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Diablo Canyon Power Plant, Units 1 and 2 Physical Security Plan, by Training and Qualification Plan, and Safeguards Contingency Plan," submitted by, letter dated May 16, 2006.

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated January 20, 2010, and withheld from public disclosure in, accordance with 10 CFR 2.390.

F. Deleted.

G. Deleted.

H. Financial Protection PG&E shall have and maintain financialprotection of such type and in such amounts as the Commission shall require in accordance with Section 170'of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

1. Mitigation Strateqy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Firefighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance

2. Assessment of mutual aid fire fighting assets

3. Designated staging areas for equipment and materials

4. Command and control

5. Training of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets

2. Communications

3. Minimizing fire spread

4. Procedures for implementing integrated fire response strategy

5. Identification of readily-available pre-staged equipment

6. Training on integrated fire response strategy

7. Spent fuel-pool mitigation measures DCPP resubmit Operating License U1.doc R43 Page 11 of 12 License No. DPR-80

D. Exemption (SSER 31, Section 6.2.6)

An exemption from certain requirements of Appendix J to 10 CFR Part 50 is described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 9. This exemption is authorized by law and will not endanger life or property or the common defense and security and is otherwise in the public interest. Therefore, this exemption previously granted in Facility Operating License No. DPR-81 -pursuant to 10 CFR 50.12 is hereby reaffirmed. The facility will operate, with the exemption authorized, in conformity with the application, as amended, the provisions of the Act, and the regulations of the Commission.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Diablo Canyon Power Plant, Units 1 and 2 Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan," submitted by letter dated May 16, 2006.

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated January 20, 2010, and withheld from public disclosure in accordance with 10 CFR 2.390.

F. Deleted.

G. Deleted.

DCPP resubmit Operating License U2.doc R45 Page 8 of 9 License No. DPR-82