ML093360247

Request for Approval of Cyber Security Plan

ML093360247
Person / Time
Site:	Millstone, Kewaunee, Surry, North Anna
Issue date:	11/20/2009
From:	Hartz L Dominion Energy Kewaunee, Dominion Nuclear Connecticut, Dominion Resources Services, Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
09-640
Download: ML093360247 (41)

Text

Dominion Resources Services, Inc.

5000 Dominion Boulevard, Glen Allen, VA 23060 Dominion Web Address: www.dom.com SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 November 20, 2009 U.S. Nuclear Regulatory Commission Serial No.: 09-640 Attention: Document Control Desk NL&OS/MAE: R3 Washington, D.C. 20555-0001 Docket Nos.: 50-305 50-336/423 50-338/339 DOMINION ENERGY KEWAUNEE, INC. 50-280/281 DOMINION NUCLEAR CONNECTICUT, INC. License Nos.: DPR-43 VIRGINIA ELECTRIC AND POWER COMPANY DPR-65 KEWAUNEE POWER STATION NPF-49 MILLSTONE POWER STATION UNITS 2 AND 3 NPF-4/7 NORTH ANNA POWER STATION UNITS 1 AND 2 DPR-32/37 SURRY POWER STATION UNITS 1 AND 2 REQUEST FOR APPROVAL OF THE CYBER SECURITY PLAN On March 27, 2009, the NRC published the final rule, Power Reactor Security Requirements, in the Federal Register. The new 10 CFR 73.54 requires licensees of operating nuclear power plants to submit a Cyber Security Plan for Commission review and approval. This section also requires that each submittal include a proposed Implementation Schedule. In accordance with the provisions of 10 CFR 50.4 and 50.90, Dominion Energy Kewaunee, Inc.

(DEK), Dominion Nuclear Connecticut, Inc. (DNC), and Virginia Electric and Power Company (Dominion) are submitting requests for amendments to the Operating Licenses (OLs) for Kewaunee, Millstone, North Anna, and Surry Power Stations. These proposed amendments request NRC approval of a common fleet Cyber Security Plan and add a sentence to the existing license condition for each DEK, DNC, and Dominion unit regarding the physical protection required to fully implement and maintain in effect all provisions of the Commission approved Cyber Security Plan. In addition to the proposed amendment requests, schedules for the implementation of the Cyber Security Plan are also provided for NRC approval. provides an evaluation of the proposed license change. Enclosure 2 provides a copy of the Cyber Security Plan, which is a stand-alone document that will be incorporated by reference into the Security Plan upon approval. Enclosure 3 provides the Implementation Schedules for the Cyber Security Plan. Enclosure 3 is submitted as part of our response to the final rule, but is not considered part of the license amendment requests. The dates provided in the Implementation Schedules extend beyond the Compliance Date provided in the final rule. In an October 7, 2009 email to Jack Roe (NEI), Richard Correia (NRC) stated that Implementation Schedules for Cyber Security Plans are those that the NRC staff will approve through the licensing process and are not linked to March 31, 2010 (final rule Compliance Date).

DEK, DNC, and Dominion request that Enclosures 2 and 3, which contain Security-Related Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 D)ODI Ig-4"

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Page 2 of 4 Information, be withheld from public disclosure in accordance with 10 CFR 2.390.

In accordance with 10 CFR 50.91, a copy of this application is being provided to the designated state officials.

For the proposed license conditions, DEK, DNC, and Dominion request implementation periods of 30 days following NRC approval of the license amendments. The Cyber Security Plan will be implemented in accordance with the NRC approved Implementation Schedules.

If you have any questions regarding this submittal, please contact Ms. Margaret A. Earle at (804) 273-2768.

Sincerely, L. N. Hartz Vice President - Nuclear Support Services - Evaluation of Proposed Change Attachment 1 - Proposed Operating License Changes (Mark-Ups)

Attachment 2 - Proposed Operating License Changes (Re-Typed)

Attachment 3 - NEI 08-09, Revision 3 Deviation Table - Cyber Security Plan (Security-Related Information) - Cyber Security Plan Implementation Schedules (Security-Related Information)

Commitments made in this letter: Enclosure 3, Cyber Security Plan Implementation Schedules COMMONWEALTH OF VIRGINIA )

)

COUNTY OF HENRICO )

The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N. Hartz, who is Vice President - Nuclear Support Services, of Dominion Energy Kewaunee, Inc., Dominion Nuclear Connecticut, Inc., and Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of these Companies, and that the statements in the document are true to the best of her knowledge and belief.

Acknowledged before me this *0iay of N0V/flhl*'.,2009.

I My Commission Expires: "

ýý_o I )_ý)

L -

GINGER L.ALUGOOD N"tVy PUMIC Comnomoems 310047 of Viugkmf My Commossin Emlrw Apr 30, 2013 E NottyPbi Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled. 1 SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Page 3 of 4 cc: U. S. Nuclear Regulatory Commission Region I Regional Administrator 475 Allendale Road King of Prussia, PA 19406-1415 U. S. Nuclear Regulatory Commission Region II Regional Administrator Sam Nunn Atlanta Federal Center 61 Forsyth Street, SW Suite 23T85 Atlanta, Georgia 30303-8931 U. S. Nuclear Regulatory Commission Region III Regional Administrator 2443 Warrenville Road Suite 210 Lisle, Illinois 60532-4352 State Health Commissioner (w/o Enclosures 2 and 3)

Virginia Department of Health James Madison Building - 7 th floor 109 Governor Street Room 730 Richmond, VA 23219 Director (w/o Enclosures 2 and 3)

Bureau of Air Management Monitoring and Radiation Division Department of Environmental Protection 79 Elm Street Hartford, Connecticut 06106-5127 Public Service Commission of Wisconsin (w/o Enclosures 2 and 3)

Electric Division P. 0. Box 7854 Madison, WI 53707 Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Page 4 of 4 Mr. P. S. Tam (w/o Enclosures 2 and 3)

NRC Senior Project Manager Kewaunee U. S. Nuclear Regulatory Commission Mail Stop 0-8 H4A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Ms. C. J. Sanders (w/o Enclosures 2 and 3)

NRC Project Manager Millstone Units 2 & 3 U. S. Nuclear Regulatory Commission Mail Stop 0-8-B 1A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Ms. K. R. Cotton (w/o Enclosures 2 and 3)

NRC Project Manager Surry U. S. Nuclear Regulatory Commission Mail Stop 0 8 G-9A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Dr. V. Sreenivas (w/o Enclosures 2 and 3)

NRC Project Manager North Anna U. S. Nuclear Regulatory Commission Mail Stop 0 8 G-9A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Millstone Power Station NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Kewaunee Power Station NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

North Anna Power Station NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Surry Power Station Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1 Evaluation of Proposed Change Request for Approval of the Cyber Security Plan 1.0 Summary Description 2.0 Detailed Description 3.0 Technical Evaluation 4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements / Criteria 4.2, Significant Hazards Consideration 5.0 Environmental Consideration 6.0 References ATTACHMENTS - Proposed Operating License Changes (Mark-Ups) - Proposed Operating License Changes (Re-Typed) - NEI 08-09, Revision 3 Deviation Table Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and, Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Page 1 of 5 1.0

SUMMARY

DESCRIPTION The license amendment requests (LARs) include the proposed Cyber Security Plan (Plan) and a proposed sentence to be added to the existing license condition regarding the physical protection license conditions.

2.0 DETAILED DESCRIPTION The amended regulations in 10 CFR 73.54, "Protection of digital computer and communication systems and networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to, operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of 10 CFR 73.54. Each submittal must include-a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the Nuclear Regulatory Commission (NRC) Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1) (the Rule). The LARs include two parts: the proposed Cyber Security Plan and the addition of a proposed sentence to the existing facility license condition regarding physical protection which requires Dominion Energy Kewaunee, Inc., (DEK)

Dominion Nuclear Connecticut, Inc. (DNC) and Virginia Electric and Power Company (Dominion) to fully implement and maintain in effect all provisions of the Commission approved Cyber Security Plan as required by 10 CFR 73.54 at Kewaunee, Millstone, North Anna, and Surry Power Stations (the Sites). Please note, the Implementation Schedules, which address compliance with the Rule and are provided in Enclosure 3 to the letter are not considered part of the requested LARs.

3.0 TECHNICAL EVALUATION

FederalRegisternotice 74 FR 13926 issued the final rule which amended 10 CFR 73. Cyber security requirements are codified as new 10 CFR 73.54 and are intended to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10CFR 73.1(a)(1)(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

The LARs include the proposed changes to the existing facility license conditions for "Physical Protection" (Attachments 1 and 2). These LARs include the proposed Plan (Enclosure 2) that conforms to the template provided in NEI 08-09, "Cyber Security Plan Template," Revision 3, except as noted in the NEI 08-09, Revision 3 Deviation Table that is provided as Attachment 3.

Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Page 2 of 5

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS / CRITERIA These LARs are submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 50.90.

4.2 SIGNIFICANT HAZARDS CONSIDERATION DEK, DNC, and Dominion have evaluated the proposed changes using the criteria in 10 CFR 50.92 and have determined that the proposed changes do not involve a significant hazards consideration. An analysis of the issue of no significant hazards consideration is presented below:

Criterion 1: The proposed change does not involve a significant increase in the probabilityor consequences of an accident previously evaluated.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08'09, Revision 3 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, 'would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems are protected from cyber attacks. The Plan describes how plant modifications that involve digital computer systems are reviewed to providehigh assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule. The proposed ýchange does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures.2 and 3, this Enclosure is decontrolled..

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Page 3 of 5 enhancement to cyber security where no requirement existed before.

The second part of the proposed change adds a sentence to the existing facility license conditions for Physical Protection. These changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, it is concluded that these changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

Criterion 2- The proposed change does not create the possibility of a new or different kind of accidentfrom any accidentpreviously evaluated.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09, Revision 3 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Plan describes how plant modifications that involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The proposed change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant enhancement to cyber security where no requirement existed before.

Hence it addresses a new threat programmatically.

The second part of the proposed change adds a sentence to the existing facility license Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.'

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Page 4 of 5 conditions for Physical Protection. These changes are administrative and do not create the possibility of a new or different kind of accident from any previously evaluated.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

Criterion3: The proposed change does not involve a significantreduction in a margin of safety.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09, Revision 3 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety fuhctions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through Limiting Conditions for Operation, Limiting Safety System Settings and Safety limits specified in the Technical Specifications. Because there. is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant enhancement to cyber security where no requirement existed before.

The second part of the proposed change adds a sentence to the existing facility license conditions for Physical Protection. These changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, DEK, DNC, and Dominion conclude that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Page 5 of 5 accordingly, a finding of no significant hazards consideration is justified.

4.3 CONCLUSION

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendments establish the licensing 'basis for a Cyber Security Program for the Sites and will be a part of the Physical Security Plan. These proposed amendments will not involve any significant construction impacts. Pursuant to 10 CFR 51.22(c)(12) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Interim Safeguards and Security Compensatory Measures, issued February 25, 2002.

Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Attachment I Proposed Facility Operating License Changes (Mark-Ups)

Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1 Attachment 1 Insert A is,to be included as indicated on the following marked-up License pages..

Insert A:

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on _ , including the provisions for implementation.

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 1 Kewaunee License Condition Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR.2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR, Chapter 1: (1) Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70, (2) is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and (3) is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level The licensee is authorized to operate the facility at steady-state reactor core power levels not in excess of 1772 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 206, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the licensee's Fire Plan, and as referenced in the Updated Safety Analysis Report, and as approved in the Safety Evaluation Reports, dated November 25, 1977, and December 12, 1978 (and supplement dated February 13, 1981) subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security Plan (Revision 0)" submitted by letter dated October. 18, as supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

.(5) Deleted Amendment No. 206 06/01/2009 3

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 1 Millstone Units 2 and 3 License Conditions Enclosures 2 and 3 to this letter'contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety J Analysis Report and as approved in the SER dated September 19, 1978, and supplements dated October 21, 1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995, subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans,submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation ri Se- Security Program, Revision 0" The set contains Safeguards Information r"P 71 *protected under 10 CFR 73.21.

(5) Relocated Technical Specifications The licensee shall relocate certain technical specification requirements to licensee-controlled documents as described below. The location of these requirements shall be retained by the licensee.

a. This license condition approves the relocation of certain technical specification requirements to licensee-controlled documents (Technical Requirements Manual), as described in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997. The approval is documented in the staff's safety evaluation dated November 19, 1997. This license condition is effective as of its date of issuance by Amendment No. 210 and shall be implemented 90 days from the date of issuance.

Implementation shall include the relocation of technical specification requirements to the appropriate licensee-controlled document as identified in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997.

Renewed Liceo. DP0-. 5

,ised by Letter dated May 29, 200

SSeptember 18, 2008 E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training, and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent I r) * */* I*f2 Fuel Storage Installation Security Program, Revision 0" The set contains Safeguards Information protected under 10 CFR 73.21.

F. eleted.

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. Fire Protection (Section 9.5.1, SER, SSER 2, SSER 4, SSER 5)

DNC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as-approved in the SER (NUREG-1031) issued July 1985 and Supplements Nos. 2, 4, ,and 5 issued September 1985, November 1985, and January 1986, respectively, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

I. This renewed operating license is effective as of its date of issuance and shall expire at midnight on November 25, 2045.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

J. E. Dyer, Director Office of Nuclear Reactor Regulation Attachments:

1. Appendix A - Technical Specifications

2. Appendix B - Environmental Protection Plan Date of Issuance: November 28, 2005 Renewed License No. NPF-49 Amendment No. 443-

)

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 1 North Anna Units f and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

(4) The licensee is authorized to receive from the Surry Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 197, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior.approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted throughMay 15, 2006.

NORTH ANNA - UNIT 1 enewe License No. NPF-4 (Revised byletter dated October 20, 2006

10-31-07 (4) The licensee is authorized to receive from the Surry Nuclear Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit.Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 178, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan. (

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensee's Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions

.of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

NORTH ANNA- UNIT 2 Renewed License No. NPF-7

ýf*vsd brýted October r0

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment'1 Surry Units 1 and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fi re.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security 71

'-5 *e.O" Program" with revisions submitted through May 15, 2006.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment No. 203

0. Deleted by Amendment 227 P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on July 25, October 1, November 4, and December 2, 2002, describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than May 25, 2012, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

Surry- Unit 1 Renewed License No. DPR-32

/ Revised by letter dated Novem er 8, 2006

I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979 (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980,' February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment 203

0. Deleted by Amendment 227 Renewed License No. DPR-37

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1 Attachment 2 Proposed Facility Operating License Change (Re-Typed)

Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 2 Kewaunee License Condition Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR, Chapter 1: (1) Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70, (2) is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and (3) is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level The licensee is authorized to operate the facility at steady-state reactor core power levels not in excess of 1772 megawatts (thermal).

-(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 206, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the licensee's Fire Plan, and as referenced in the Updated;S afety Analysis Report, and as approved in the Safety Evaluation Reports, dated November 25, 1977, and December 12, 1978 (and supplement dated February 13, 1981) subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10'CFR 73.55 (51 FR 27817 and 27822) and to the author ity of 10 CFR 50.90 and 10 CF R 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 C FR 73.21, is entitled: "Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security Plan (Revision 0)" submitted by letter dated October 18, as supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on including the provisions for implementation.

(5) Deleted

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 2 Millstone Units 2 and 3 License Conditions J

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report and as approved in the SER dated September 19, 1978, and supplements dated October 21, 1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995, subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and

.to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and'Surry Power Stations' Security Plan, Training and Qualificatibn Plan, Safeguards.

Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision 0" The set contains Safeguards Information protected under 10 CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on __, including the provisions for implementation.

(5) Relocated Technical Specifications The licensee shall relocate certain technical specification requirements to licensee-controlled documents as described below. The location of these requirements shall be retained by the licensee.

a. This license condition approves the relocation of certain technical specification requirements to licensee-controlled documents (Technical Requirements Manual), as described in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997. The approval is documented in the staff's safety evaluation dated November 19, 1997. This license condition is effective as of its date of issuance by Amendment No. 210 and shall be implemented 90 days from the date of issuance.

Implementation shall include the relocation of technical specification requirements to the appropriate licensee-controlled document as identified in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997.

Renewed License No. DPR-65 Amendment No.

E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training, and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision 0." The set contains Safeguards Information protected under 10 CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on ,including the provisions for implementation.

F. Deleted.

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. Fire Protection (Section 9.5.1. SER, SSER 2, SSER 4, SSER 5)

DNC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as approved in the SER (NUREG-1031) issued July 1985 and Supplements Nos. 2, 4, and 5 issued September 1985, November 1985, and January 1986, respectively, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

This renewed operating license is effective as of its date of issuance and shall expire at midnight on November 25, 2045.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA!

J. E. Dyer, Director Office of Nuclear Reactor Regulation Attachments:

1. Appendix A - Technical Specifications

2. Appendix B - Environmental Protection Plan Date of Issuance: November 28, 2005 Renewed License No. NPF-49 Amendment No. 24,,

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 2 North Anna Units 1 and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

(4) The licensee is authorized to receive from the Surry Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 197, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and'maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authorityof 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on __, including the provisions for implementation.

NORTH ANNA - UNIT I Renewed License No. NPF-4

(4) The licensee is authorized to receive from the Surry Nuclear Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more' than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 178, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensee's Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on' ,including the provisions for implementation.

NORTH ANNA - UNIT 2 Renewed License No. NPF-7

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 2 Surry Units 1 and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on __,including the provisions for implementation.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment No. 203

0. Deleted by Amendment 227 P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on July 25, October 1, November 4, and December 2, 2002, describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than May 25, 2012, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

Surry - Unit I Renewed License No. DPR-32

I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979 (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical-security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on __, including the provisions for implementation.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment 203

0. Deleted by Amendment 227 Surry - Unit 2 u Renewed License No. DPR-37

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1 Attachment 3 NEI 08-09, Revision 3 Deviation Table Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 0-Enclosure 1, Attachment 3 Page 1 of 5 Deviations from NEI 08-09 Rev 3 Black Text Only SECTION DESCRIPTION JUSTIFICATION 1, and throughout Removed "of NEI 08-09 Revision DEK, DNC, and Dominion are document 3" from the references to referencing appendices appendices throughout the which have incorporated the document NEI appendices with some exceptions and/or clarifications.

1, first sentence Removed all references to the Establish consistent 2.2.4, first sentence "Rule" and replaced with reference to 10 CFR 73.54 3, second sentence "10 CFR 73.54" throughout the document. F 4.2 second paragraph 4.6, first sentence 4.9.2, first sentence 4.13, first sentence 2.1, third paragraph, Deleted Table I List of Systems Draft RG 5.71 and 3.1.3, first bullet and references to Table 1 conversations with NRC Table 1 Staff indicate Table should not be in Plan; plan should be a process, not results of

__________________process.

2.1, last bullet, Changed "Chapter" to "Section" These refer to Sections 3.1.2, last sentence, within the Plan, not 4, first sentence Chapters.

4.1, first sentence 4.3, first paragraph 4.10, second sentence 2.2, second paragraph Deleted "Protection" from Title of RG 5.69 incorrect as "Guidance for the Application of written.

the Radiological Sabotage Design Basis Threat in the Design, Development and Implementation of a Physical Security Protection Program that Meets § 73.55 Requirements."

2.2, second paragraph Deleted "(Safeguards The reference to SGI is Information (SGI)" unnecessary and can be mistaken as portion marking.

2.2.2 Deleted "(i)" from Reference to 73.55(b)(2)(i) is

"(§ 73.55(b)(2)(i), incorrect.

§ 73.54(e)(2)(i), and

§ 73.54(e)(2)(iv)).

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment,3 Page 2 of 5 3, first paragraph Deleted "I" from "adversely Correct typographical error.

impact the integrity or confidentiality of data andlor/software;"

3.1.1, first sentence Changed "develops, Grammatical correction.

disseminates, and periodically reviews and updates" to "develop, disseminate, and periodically review and update" 3.1.2, second bullet Added "nuclear" to "Nuclear Clarify that this does not power plant operations, mean personal safety.

engineering, and nuclear safety" 3.1.3, first bullet Added "to" to "CSs are Grammatical correction.

identified by conducting an initial consequence analysis of site systems, equipment, communication systems and networks to determine those which,"

3.1.3, second bullet Changed "systems" to Grammatical correction to "devices" in "These digital maintain consistency with systems devices are hereafter previous sentence.

called Critical Digital Assets (CDAs) 3.1.3, second bullet Deleted individual CDA analysis Some analysis can only be if Group CDA is appropriate effectively performed on a CDA group or system level.

Methods of Inheritance, Type and Grouping are recognized as acceptable methods of analysis and are expected to be used in analyzing security controls.

3.1.4, fourth bullet Added separate bullet to Correct typographical error.

"information on computer networks and communication systems and networks that are present within the plant and could ,be potential pathways for attacks;"

4.1 Deleted "The Sites Physical This is an incorrect Security Plan, Chapter 23 statement from the base provides details on the DBT as template. Details on the DBT Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 3 Page 3 of 5 described in RG 5.69" are not described in the Physical Security Plan.

4.3, first header Deleted "Site" from "Site This refers to a fleet strategy Defensive Strategy" that applies to all sites within the fleet.

4.4.1, last paragraph Added "a" to "have been Grammatical correction.

implemented in a manner consistent with this Plan and implementing procedures."

4.6, sixth paragraph Deleted "site" from "site Some procedures will be 4.6, seventh paragraph procedures" fleet procedures that apply 4.11, first sentence to all sites within the fleet.

4.11, last bullet 4.7, second bullet Deleted "in manual mode".from Some systems will support a "Procedures for operating the locally controlled mode of CDAs in manual mode with automatic operation with all external electronic external communications communications connections severed. It is expected that severed until secure conditions analysis may show this to be can be restored" a safer and more reliable method of contingency plan operation.

4.11, fourth bullet Deleted "site" from "Functions This may be a fleet under Cyber Security as a single point of contact for responsibility that applies to Program Manager issues related to site cyber all sites within the fleet.

security' 4.11, sixth bullet under Deleted bullet "Initiates and It is inappropriate to assign Cyber Security coordinates Cyber Security responsibility for initiation Program Manager Incident Response Team and coordination of CSIRT to (CSIRT) functions as required" a single individual. This is responsibility that must be continuously supported.

Appendices Added 5 appendices Format allows easy corresponding to NEI 08-09 accounting of deviations appendices from NEI 08-09 (current and future) without duplicating text.

Appendix B, (CS) Deleted "operational control Based on 10 CFR 73.54 Critical System systems" from "These systems language, Critical Systems definition include safety systems, plant do not include operational security, operational control control systems.

systems, emergency preparedness, and auxiliary systems that support safety Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER ,10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 3 Page 4'of 5 systems."

Appendix C Changed Part 21 Reportability Ambiguous terms should not process description terms to be 'be substituted for the Part 21 consistent with defined terms in defined reportability terms.

§21.3 and §21.21 1, third sentence Replaced "physical security Correction to restore the plan" with "cyber security plan" intent of this statement.

1, fourth sentence Removed "that" Remove unnecessary words 1, fifth sentence to clarify statement.

2.2, first sentence 2.2.2, first sentence 3.1.6, bullet (2)(b) 4, fourth sentence 4.4, second bullet 4.4, third bullet 4.4.1, second sentence 4.4.1, third sentence 4.4.3, first sentence 4.4.3.1, first sentence 4.5, fourth sentence (3 separate occurrences) 4.6, first sentence 1, third sentence Removed "their" Remove unnecessary words to clarify statement. Avoid use of first person.

1, second paragraph Replaced "Elements of the Use more appropriate word.

Program described in this Plan apply to the following sites" with "Elements of the Program described in this Plan apply to the following units" 2.2, first sentence Replaced "§ 73.55(a)(1) requires Grammatical correction.

licensees implement" with "§ 73.55(a)(1) requires licensees to implement" 2.2, second paragraph Replaced "RG" with "Regulatory Clarify abbreviation.

Guide" 2.2.1, first sentence Replaced "that" with "which" Grammatical correction.

3, first sentence 3, second sentence 3, fifth sentence 3, sixth sentence 3.1, second bullet 3.1.4, first sentence Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.09-640 Enclosure 1, Attachment 3 Page 5 of 5 3,1.4, fifth bullet 3.1.6, bullet (c) 3.1.6, bullet (3) 4, fifth sentence 4.3, third sentence 4.3, third bullet 4.4.3.2, second sentence 4.4.3.2, third sentence 4.4.3.2, fourth sentence 4.5, second sentence 4.6, ninth sentence 4J7, first bullet 2.2.5, first sentence Replaced "Commission" with Clarify abbreviation.

"Nuclear Regulatory Commission (NRC)"_

2.2.5, first sentence Replaced "Commission" with Use consistent reference.

4.13, first sentence (2 "NRC" separate occurrences) 4.3, first bullet Replaced "e.g." with "e.g.," Grammatical correction.

4.3, second bullet 4.4.3.1, first sentence Deleted "and efficiency" from Correction to align statement "The effectiveness and with subsequent description efficiency of the Cyber Security which is to ensure Program" effectiveness. "Efficiency" is not an objective of this section or required by regulation.

4.8, second sentence Replaced "that" with "these" Grammatical correction.

4.9.1, first sentence Replaced "Operating Experience Remove unnecessary (OE) and Corrective Action acronyms.

Program (CAP) "with "Operating Experience (OE) and Corrective Action Program (CAP) "

4.12, first sentence Replaced "established" with Grammatical correction.

"establishes" Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390