Text

License Amendment Request - Cyber Security Plan, Withdrawal & Re-Submittal
	ML102000415
Person / Time
Site:	Waterford
Issue date:	07/15/2010
From:	Kowalewski J; Entergy Nuclear South, Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML102000418	List: W3F1-2010-0053, License Amendment Request - Cyber Security Plan, Withdrawal & Re-Submittal;
References
	W3F1-2010-0053
	Download: ML102000415 (12)
	v • d • e

Entergy Nuclear South Entergy Operations, Inc.

17265 River Road Killona, LA 70057-3093 Tel 504 739 6660 Fax 504 739 6678 jkowale@entergy.com Joseph A. Kowalewski Vice President, Operations Waterford 3 W3F1-2010-0053 10CFR 73.54 July 15, 2010 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001

Subject:

License Amendment Request - Cyber Security Plan, Withdrawal and Re-submittal Waterford Steam Electric Station Unit 3 Docket No. 50-382 License No. NPF-38

REFERENCES:

1. W3F1-2009-0063, License Amendment, Cyber Security Plan and Implementation Schedule - 10 CFR 73.54, November 21, 2009 [ADAMS Accession Number ML093280370].

2. NRC Letter, License Amendment Request for Approval of the Cyber Security Plan (TAC No. ME2729) May 20, 2010 [ADAMS Accession Number ML101310598].

3. NRC letter to Nuclear Energy Institute (NEI) dated June 7, 2010, NEI 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors [ADAMS Accession Number ML101550052]

Dear Sir or Madam:

In accordance with the 60-day request provided in Reference 2, Entergy Operations, Inc. (Entergy) is hereby withdrawing the request for an amendment to the operating license for Waterford Steam Electric Station, Unit 3 (Waterford 3), as submitted in Reference 1, and in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Entergy is submitting a new request for an amendment to the operating license for Waterford 3. The proposed amendment and request for NRC approval of the Waterford 3 Cyber Security Plan provides an implementation schedule and revises the existing operating license physical protection condition 2.E to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan. Entergy utilized NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, in development of the Waterford 3 Cyber Security Plan which This letter contains security-sensitive information - Attachments 4, 5, and 6 are withheld from public disclosure per 10CFR2.390

W3F1-2010-0053 Page 2 resolves the NRC's generic issues (Reference 2) with the previous submittal (Reference 1). In addition , Entergy is also providing a detailed milestone implementation schedule as requested. Therefore, this submittal supersedes, in its entirety, the previous submittal (Reference 1). provides an evaluation of the proposed change. Attachment 2 provides the existing Waterford 3 operating license page marked-up to show the proposed change. Attachment 3 provides the proposed operating license change in final typed format. Attachment 4 provides the list of regulatory commitments. Attachment 5 provides the Waterford 3 Cyber Security Plan implementation schedule. Attachment 6 provides a copy of the Waterford 3 Cyber Security Plan, which is a standalone document that has been incorporated by reference into the Waterford 3 Security Plan .

In addition, Entergy is utilizing the definition of "cyber attack" as delineated in Reference 3. Entergy requests that Attachments 4, 5, and 6, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

The proposed changes have been evaluated in accordance with 10 CFR 50.91(a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration. The bases for these determinations are included in Attachment 1.

Once approved, the amendment will be implemented in accordance with the approved implementation schedule. Although this request is neither exigent nor emergency, your review is requested within approximately one year of this submittal.

The new commitment contained in this letter is provided in Attachment 4. If you have any questions or require additional information , please contact William Steelman, Acting Licensing Manager, at 504-739-6685.

I declare under penalty of perjury that the foregoing is true and correct. Executed on July 15, 2010.

JAKlJDW Attachments: 1. Analysis of Proposed Operating License Change

2. Proposed Waterford 3 Operating License Changes (mark-up)

3. Revised Waterford 3 Operating License Pages

4. List of Regulatory Commitment(s)

5. Implementation Schedule

6. Waterford 3 Cyber Security Plan Security-Related Information - Withhold from Public Disclosure under 10CFR2.390

W3F1-2010-0053 Page 3 cc: Mr. Elmo E. Collins, Jr.

Regional Administrator U. S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 NRC Senior Resident Inspector Waterford Steam Electric Station Unit 3 P.O. Box 822 Killona, LA 70066-0751 U. S. Nuclear Regulatory Commission Attn: Mr. N. Kalyanam Mail Stop O-07D1 Washington, DC 20555-0001 (with attachments 1, 2 and 3 only; without attachments 4, 5 and 6):

Louisiana Department of Environmental Quality Office of Environmental Compliance Emergency and Radiological Services Division P. O. Box 4312 Baton Rouge, LA 70821-4312 Ji.Wiley@LA.gov

Attachment 1 to W3F1-2010-0053 Analysis of Proposed Operating License Change to W3F1-2010-0053 Page 1 of 4 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed Waterford Steam Electric Station Unit 3 (Waterford 3) Cyber Security Plan, an implementation schedule, and a proposed addition to the existing operating license physical protection condition 2.E.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed Waterford 3 Cyber Security Plan, an implementation schedule, and a proposed addition to the existing operating license physical protection condition 2.E for Waterford 3 to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved Waterford 3 Cyber Security Plan as required by 10 CFR 73.54. Federal Register notice dated March 27, 2009, issued the final rule that amended 10CFR Part 73. The regulations in 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74FR13926 (Reference 1).

3.0 TECHNICAL EVALUATION

Federal Register notice 74FR13926 issued the final rule that amended 10 CFR Part 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v). These requirements are more in depth than the requirements imposed by NRC Order EA-02-026 (Reference 2).

This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, dated April 2010, for use by licensees in development of their own cyber security plans. A deviation to Appendix B of NEI 08-09, Revision 6 is the use of a revised definition of cyber attack as delineated in NRC letter dated June 7, 2010 (Reference 3). The revised definition of cyber attack is any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a critical digital asset.

This LAR includes the proposed Waterford 3 Cyber Security Plan (Attachment 6) that conforms to the template provided in Appendix A of NEI 08-09, Revision 6. In addition, the LAR includes the proposed change to the existing operating license physical protection condition 2.E for (Attachments 2 and 3) for Waterford 3. The LAR contains the proposed implementation schedule (Attachment 5) as required by 10CFR73.54. The LAR also provides a list of regulatory commitments (Attachment 4).

to W3F1-2010-0053 Page 2 of 4

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria This LAR is submitted pursuant to 10CFR73.54 which requires licensees currently licensed to operate a nuclear power plant under 10CFR Part 50 to submit a cyber security plan as specified in 10CFR50.4 and 10CFR50.90.

4.2 Significant Safety Hazards Consideration Entergy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for Waterford 3. The Waterford 3 Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents. The Waterford 3 Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected.

The Waterford 3 Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for physical protection.

Both of these changes are administrative in nature and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for Waterford 3. The Waterford 3 Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents. The Waterford 3 Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the to W3F1-2010-0053 Page 3 of 4 manner in which systems are operated, maintained, modified, tested, or inspected.

The Waterford 3 Cyber Security Plan is designed to achieve high assurance that the systems within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for physical protection.

Both of these changes are administrative in nature and do not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

As required by 10 CFR 73.54 Entergy has submitted a cyber security plan for NRC review and approval for Waterford 3. Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. Because there is no change to these established safety margins as result of the implementation of the Waterford 3 Cyber Security Plan, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for physical protection.

Both of these changes are administrative in nature and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10CFR50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

4.3 Conclusion In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

to W3F1-2010-0053 Page 4 of 4

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Cyber Security Program for Waterford 3 and will be a part of the Waterford 3 Cyber Security Plan. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12). Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926

2. Federal EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002

3. NRC letter to Nuclear Energy Institute (NEI) dated June 7, 2010, NEI 08-09, Revision 6, Cyber Security Plan for Nuclear Power Reactors

Attachment 2 to W3F1-2010-0053 Proposed Waterford 3 Operating License Changes (mark-up)

(a) The first performance of SR 6.5.17, in accordance with Specification 6.5.17.c.(i), shall be within the specified Frequency of 6 years, plus the 18-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 18 months if the time period since the most recent successful tracer gas test is greater than 6 years.

(b) The first performance of the periodic assessment of CRE habitability, Specification 6.5.17.c.(ii), shall be within 3 years, plus the 9-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 9 months if the time period since the most recent successful tracer gas test is greater than 3 years.

(c) The first performance of the periodic measurement of CRE pressure, Specification 6.5.17.d, shall be within 18 months, plus the 138 days allowed by SR 4.0.2, as measured from August 13, 2008, the date of the most recent successful pressure measurement test, or within 138 days if not performed previously.

D. The facility requires an exemption from certain requirements of Appendices E and J to 10 CFR Part 50. These exemptions are described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 10 (Section 6.1.2) and Supplement No. 8 (Section 6.2.6), respectively. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. These exemptions are, therefore, hereby granted pursuant to 10 CFR 50.12. With the granting of these exemptions, the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.

E. EOI shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan, which contains Safeguards Information protected under 10 CFR 73.21, is entitled:

"Physical Security, Safeguards Contingency and Training & Qualification Plan, and was submitted on October 4, 2004.

EOI shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved Waterford 3 Cyber Security Plan submitted by letter dated July 15, 2010.

AMENDMENT NO. 171, 218 Revised by letter dated July 26, 2007

Attachment 3 to W3F1-2010-0053 Revised Waterford 3 Operating License Pages