L-2011-239, Response to Request for Additional Information Regarding License Amendment Request for Approval of the St. Lucie/Fpl Cyber Security Plan

Response to Request for Additional Information Regarding License Amendment Request for Approval of the St. Lucie/Fpl Cyber Security Plan

ML111822734
Person / Time
Site:	Saint Lucie
Issue date:	06/22/2011
From:	Richard Anderson Florida Power & Light Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
L-2011-239
Download: ML111822734 (4)

Text

0Florida JunePower 22,&2011 Light Company, 6501 S. Ocean Drive, Jensen Beach, FL 34957 F:PL L-2011-239 10 CFR 50.90 10 CFR 50.4 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 RE: St. Lucie Units 1 and 2 Docket Nos. 50-335 and 50-389 Response to Request for Additional Information Regarding License Amendment Request for Approval of the St. Lucie/FPL Cyber Security Plan

References:

(1) FPL Letter L-2010-149 dated August 2, 2010, "Request for Approval of the St. Lucie/FPL Cyber Security Plan,"

(2) FPL Letter L-2010-213 dated September 27, 2010, "Notification Letter Designating St. Lucie Balance of Plant Systems within the Cyber Security Rule Scope."

(3) FPL Letter L-2010-254 dated November 17, 2010, "Request for Approval of the St. Lucie/FPL Cyber Security Plan."

(4) Letter from NRC, T. Orf, to R. Anderson, FPL, Request for Additional Information Regarding License Amendment Request for Approval of Cyber Security Plan (TAC No. ME4549, ME4550, ME4582, and ME4583) dated June 15, 2011 (ML11147A119)

By letter dated August 2, 2010 (Reference 1), as supplemented by letters dated September 27, 2010 (Reference 2), November 17, 2010 (Reference 3), Florida Power and Light Company (FPL) submitted a license amendment request (LAR) for St. Lucie Units 1 and 2. The proposed amendment requested approval of the St. Lucie/FPL Cyber Security Plan.

In Reference 4, the NRC requested additional information in order to complete its review of the LAR. The Enclosure provides the request for additional information along with our response.

This letter contains no new Regulatory Commitments and no revisions to existing Regulatory Commitments.

The information contained in this letter does not alter the no significant hazards consideration contained in Reference (3) and continues to satisfy the criteria of 10 CFR 51.22(c)(1 2).

3odL an FPL Group company

Florida Power and Light Company L-2011-239 St. Lucie Units 1 and 2 Page 2 Response to Request for Additional Information If you have any questions or require additional information, please contact Eric Katzman, Licensing Manager, at (772) 467-7734.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on e_ U', 2011.

Richard L.Anderson Site Vice President St. Lucie Plant Enclosure cc: Mr. W. A. Passetti, Florida Department of Health (with Enclosure)

Florida Power and Light Company L-2011-239 St. Lucie Units 1 and 2 Attachment Response to Request for Additional Information Page 1 of 2 ENCLOSURE RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION REGARDING LICENSE AMENDMENT REQUEST FOR APPROVAL OF CYBER SECURITY PLAN NRC Request for Additional Information The requirements of 10 CFR 73.54(a) are that each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in Section 73.1. Furthermore, 10 CFR 73.54(a)(1) states that the licensee shall protect digital computer and communication systems and networks associated with: (i) safety-related and important-to-safety functions; (ii)security functions; (iii) emergency preparedness functions, including offsite communications; and (iv) support systems and equipment that, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 3.0 of Enclosure 1 to the cyber security plan, Evaluation of Proposed Change, includes clarifications to the Nuclear Energy Institute 08-09 Cyber Security Plan template with regard to Emergency Preparedness and states, "Therefore, the systems and portions of systems to be protected from cyber attack in accordance with 10 CFR 73.54(a)(1)(iii), must: (1) Perform a RSPS [Risk Significant Planning Standards]-related EP [emergency preparedness] function, and (2) Be within the licensee's complete custody and control."

The rule clearly states that digital computer and communication systems and networks associated with emergency preparedness functions, including offsite communications, shall be adequately protected against cyber attacks. For systems and networks that are not within the licensee's complete custody and control, the licensee is still required to ensure protection against cyber attacks.

Explain Florida Power & Light Company's deviation from the 10 CFR 73.54(a)(1).

FPL Response to the RAI:

FPL withdraws the clarification regarding Emergency Preparedness from further NRC review.

Prior to a conference call with the NRC staff on May 24, 2011, FPL did not consider the clarification regarding Emergency Preparedness to be a deviation from the Page 1 of`2

Florida Power and Light Company L-2011-239 St. Lucie Units 1 and 2 Attachment Response to Request for Additional Information Page 2 of 2 requirements of 10 CFR 73.54(a)(1). However, FPL now understands how the clarification could result in a deviation from the requirements of 10 CFR 73.54(a)(1).

Therefore, FPL withdraws the clarification regarding Emergency Preparedness included in Section 3.0, Technical Evaluation, of References 1, and 3.

Page 2 of 2