NRC 2009-0106, Transmittal of License Amendment Request 263 Regarding Changes to Cyber Security Plan

Transmittal of License Amendment Request 263 Regarding Changes to Cyber Security Plan

ML093310298
Person / Time
Site:	Point Beach
Issue date:	11/23/2009
From:	Meyer L Nextera Energy
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NRC 2009-0106
Download: ML093310298 (14)

Text

SECURITY-RELATED INFORMATION-WITHHOLD UNDER 10 CFR 2.390 NsxTeraT ENERG'YQ4 November 23, 2009 NRC 2009-0106 10 CFR 50.90 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555 Point Beach Nuclear Plant, Units 1 and 2 Dockets 50-266 and 50-301 Renewed License Nos. DPR-24 and DPR-27 License Amendment Request 263 Cyber Security Plan In accordance with the provisions of 10 CFR 50.4 and 50.90, NextEra Energy Point Beach, LLC (NextEra) is submitting a request for an amendment to the Renewed Facility Operating Licenses for Point Beach Nuclear Plant (PBNP). This proposed amendment requests NRC approval of the NextEra Cyber Security Plan, provides an implementation schedule and revises License Condition D of the Renewed Facility Operating Licenses to require PBNP to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan. provides an evaluation of the proposed change. Attachment 1 of Enclosure 1 provides the existing Renewed Facility Operating License pages marked up to show the proposed change. provides a copy of the NextEra Cyber Security Plan implementation milestone schedule. The plan will be implemented within 36 months of Commission approval of this license amendment request. provides a copy of the NextEra Cyber Security Plan. The Plan will be incorporated by reference into the NextEra Physical Security Plan upon approval. NextEra requests that, which contains security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

The PBNP Plant Operations Review Committee has reviewed the proposed license amendment request. to this letter contains sensitive information.

Withhold from public disclosure under 10 CFR 2.390.

Upon removal of Enclosure 3, this letter is uncontrolled.

NextEra Energy Point Beach, LLC, 6610 Nuclear Road, Two Rivers, WI 54241

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Document Control Desk Page 2 In accordance with 10 CFR 50.91, a copy of this letter is being provided to the designated Wisconsin Official.

If you have any questions or require additional information, please contact James Costedio, Licensing Manager, at 920/755-7427 I declare under penalty of perjury that the foregoing is true and correct.

Executed on November 23, 2009.

Very truly yours, NextEra Energy Point Beach, LLC t'arry Meyer Site Vice President Enclosures cc:

Administrator, Region III, USNRC Project Manager, Point Beach Nuclear Plant, USNRC Resident Inspector, Point Beach Nuclear Plant, USNRC PSCW to this letter contains sensitive information.

Withhold from public disclosure under 10 CFR 2.390.

Upon removal of Enclosure 3, this letter is uncontrolled.

ENCLOSURE1 NEXTERA ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 LICENSE AMENDMENT REQUEST 263 CYBER SECURITY PLAN EVALUATION OF PROPOSED CHANGE 1.0

SUMMARY

DESCRIPTION 2.0 DETAILED DESCRIPTION

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 4.2 Significant Hazards Consideration 4.3 Conclusions

6.0 REFERENCES

ATTACHMENT - Marked up Renewed Facility Operating License pages 6 pages follow

1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed NextEra Energy Point Beach, LLC (NextEra) Cyber Security Plan for Point Beach Nuclear Plant (PBNP), an implementation schedule and a proposed addition to License Condition D of the Renewed Facility Operating Licenses, DPR-24 and DPR-27, for PBNP Units 1 and 2, respectively.

2.0 DETAILED DESCRIPTION The proposed license amendment request (LAR) includes the proposed NextEra Cyber Security Plan, an implementation schedule and a proposed addition to License Condition D of the Renewed Facility Operating Licenses to require NextEra to fully implement and maintain in effect all provisions of the Commission approved cyber security plan as required by 10 CFR 73.54. Federal Register notice 74 FR 13926 (Reference 1) issued the final rule that amended 10 CFR 73. The regulations in 10 CFR 73.54, Protection of digital computer and communication systems and networks, establish the requirements for a cyber security program.

This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under 10 CFR 50 to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule.

3.0 TECHNICAL EVALUATION

Federal Register notice 74 FR 13926 issued the final rule that amended 10 CFR 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

This LAR includes the proposed Plan (Enclosure 3) that conforms to the template provided in NEI 08-09. In addition, the LAR includes the proposed change to License Condition D of the Renewed Facility Operating License, Physical Protection (Attachment 1). Finally, the LAR contains the proposed implementation schedule (Enclosure 2) as required by 10 CFR 73.54.

NEI 08-09 Deviations Emergency Preparedness 10 CFR 73.54 requires protecting digital computer and communication systems and networks associated with emergency preparedness (EP) functions, including offsite communications. The EP functions within the scope of the Plan are those functions which support implementation of the Risk Significant Planning Standards* (RSPSs) as defined in NRC Inspection Manual Chapter 0609, Appendix B. The RSPSs are the subset of EP Planning Standards, defined in 10 CFR 50.47(b), that play the greatest role in protecting public health and safety. In terms of importance, this approach aligns the selected EP functions with other system functions which are "Safety-Related" or "Important-to-Safety."

10 CFR 73.56(b)(ii) requires that any individual whose duties and responsibilities permit the individual to take actions by electronic means, either on site or remotely, that could adversely impact the licensee's emergency preparedness be subject to an access authorization program.

Page 1 of 6

However, some systems, or portions of systems, that perform an RSPS-related EP function may be located in offsite locations not under the control of the licensee and/or not staffed by licensee personnel. Similarly, there may be system components that are normally installed, modified or maintained by non-licensee personnel (e.g., a telecommunications company technician, employee of a State agency, etc.).

Therefore, the systems, and portions of systems, to be protected from cyber attack in accordance with 10 CFR 73.54(a)(1)(iii) must;

1.

Perform a RSPS-related EP function, and

2.

Be within the licensee's complete custody and control.

• The RSPSs are 10 CFR 50.47(b)(4), (5), (9), and (10), including the related sections of Appendix E to 10 CFR Part 50. 10 CFR 50.47(b)(10) has two aspects that are of differing risk significance. Only the portion dealing with the development of protective action recommendations (PARs) is integral to protection of public health and safety and is considered to be an RSPS.

Senior Nuclear Management Senior nuclear management is defined as Vice President, Nuclear Plant Support, who is accountable for nuclear plant security. The NEI 08-09 template defines this position as accountable for nuclear plant operations. The position of Vice President, Nuclear Plant Support, better reflects the duties and responsibilities of the NextEra Energy Point Beach, LLC Cyber Security Plan.

List of Critical Systems The NEI 08-09, Revision 3, template included a list of critical systems and included this list as Table 1. Table 1 is not included in this plan. These critical systems will be identified and evaluated during the cyber security assessment program development.

NEI 08-09 Section 2.2.6 The reference to 73.54(g) has been changed to a more appropriate reference of 73.54(b)(2).

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory RequirementslCriteria This LAR is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

Page 2 of 6

4.2 Significant Hazards Consideration NextEra has evaluated the proposed changes using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. An analysis of the issue of no significant hazards consideration is presented below:

Criterion 1: The proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

The proposed change is required by 10 CFR 73.54 and includes three parts.' The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09 and provides a description of how the requirements of the Rule will be implemented at PBNP. The Plan establishes the licensing basis for the NextEra Cyber Security Program. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1.

Safety-related and important-to-safety functions,

2.

Security functions,

3.

Emergency preparedness functions including offsite communications, and

4.

Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part 1 of the proposed change is designed to achieve high assurance that the systems are protected from cyber attacks. The Plan itself does not require any plant modifications.

However, the Plan does describe how plant modifications which involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation schedule. The third part adds a sentence to License Condition D of the Renewed Facility Operating License for Physical Protection. Both of these changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, it is concluded that this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Page 3 of 6

Criterion 2: The proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The proposed change is required by 10 CFR 73.54 and includes three parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided by NEI 08-09 and provides a description of how the requirements of the Rule will be implemented at PBNP. The Plan establishes the licensing basis for the NextEra Cyber Security Program. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1.

Safety-related and important-to-safety functions,

2.

Security functions,

3.

Emergency preparedness functions including offsite communications, and

4.

Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part 1 of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Plan itself does not require any plant modifications. However, the Plan does describe how plant modifications involved digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated.

The second part of the proposed change is an Implementation Schedule. The third part adds a sentence to License Condition D of the Renewed Facility Operating License for Physical Protection. Both of these changes are administrative and do not create the possibility of a new or different kind of accident from any previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

Page 4 of 6

Criterion 3: The proposed change does not involve a significant reduction in a margin of safety.

The proposed change is required by 10 CFR 73.54 and includes three parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided by NEI 08-09 and provides a description of how the requirements of the Rule will be implemented at PBNP. The Plan establishes the licensing basis for the NextEra Cyber Security Program. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1.

Safety-related and important-to-safety functions,

2.

Security functions,

3.

Emergency preparedness functions including offsite communications, and

4.

Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part 1 of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through Limiting Conditions for Operation, Limiting Safety System Settings and Safety limits specified in the Technical Specifications. Because there is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an Implementation Schedule. The third part adds a sentence to License Condition D of the Renewed Facility Operating License for Physical Protection. Both of these changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, NextEra concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

4.3 Conclusions In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Page 5 of 6

5.

ENVIRONMENTAL CONSIDERATION The proposed amendment establishes the licensing basis for a Cyber Security Program for NextEra and will be a part of the Physical Security Plan. This proposed amendment will not involve any significant construction impacts. Pursuant to 10 CFR 51.22(c)(12) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.

REFERENCES

1.

Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2.

EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

Page 6 of 6

ATTACHMENT 1 TO ENCLOSURE 1 NEXTERA ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 LICENSE AMENDMENT REQUEST 263 CYBER SECURITY PLAN PROPOSED RENEWED FACILITY OPERATING LICENSE CHANGES (MARK-UP) 2 pages follow D. Physical Protection PtE NextEra Energv Point Beach shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans, including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Point Beach Nuclear Plant Physical Security Plan, (Revision 4)," submitted by letter dated May 10, 2006. NextEra Energy Point Beach, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Point Beach Nuclear Plant cyber security plan submitted by letter dated November 23. 2009. and withheld from public disclosure in accordance with 10 CFR 2.390.

E. Safety Iniection Logic The licensee is authorized to modify the safety injection actuation logic and actuation power supplies and related changes as described in licensee's application for amendment dated April 27, 1979, as supplemented May 7, 1979. In the interim period until the power supply modification has been completed, should any DC powered safety injection actuation channel be in a failed condition for greater than one hour, the unit shall thereafter be shutdown using normal procedures and placed in a block-permissive condition for safety injection actuation.

F. FPLE Point Beach shall implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR for the facility and as approved in the Safety Evaluation Report dated August 2, 1979 (and Supplements dated October 21, 1980, January 22, 1981, and July 27, 1988) and the safety evaluation issued January 8, 1997, for Technical Specification Amendment No. 170, subject to the following provision:

FPLE Point Beach may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G. Secondary Water Chemistry Monitoring Program FPLE Point Beach shall implement a secondary water chemistry monitoring program to inhibit steam generator tube degradation. This program shall include:

1. Identification of a sampling schedule for the critical parameters and control points for these parameters;

2. Identification of the procedures used to quantify parameters that are critical to control points;

3. Identification of process sampling points;

4. Procedure for the recording and management of data;

5. Procedures defining corrective actions for off control point chemistry condition; and Renewed License No. DPR-24 Amendment No. 229 D. Physical Protection NextEra Energyv Point Beach shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans, including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Point Beach Nuclear Plant Physical Security Plan, (Revision 4)," submitted by letter dated May 10, 2006. NextEra Energy Point Beach, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Point Beach Nuclear Plant cyber security plan submitted by letter dated November 23, 2009, and withheld from public disclosure in accordance with 10 CFR 2.390.

E. Safety Iniection Logic The licensee is authorized to modify the safety injection actuation logic and actuation power supplies and related changes as described in licensee's application for amendment dated April 27, 1979, as supplemented May 7, 1979. In the interim period until the power supply modification has been completed, should any DC powered safety injection actuation channel be in a failed condition for greater than one hour, the unit shall thereafter be shut down using normal procedures and placed in a block-permissive condition for safety injection actuation.

F. FPLE Point Beach shall implement and maintain in effect all provisions of the approved fire protection program as described in the FSAR for the facility and as approved in the Safety Evaluation Report dated August 2, 1979 (and Supplements dated October 21, 1980, January 22, 1981, and July 27, 1988) and the safety evaluation issued January 8, 1997, for Technical Specifications Amendment No. 174, subject to the following provision:

FPLE Point Beach may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G. Secondary Water Chemistry Monitoring Program FPLE Point Beach shall implement a secondary water chemistry monitoring program to inhibit steam generator tube degradation. This program shall include:

1. Identification of a sampling schedule for the critical parameters and control points for these parameters;

2. Identification of the procedures used to quantify parameters that are critical to control points;

3. Identification of process sampling points;

4. Procedure for the recording and management of data;

5. Procedures defining corrective actions for off control point chemistry condition; and Renewed License No. DPR-27 Amendment No. 234

ENCLOSURE 2 NEXTERA ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 LICENSE AMENDMENT REQUEST 263 CYBER SECURITY PLAN CYBER SECURITY PLAN IMPLEMENTATION MILESTONE SCHEDULE 1 page follows

NEXTERA ENERGY POINT BEACH, LLC CYBER SECURITY PLAN PROPOSED IMPLEMENTATION SCHEDULE Commitment*

Completion Date

1. Establish a Cyber Security Project Team 3 months after NRC approval of Cyber Security Plan

2. Establish and maintain cyber security policies 6 months after NRC approval of Cyber Security Plan

3. Identify Critical Digital Assets (CDAs) within 10 months after NRC approval scope of 73.54(a) of Cyber Security Plan

4. Review and Validate CDA connections 12 months after NRC approval of Cyber Security Plan

5. Complete baseline assessments (Operational 24 months after NRC approval Security Controls, Management Security of Cyber Security Plan Controls, Technical Security Controls) and schedule mitigation actions

6. Implement defensive architecture 24 months after NRC approval of Cyber Security Plan

7. Implement Cyber Security Program, procedures 18 months after NRC approval and training of Cyber Security Plan

8. Perform vulnerability and effective analysis, and 36 months after NRC approval document gaps in condition reporting program of Cyber Security Plan

• Any commitment changes will be managed in accordance with NEI 99-04, "Guidelines for Managing NRC Commitment Changes."