CP-200901569, License Amendment Request (LAR) 09-010, for Approval of the Cyber Security Plan

License Amendment Request (LAR)09-010, for Approval of the Cyber Security Plan

ML093340393
Person / Time
Site:	Comanche Peak
Issue date:	11/19/2009
From:	Flores R Luminant Generation Co, Luminant Power
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CP-200901569, TXX-09133
Download: ML093340393 (16)

Text

Enclosures 1, 2, and 3 - Security Related Information - Withhold under 10 CFR 2.390 Rafael Flores Luminant Power Senior Vice President P.O. Box 1002 Ch ief Nuclear Officer 6322 North FM 56 rafael.flores@lninant .corn Glen Rose, TX 76043 Lumin*an T 254 897 5590 C 817 559 0403 F 254 897 6652 CP-200901569 Ref: 10 CFR 50.90 TXX-09133 November 19,2009 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

COMANCHE PEAK STEAM ELECTRIC STATION (CPSES) DOCKET NOS. 50-445 AND 50-446, LICENSE AMENDMENT REQUEST (LAR)09-010, FOR APPROVAL OF THE CYBER SECURITY PLAN

REFERENCE:

Nuclear Energy Institute (NEI) 08-09, Revision 3, "Cyber Security Plan for Nuclear Power Reactors"

Dear Sir or Madam:

Pursuant to 10CFR50.90 and 10CFR50.4, Luminant Generation Company LLC (Luminant Power) hereby requests an amendment to the Facility Operating License (FOL) for CPSES, herein referred to as Comanche Peak Nuclear Power Plant (CPNPP), Unit 1 Operating License (NPF-87) and CPSES Unit 2 Operating License (NPF-89). This change request applies to both Units. This proposed amendment requests NRC approval of the CPNPP Cyber Security Plan, provides a proposed Implementation Schedule, and adds a sentence to the existing FOL Physical Protection license condition to require CPNPP to fully implement and maintain in effect all provisions of the Commission approved Cyber Security Plan.

This proposed change is consistent with Nuclear Energy Institute (NEI) 08-09, Revision 3, "Cyber Security Plan for Nuclear Power Reactors."

Attachment 1 provides a detailed description of the proposed change, a technical analysis of the proposed change, Luminant Power's determination that the proposedchanges do not involve a significant hazard consideration, a regulatory analysis of the proposed changes and an environmental evaluation.

Attachment 2 provides the marked-up copy of the proposed FOL change. Attachment 3 provides retyped FOL pages which incorporate the requested changes.

Enclosure I provides a copy of the CPNPP Cyber Security Plan; which is a standalone document that will be incorporated by reference into the CPNPP Licensee Physical Security Plan upon approval. Enclosure 2 provides a copy of the CPNPP Cyber Security Plan Proposed Implementation Schedule. Enclosure 3 provides a Deviation Table which includes a description of changes to the un-bracketed text of NEI 08-09, Revision 3. Luminant Power requests that the enclosures, which contain sensitive information, be withheld from public disclosure in accordance with 10 CFR 2.390.

Luminant Power requests an implementation period of 120 days following NRC approval of the license amendment to issue the CPNPP Cyber Security Plan.

A member of the STARS (Strategic Teaming and Resource Sharing) Alliance Callaway Comanche Peak Diablo Canyon

• Palo Verde -San Onofre - South Texas Project Wolf Creek kwQA

U. S. Nuclear Regulatory Commission TXX-09133 Page 2 of 3 11/19/2009 In accordance with 10CFR50.91(b), Luminant Power is providing the State of Texas with a copy of this proposed amendment.

This communication contains the following new or revised commitments which will be completed or incorporated into the CPNPP licensing basis as noted:

Number Commitment Due Date/Event 3829942 The analysis of digital computer systems and 36 months after NRC approval of the networks in accordance with Section 3 of the Cyber Security Plan CPNPP Cyber Security Plan will be performed and results documented as required.

3829961 For cyber security controls that have been 48 months after NRC approval of the identified for implementation by the process Cyber Security Plan (All CDA described in Section 3 of the CPNPP Cyber remedial actions budgeted, planned, Security Plan, an implementation plan will be scheduled and approved) prepared and available for on-site inspection.

3834209 The elements to establish, implement, and 60 months after NRC approval of the maintain the Cyber Security Program as Cyber Security Plan (some remedial described in Chapter 4 of the CPNPP Cyber actions may be open beyond this Security Plan will be implemented. Schedule period pending completion of will be available onsite for inspection. scheduled modifications)

The commitment number is used by Luminant Power for the internal tracking of CPNPP commitments.

Should you have any questions, please contact Mr. Jim Barnette at (254) 897-5866.

I state under penalty of perjury that the foregoing is true and correct.

Executed on November 19, 2009.

Sincerely, Luminant Generation Company, LLC Rafael Flores By: /4 2?*

B Fred W Madden Director, Oversight and Regulatory Affairs

U. S. Nuclear Regulatory Commission TXX-09133 Page 3 of 3 11/19/2009 JEB Attachments 1. Description and Assessment

2. Proposed Facility Operating License Changes (Mark-Up)

3. Retyped Facility Operating License Changes Enclosures 1. CPNPP Cyber Security Plan

2. CPNPP Cyber Security Plan Proposed Implementation Schedule

3. Deviation Table (Description of Changes to Un-Bracketed Text of NEI 08-09, Revision 3) c - E. E. Collins, Region IV B. K. Singal, NRR Resident Inspectors, CPNPP Alice Hamilton Rogers, P.E.

Inspection Unit Manager Texas Department of State Health Services Mail Code 1986 P. 0. Box 149347 Austin TX 78714-9347

ATTACHMENT 1 to TXX-09133 DESCRIPTION AND ASSESSMENT to TXX-09133 Page 2 of 7 11/19/2009 LICENSEE'S EVALUATION

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/ Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENTS

8.0 REFERENCES

LICENCEE'S EVALUATION to TXX-09133 Page 3 of 7 11/19/2009

1.0 DESCRIPTION

By this letter, Luminant Generation Company LLC (Luminant Power) requests an amendment to the Comanche Peak Steam Electric Station (CPSES) Unit 1 Operating License (NPF-87) and CPSES Unit 2 Operating License (NPF-89) by incorporating the attached change into the CPSES Unit 1 and 2 Facility Operating Licenses. License Amendment Request (LAR)09-010 is a request to revise Facility Operating Licenses (OLs) for Comanche Peak Steam Electric Station (CPSES) Units 1 and 2.

2.0 PROPOSED CHANGE

The proposed LAR 09-010 includes the proposed Luminant Power CPNPP Cyber Security Plan, the CPNPP Cyber Security Plan Proposed Implementation Schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition.

3.0 BACKGROUND

FederalRegister notice 74 FR 13926 issued the final rule that amended 10 CFR Part 73 (Reference 1). Cyber security requirements are codified as new § 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by

§ 73.1(a)(1(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

4.0 TECHNICAL ANALYSIS

Nuclear Energy Institute (NEI) 08-09, Revision 3, September 2009, "Cyber Security Plan for Nuclear Power Plants" (Reference 3) has been issued for use by licensees in development of their own cyber security plans.

This LAR includes a proposed Plan (Enclosure 1) that is consistent with the template provided in NEI 08-09, Revision 3. In addition the LAR includes proposed changes to the existing Facility Operating License conditions for "Physical Protection" (Attachment 2). A proposed Implementation Schedule as required by 10 CFR 73.54 is provided in Enclosure 2. Enclosure 3 provides a description of the changes to the un-bracketed text of NEI 08-09, Revision 3.

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Luminant Power has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change is required by § 73.54 and includes three parts. The first part is the submittal of the Plan for NRC review and approval. The Comanche Peak Nuclear Power Plant (CPNPP) Cyber Security Plan is consistent with the

LICENCEE'S EVALUATION to TXX-09133 Page 4 of 7 11/19/2009 template provided in Nuclear Energy Institute (NEI) 08-09, Revision 3, and provides a description of how the requirements of the Rule will be implemented at CPNPP. The CPNPP Cyber Security Plan establishes the licensing basis for the CPNPP Cyber Security Program. The CPNPP Cyber Security Plan also establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems are protected from cyber attacks. The CPNPP Cyber Security Plan itself does not require any plant modifications. However, the CPNPP Cyber Security Plan does describe how plant modifications which involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule.

The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an Implementation Schedule. The third part adds a sentence to the existing FOL license condition for Physical Protection. Both of these changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change is required by § 73.54 and includes three parts. The first part is the submittal of the CPNPP Cyber Security Plan for NRC review and approval. The CPNPP Cyber Security Plan is consistent with the template provided by NEI 08-09, Revision 3 and provides a description of how the requirements of the Rule will be implemented at Comanche Peak Nuclear Power Plant. The CPNPP Cyber Security Plan establishes the licensing basis for the CPNPP Cyber Security Program. The CPNPP Cyber Security Plan also establishes how to achieve high assurance that nuclear power plant digital

LICENCEE'S EVALUATION to TXX-09133 Page 5 of 7 11/19/2009 computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions, 2; Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The CPNPP Cyber Security Plan itself does not require any CPNPP Cyber Security Plant modifications. However, the CPNPP Cyber Security Plan does describe how plant modifications involved digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated.

The second part of the proposed change is an Implementation Schedule. The third part adds a sentence to the existing FOL license condition for Physical Protection. Both of these changes are administrative and do not create the possibility of a new or different kind of accident from any previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No The proposed change is required by § 73.54 and includes three parts. The first part is the submittal of the CPNPP Cyber Security Plan for NRC review and approval. The CPNPP Cyber Security Plan is consistent with the template provided by NEI 08-09, Revision 3, and provides a description of how the requirements of the Rule will be implemented at Comanche Peak Nuclear Power Plant. The CPNPP Cyber Security Plan establishes the licensing basis for the CPNPP Cyber Security Program. The CPNPP Cyber Security Plan also establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

LICENCEE'S EVALUATION Attachment I to TXX-09133 Page 6 of 7 11/19/2009

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through Limiting Conditions for Operation, Limiting Safety System Settings and Safety limits specified in the Technical Specifications. Because there is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an Implementation Schedule. The third part adds a sentence to the existing FOL license condition for Physical Protection. Both of these changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore the proposed change does not involve a reduction in a margin of safety.

Based on the above evaluations, Luminant Power concludes that the proposed amendment(s) present no significant hazards under the standards set forth in 10CFR50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/ Criteria This LAR is submitted pursuant to 10 CFR §73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Cyber Security Plan as specified in §50.4 and §50.90.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for the CPNPP Unit 1 and Unit 2 Cyber Security Program and will be a part of the Physical Security Plan. This proposed amendment will not involve any significant construction impacts. Pursuant to 10 CFR 51.22(c)(12), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

7.0 PRECEDENTS None

LICENCEE'S EVALUATION to TXX-09133 Page 7 of 7 11/19/2009

8.0 REFERENCES

8.1 Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

8.2 EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

8.3 NEI 08-09,Revision 3, September 2009, "Cyber Security Plan for Nuclear Power Reactors."

ATTACHMENT 2 to TXX-09133 PROPOSED FACILITY OPERATING LICENSE CHANGES (MARK-UP)

Pages 8 (Unit 1) 8 (Unit 2)

(3) Luminant Generation Company LLC shall promptly notify the NRC of any attempts by subsurface mineral rights owners to exercise mineral rights, including any legal proceeding initiated by mineral rights owners against Luminant Generation Company LLC.

G. Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24, subject to the following provision:

Luminant Generation Company LLC may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006

1. The licensees shall have and maintain financial pr ection of such type and in such amounts as the Commission shall require i accordance with Section 170 of the Atomic Energy Act of 1954, as amended, o cover public liability claims.

J. NOT USED Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Comanche Peak Nuclear Power Plant Cyber Security Plan approved by the Commission by letter dated [insert date], and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan is withheld from public disclosure in accordance with 10 CFR 2.390.

Amendment No. 68, ,82 90, 139 Revised by letter dated March 15, 2007

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, guard training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the Office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 20016,

1. The licensee shall have and maintain financial protection of s h type and in such amounts as the Commission shall require in accorda e with Section 170 of the Atomic Energy Act of 1954, as amended, to cove ublic liability claims.

J. NOT USED K. This license is effective as of the date of iss nce and shall expire at Midnight on February 2, 2033.

Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Comanche Peak Nuclear Power Plant Cyber FOR E NUCLEAR REGULATORY COMMISSION Security Plan approved by the Commission by letter dated [insert date], and all amendments made original signed by:

pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan is withheld from public Thomas E. Murley, Director disclosure in accordance with 10 CFR 2.390. Office of Nuclear Reactor Regulation Attachments/Appendices:

1. Appendix A - Technical Specifications (NUREG-1468)

2. Appendix B - Environmental Protection Plan

3. Appendix C - Antitrust Conditions Date of Issuance: April 6, 1993 Amendment No. 68, 82, 80, 00, 139 Revised by letter dated July 26, 2007

ATTACHMENT 3 to TXX-09133 RETYPED FACILITY OPERATING LICENSE CHANGES Pages 8 (Unit 1) 8 (Unit 2)

(3) Luminant Generation Company LLC shall promptly notify the NRC of any attempts by subsurface mineral rights owners to exercise mineral rights, including any legal proceeding initiated by mineral rights owners against Luminant Generation Company LLC.

G. Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24, subject to the following provision:

Luminant Generation Company LLC may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Comanche Peak Nuclear Power Plant Cyber Security Plan approved by the Commission by letter dated [insert date], and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan is withheld from public disclosure in accordance with 10 CFR 2.390.

The licensees shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

J. NOT USED Amendment No. 68, 82, 00, 1 Revised by letter dated March 15, 2007

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, guard training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the Office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Comanche Peak Nuclear Power Plant Cyber Security Plan approved by the Commission by letter dated [insert date], and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan is withheld from public disclosure in accordance with 10 CFR 2.390.

The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

J. NOT USED K. This license is effective as of the date of issuance and shall expire at Midnight on February 2, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION original signed by:

Thomas E. Murley, Director Office of Nuclear Reactor Regulation Attachments/Appendices:

1. Appendix A - Technical Specifications (NUREG-1468)

2. Appendix B - Environmental Protection Plan

3. Appendix C - Antitrust Conditions Date of Issuance: April 6, 1993 Amendment No. 68, 82, 80, 0,1 39, Revised by letter dated July 26, 2007