DCL-10-087, License Amendment Request 09-05 for Approval of Cyber Security Plan and Revision to the Facility Operating Licenses

License Amendment Request 09-05 for Approval of Cyber Security Plan and Revision to the Facility Operating Licenses

ML102150081
Person / Time
Site:	Diablo Canyon
Issue date:	07/22/2010
From:	Becker J Pacific Gas & Electric Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
DCL-10-087
Download: ML102150081 (12)

Text

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 PacificGas and Electric Company James R.Becker Diablo Canyon Power Plant Site Vice President Mail Code 104/5/601 P.0. Box 56 Avila Beach, CA 93424 805.545.3462 July 22, 2010 Internal: 691.3462 Fax: 805.545.6445 PG&E Letter DCL-10-087 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Diablo Canyon Units 1 and 2 Docket No. 50-275, OL-DPR-80 Docket No. 50-323, OL-DPR-82

SUBJECT:

License Amendment Request 09-05, Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan and Revision to the Facility Operating Licenses On January 20, 2010, Pacific Gas and Electric Company (PG&E) submitted PG&E Letter DCL-1 0-002, "License Amendment Request 09-05, Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan and Revision to the Facility Operating Licenses," which superseded the previous submittal on November 20, 2009.

By letter dated May 24, 2010, the NRC requested that PG&E review the list of generic issues identified via e-mail dated March 9, 2010, and provide a revised submittal.

The NRC further identified that submission of a cyber security plan using the template provided in NEI 08-09, Revision 6, dated April 2010, would be acceptable for use by licensees to comply with the requirements of 10 CFR 73.54, with the exception of the definition of "cyber attack."

This letter and license amendment request supersedes PG&E Letter DCL-1 0-002 in its entirety and is based on the template provided in NEI 08-09, Revision 6.

In accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, PG&E hereby requests approval of the enclosed proposed amendment to Facility Operating License (FOL) Nos. DPR-80 and DPR-82 for Units 1 and 2 of the Diablo Canyon Power Plant (DCPP) respectively. The enclosed license amendment requests NRC approval of the DCPP Cyber Security Plan, provides an implementation schedule, and adds a sentence to the existing DCPP Composite FOL Physical Protection license condition to require PG&E to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan.

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CER 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde - San Onofre

• South Texas Project

• Wolf Creek

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Document July 22, 2010 Control Desk PG&E Letter DCL-10-087 Page 2 provides an evaluation of the proposed change. Enclosure 1 also contains the following attachment:

Attachment 1 provides the existing FOL pages marked up to show the proposed change. provides a copy of the DCPP Cyber Security Plan Implementation Schedule. The actions described are regulatory commitments. The final completion date is a regulatory commitment. provides a copy of the DCPP Cyber Security Plan, which is a standalone document that will be incorporated by reference into the DCPP Physical Security Plan upon approval.

Enclosures 2 and 3 contain security-related sensitive information which could reasonably be expected to be useful to potential adversaries. PG&E requests that Enclosures 2 and 3 be withheld from public disclosure in accordance with 10 CFR 2.390.

PG&E requests a period of 90 days for license amendment implementation following NRC approval of the license amendment.

If you have any questions, or require additional information, please contact Mr. Thomas Baldwin at (805) 545-4720.

I state under penalty of perjury that the foregoing is true and correct.

Executed on July 22, 2010.

Sincerely, James R. eckerr Site Vice President - Evaluation of Proposed Change - DCPP Cyber Security Plan Implementation Schedule - DCPP Cyber Security Plan ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway - Comanche Peak

• DiabloCanyon

• PaloVerde - San Onofre

• South Texas Project - Wolf Creek

ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Document Control Desk PG&E Letter DCL-10-087 SJuly 22, 2010 Page 3 mjrm/4557/N50280795/N50287698.

Enclosures cc: Diablo Distribution cc/enc: Gary W. Butner, Acting Branch Chief, California Department of Public Health Elmo E. Collins, NRC Region IV' Michael S. Peck, NRC, Senior Resident Inspector Alan B. Wang, Project Manager, Office of Nuclear Reactor Regulation ENCLOSURES 2 AND 3 CONTAIN SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• San Onofre

• South Texas Project

• Wolf Creek

Enclosure 1 PG&E LetterDCL-10-087 Evaluation of Proposed Change Request for Approval of the Diablo Canyon Power Plant Cyber Security Plan 1.0 Summary Description 2.0 Detailed Description 3.0 Technical Evaluation 4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements Criteria 4.2 Significant Hazards Consideration 5.0 Environmental Consideration 6.0 References ATTACHMENT: - Marked-up Facility Operating License (FOL) pages

Enclosure 1 PG&E Letter DCL-10-087 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed Diablo Canyon Power Plant (DCPP) Cyber Security Plan (Plan), an Implementation Schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed Plan, an Implementation Schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition to require PG&E to fully implement and maintain in effect all provisions of the Commission-approved Plan as required by 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks." The regulations in 10 CFR 73.54 establish the requirements for a cyber security program (Program). This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a Plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's Program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1).

3.0 TECHNICAL EVALUATION

FederalRegister notice 74 FR 13926 issued the final'rule that amended 10 CFR 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and -

including the design basis threat (DBT) established by 10 CFR 73.1(a)(1)(v).

These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).'

This LAR includes the proposed Plan (Enclosure 3) that is consistent with the template provided in industry document NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, dated April 2010. Based on a technical review of the document, the NRC staff concluded that the template provided in NEI 08-09, Revision 6 would be acceptable for use by licensees to comply with the requirements of 10 CFR 73.54 with the exception of the definition of "cyber attack" (Reference 3). The NRC staff reviewed and approved by letter, a definition for "cyber attack" to be used in submissions based on NEI 08-09, Revision 6 (Reference 4). The DCPP submittal uses the definition of "cyber attack" included in Reference 4.

In addition the LAR includes the proposed change to the existing FOL condition for "Physical Protection" (Attachment 1). Finally, the LAR contains the proposed 1

Enclosure 1 PG&E Letter DCL-10-087 Implementation Schedule (Enclosure 2) as required by 10 CFR 73.54.

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS / CRITERIA This LAR is submitted pursuant to 10 CFR 73.54, which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 SIGNIFICANT HAZARDS CONSIDERATION Pacific Gas and Electric Company (PG&E) has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed amendment incorporates a new requirement in the Facility Operating License (FOL) to implement and maintain a Cyber Security Plan (Plan) as part of the facility's overall program for physical protection.

Inclusion of the Cyber Security Plan in the FOL itself does not involve any modifications to the safety-related structures, systems or components (SSCs). Rather, the. Cyber Security Plan describes how the requirements of 10 CFR 73.54 are to be implemented to identify, evaluate, and mitigate cyber attacks up to and including the design basis cyber attack threat, thereby achieving high assurance that the facility's digital computer and communications systems and networks are protected from cyber attacks.

The Plan will not alter previously evaluated Final Safety Analysis Report (FSAR) design basis accident analysis assumptions, add any accident initiators, or affect the function of the plant safety-related SSCs as to how they are operated, maintained, modified, tested, or inspected. Any plant modifications necessary to implement the Plan will be evaluated pursuant to 10 CFR 50.59 to assure they will not alter previously evaluated FSAR design basis accident analysis assumptions, add any accident initiators, or affect the function of the plant safety-related SSCs as to how they are operated, maintained, modified, tested, or inspected. Further amendments to the operating licenses will be pursued as necessary based on the results of these evaluations.

2

Enclosure 1 PG&E Letter DCL-10-087 Therefore, the proposed amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the, proposed amendment create the possibility of a new or different accident from any accident previously evaluated?

Response: No.

This proposed amendment provides assurance that safety-related SSCs are protected from cyber attacks. Implementation of 10 CFR 73.54 and the inclusion of a plan in the FOL do not result in the need of any new or different FSAR design basis accident analysis. As noted in response to question 1, any plant modifications necessary to implement the Plan will be evaluated pursuant to 10 CFR 50.59 to assure they do not introduce new equipment that could create a new or different kind of accident, and no new equipment failure modes are created. Further amendments to the operating licenses will be pursued as necessary based on the results of these evaluations.

As a result, no new accident scenarios, failure mechanisms, or limiting single failures will be introduced as a result of this proposed amendment.

Therefore, the proposed change does not create the possibility of a new or different accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response:. No.

The margin of safety is associated with the confidence in the ability of the fission product barriers (i.e., fuel cladding, reactor coolant pressure boundary, and containment structure) to limit the level of radiation to the public. The proposed amendment would not alter the way any safety-related SSC functions and would not alter the way the plant is operated.

The amendment provides assurance that safety-related SSCs are protected from cyber attacks. The proposed amendment would not introduce any new uncertainties or change any existing uncertainties associated with any safety limit. The proposed amendment would have no impact on the structural integrity of the fuel cladding, reactor coolant pressure boundary, or containment structure. Based on the above considerations, the proposed amendment would not degrade the confidence in the ability of the fission product barriers to limit the level of radiation to the public.

3

Enclosure 1 PG&E Letter DCL-10-087 Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, PG&E concludes that the proposed amendment does not involve a significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.3 CONCLUSION

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Program for DCPP and will be a part of the Physical Security Plan.' This proposed amendment will not involve any significant construction impacts. PG&E has evaluated the proposed amendment and has determined that the proposed amendment does not involve: (1) a significant hazards consideration, (2) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (3) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed amendment meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

4

Enclosure 1 PG&E Letter DCL-10-087

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan

'Requirements, issued February 25, 2002.

3. Letter dated May 5, 2010, from NRC to NEI concluding that the template provided in NEI 08-09, Revision 6 dated April 2010, would be acceptable for use by licensees with the exception of the definition of "cyber attack." Adams Accession Number: ML101190371

4. Letter dated June 7, 2010, from NRC to NEI approving by letter the definition of cyber attack for incorporation in submittals of cyber security plans based on NEI 08-09, Revision 6. Adams Accession Number: ML101550052 5

Enclosure 1 Attachment 1 PG&E Letter DCL-10-087 Proposed Facility Operating License Change (Mark-Up)

Insert the following text within the current FOL condition for Physical Protection and after its existing text:

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated July 22, 2010, and withheld from public disclosure in accordance with 10 CFR 2.390.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54 (p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Diablo Canyon Power Plant, Units 1 and 2 Physical Security Plan, by Training and Qualification Plan, and Safeguards Contingency Plan," submitted by letter dated May 16, 2006.

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated July 22, 2010, and withheld from public disclosure in accordance with 10 CFR 2.390.

F. Deleted.

G. Deleted.

H. Financial Protection PG&E shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance

2. Assessment of mutual aid fire fighting assets

3. Designated staging areas for equipment and materials

4. Command and control

5. Training Of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets

2. Communications

3. Minimizing fire spread

4. Procedures for implementing integrated fire response strategy

5. Identification of readily-available pre-staged equipment

6. Training on integrated fire response strategy

7. Spent fuel pool mitigation measures DCPP Operating License Unit 1 R43 Page 11 of 12 License No. DPR-80

D. Exemption (SSER 31, Section 6.2.6)

An exemption from certain requirements of Appendix J to 10 CFR Part 50 is described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 9. This exemption is authorized by law and will not endanger life or property or the common defense and security and is otherwise in the public interest. Therefore, this exemption previously granted in Facility Operating License No. DPR-81 pursuant to 10 CFR 50.12 is hereby reaffirmed. The facility will operate, with the exemption authorized, in conformity with the application, as amended, the provisions of the Act, and the regulations of the Commission.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Diablo Canyon Power Plant, Units 1 and 2 Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan," submitted by letter dated May 16, 2006.

PG&E shall fully implement and maintain in effect all provisions of the Commission-approved DCPP Cyber Security Plan submitted by letter dated July 22, 2010, and withheld from public disclosure in accordance with 10 CFR 2.390.

F. Deleted.

G. Deleted.

DCPP Operating License U2.doc R45 Page 8 of 9 License No. DPR-82