JAFP-10-0132, Notification Letter Designating Jaf Balance of Plant Systems within the Cyber Security Rule Scope

Notification Letter Designating Jaf Balance of Plant Systems within the Cyber Security Rule Scope

ML102700602
Person / Time
Site:	FitzPatrick
Issue date:	09/27/2010
From:	Peter Dietrich Entergy Nuclear Northeast, Entergy Nuclear Operations
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
JAFP-10-0132
Download: ML102700602 (6)

Text

Entergy Nuclear Northeast Entergy Nuclear Operations, Inc.

James A. FitzPatrick NPP P.O. Box 110 Lycoming, NY 13093 Tel 315-342-3840 Pete Dietrich Site VP - JAF NPP JAFP-10-0132 September 27, 2010 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555-0001

Subject:

Notification Letter Designating JAF Balance of Plant Systems within the Cyber Security Rule Scope James A. FitzPatrick Nuclear Power Plant Docket No. 50-333 License No. DPR-59

Reference:

(1) Letter from Jim Hughes (NERC) to Entergy, "Request for Data or Information: Nuclear Power Plant 'Bright-Line' Survey," dated June 15, 2010 (2) Letter from Michael Moon (NERC) to JAF, "NERC's Response to the Completed Bright Line Survey," dated August 27, 2010

Dear Sir or Madam:

By Order dated March 19, 20091, the Federal Energy Regulatory Commission (FERC) clarified that the balance-of-plant equipment within a nuclear power plant is subject to compliance with the FERC approved Critical Infrastructure Protection (CIP) Reliability Standards. Paragraph 50 of the Order provides for an exception from the CIP Reliability Standards for equipment in the balance-of-plant that is subject to the NRC cyber security regulations. Pursuant to paragraph 50 of the Order, the North American Electric Reliability Corporation (NERC) has been engaging in a Bright-Line determination process (Reference 1) to clarify the systems that would be subject to the NRC cyber security rule (10 CFR 73.54), and those that would be subject to the CIP Reliability Standards.

1 Mandatory Reliability Standards for Critical Infrastructure Protection, order on clarification, Order No. 706-B, 126 FERC ¶ 61,229 (2009).

JAFP-10-0132 Page 2 of 3 In the Reference 2 letters, NERC is requiring that James A. FitzPatrick (JAF) Nuclear Power Plant provide the NRC with a letter identifying all balance-of-plant systems, structures, and components (SSCs) considered important-to-safety with respect to the NRC's cyber security regulation. As documented in our response to the Bright-Line survey, balance-of-plant SSCs in Attachment 1 of the survey are important-to-safety, and thus, are within the scope of 10 CFR 73.54.

In accordance with the requirements of 10 CFR 73.54 (b)(1), a comprehensive identification of SSCs subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. The program is implemented in accordance with the schedule submitted to the NRC by letter dated July 15, 2010 (JAFP-1 0-0075) with JAF's Cyber Security Plan. This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey. Providing the requested information in this alternate manner satisfies the intent of the NERC letter.

In Reference 2, NERC is also requiring that JAF submit a revised cyber security plan to the NRC for its review and approval. On or before November 30, 2010, JAF will supplement the Cyber Security Plan submittal to clarify the scope of systems described in Section 2.1, "Scope and Purpose." Section 2.1 will be amended to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program.

The new commitments contained in this submittal are summarized in the Attachment.

Should you have any questions concerning this letter, or require additional information, please contact Mr. Joseph Pechacek at (315) 349-6766.

Respectfully, Pete Dietrich Site Vice President PD:JP:mh

Attachment:

List of Regulatory Commitments cc: Next page

JAFP-10-0132 Page 2 of 3 In the Reference 2 letters, NERC is requiring that James A. FitzPatrick (JAF) Nuclear Power Plant provide the NRC with a letter identifying all balance-of-plant systems, structures, and components (SSCs) considered important-to-safety with respect to the NRCs cyber security regulation. As documented in our response to the Bright-Line survey, balance-of-plant SSCs in Attachment 1 of the survey are important-to-safety, and thus, are within the scope of 10 CFR 73.54.

In accordance with the requirements of 10 CFR 73.54 (b)(1), a comprehensive identification of SSCs subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. The program is implemented in accordance with the schedule submitted to the NRC by letter dated July 15, 2010 (JAFP-10-0075) with JAFs Cyber Security Plan. This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey. Providing the requested information in this alternate manner satisfies the intent of the NERC letter.

In Reference 2, NERC is also requiring that JAF submit a revised cyber security plan to the NRC for its review and approval. On or before November 30, 2010, JAF will supplement the Cyber Security Plan submittal to clarify the scope of systems described in Section 2.1, Scope and Purpose. Section 2.1 will be amended to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program.

The new commitments contained in this submittal are summarized in the Attachment.

Should you have any questions concerning this letter, or require additional information, please contact Mr. Joseph Pechacek at (315) 349-6766.

Respectfully, Pete Dietrich Site Vice President PD:JP:mh

Attachment:

List of Regulatory Commitments cc: Next page

JAFP-10-0132 Page 3 of 3 CC:

Mr. Mark Dapas Acting Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, Pennsylvania 19406-1415 Mr. Bhalchandra Vaidya, Project Manager Plant Licensing Branch I-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop O-8-C2A Washington, DC 20555-0001 Resident Inspectors Office U.S. Nuclear Regulatory Commission James A. FitzPatrick Nuclear Power Plant P.O. Box 136 Lycoming, New York 13093 Mr. Paul Eddy New York State Department of Public Service 3 Empire Plaza, 10th Floor Albany, New York 12223 Mr. Francis J. Murray, Jr.

President and CEO NYSERDA 17 Columbia Circle Albany, NY 12203-6399 Michael Moon Director of Compliance Operations North American Electric Reliability Corporation 116-390 Village Boulevard Princeton, NJ 08540 Document Component(s):

001 Transmittal Letter JAFP-10-0132 with Attachment

Attachment JAFP-10-0132 List of Regulatory Commitments

JAFP-10-0132 Attachment List of Regulatory Commitments The following table identifies those actions committed to by Entergy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE SCHEDULED (Check One) COMPLETION COMMITMENT DATE ONE-TIME CONTINUING ACTION COMPLIANCE (If Required)

Entergy will supplement the Cyber X November 30, 2010 Security Plan submittal to clarify the scope of systems described in Section 2.1, Scope and Purpose to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program.

In accordance with the requirements X September 30, 2014 of 10 CFR 73.54 (b)(1), a comprehensive identification of systems, structures, and components (SSCs) subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey.

Page 1 of 1