ML102010091

Units 2 & 3 and North Anna & Surry, Units 1 & 2 - Supplement to Request for Approval of the Cyber Security Plan

ML102010091
Person / Time
Site:	Millstone, Kewaunee, Surry, North Anna
Issue date:	07/12/2010
From:	Hartz L Dominion, Dominion Energy Kewaunee, Dominion Nuclear Connecticut, Virginia Electric & Power Co (VEPCO)
To:	Document Control Desk, Office of Nuclear Reactor Regulation, Office of Nuclear Security and Incident Response
References
10-349
Download: ML102010091 (39)

Text

Dominion Resources Services, Inc.

5000 Dominion Boulevard, Glen Allen, VA 23060 July 12, 2010 _JDominion Web Address: www.dom.com SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 U.S. Nuclear Regulatory Commission Serial No.: 10-349 Attention: Document Control Desk NL&OS/MAE: R1 Washington, D.C. 20555-0001 Docket Nos.: 50-305 50-336/423 50-338/339 DOMINION ENERGY KEWAUNEE, INC. 50-280/281 DOMINION NUCLEAR CONNECTICUT, INC. License Nos.: DPR-43 VIRGINIA ELECTRIC AND POWER COMPANY DPR-65 KEWAUNEE POWER STATION NPF-49 MILLSTONE POWER STATION UNITS 2 AND 3 NPF-4/7 NORTH ANNA POWER STATION UNITS 1 AND 2 DPR-32/37 SURRY POWER STATION UNITS 1 AND 2 SUPPLEMENT TO REQUEST FOR APPROVAL OF THE CYBER SECURITY PLAN On March 27, 2009, the Nuclear Regulatory Commission (NRC) published the final rule, Power Reactor Security Requirements, in the Federal Register. The new 10 CFR 73.54 requires licensees of operating nuclear power plants to submit a Cyber Security Plan for Commission review and approval as specified in 10 CFR 50.4 and 50.90. This section also requires that each submittal include a proposed Implementation Schedule. Dominion Energy Kewaunee, Inc. (DEK), Dominion Nuclear Connecticut, Inc. (DNC), and Virginia Electric and Power Company (Dominion) submitted requests for amendments to the Operating Licenses (OLs) for Kewaunee, Millstone, North Anna, and Surry Power Stations on November 20, 2009 (Serial No.09-640). These proposed amendments requested NRC approval of a common fleet Cyber Security Plan and included a sentence in the associated license condition for each existing DEK, DNC, and Dominion operating license regarding the physical protection required to fully implement and maintain in effect the Commission approved Cyber Security Plan. In addition to the proposed amendment requests, a schedule for the implementation of the Cyber Security Plan was also provided for NRC approval.

The Cyber Security Plan in this submittal was based on Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 3.

On May 21, 2010 the NRC responded to DEK, DNC, and Dominion's November 20, 2009 submittal.

The NRC stated that the staff had significant generic concerns with the version of the NEI guidance that was used in preparing that submittal. To resolve the NRC staff's concerns, DEK, DNC, and Dominion were requested to review the list of generic issues that was provided to the industry cyber security writing team and forwarded to licensees via a March 9, 2010 email, and provide a revised submittal. As an alternative to addressing the individual issues, the NRC stated that a revised Cyber Security Plan could be submitted consistent with Regulatory Guide (RG) 5.71 or NEI 08-09, Revision 6. DEK, DNC, and Dominion have elected to supplement their November 20, 2009 submittal by revising the Cyber Security Plan to be consistent with NEI 08-09, Revision 6. The revised Cyber Security Plan is provided in Enclosure 2 to this letter and supersedes, in its entirety, the Cyber Security Plan submitted on November 20, 2009. The remaining portions of this submittal have been revised as necessary, as discussed below.

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 SO)DIýi

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Page 2 of 5 provides an evaluation of the proposed license change which was revised to reference NEI 08-09, Revision 6 instead of Revision 3. Attachments 1 and 2 to Enclosure 1 are the proposed OL changes and have not been revised from the original November 20, 2009 submittal. Attachment 3 to Enclosure 1 lists where the Cyber Security Plan deviates from NEI 08-09, Revision 6. provides a copy of the Cyber Security Plan. Enclosure 3 provides the Implementation Schedule for the Cyber Security Plan and has not been revised from the original November 20, 2009 submittal. Enclosure 3 is submitted as part of our response to the final rule, but is not considered part of the license amendment requests.

DEK, DNC, and Dominion request that Enclosures 2 and 3, which contain Security-Related Information, be withheld from public disclosure in accordance with 10 CFR 2.390.

In accordance with 10 CFR 50.91, a copy of this application is being provided to the designated state officials.

For the proposed license conditions, DEK, DNC, and Dominion request implementation periods of 30 days following NRC approval of the license amendments. The Cyber Security Plan will be implemented in accordance with the proposed Implementation Schedule, subject to NRC review and approval. If you have any questions regarding this submittal, please contact Ms. Margaret A. Earle at (804) 273-2768.

Sincerely, L. N. Ha"rtz Vice President - Nuclear Support Services Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company COMMONWEALTH OF VIRGINIA

)

COUNTY OF HENRICO The foregoing document was acknowledged before me, in and for the County and Commonwealth aforesaid, today by Leslie N.

Hartz, who is Vice President - Nuclear Support Services, of Dominion Energy Kewaunee, Inc., Dominion Nuclear Connecticut, Inc., and Virginia Electric and Power Company. She has affirmed before me that she is duly authorized to execute and file the foregoing document in behalf of these Companies, and that the statements in the document are true to the best of her knowledge and belief. ell.Oa itJd o vW*Wr* An Acknowledged before me this 1.y. day of July, 2010. L 1oI 019A 11U o My Commission Expires: 3"I nd AJFN-I

, " ot Nu"1ic N"A"

-39NI-Not J1i Enclosures 2 and 3 to this letter contains Security-Related Informati'b-i. Withhold from'ptiblic disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Page 3 of 5 - Evaluation of Proposed Change Attachment 1 - Proposed Operating License Changes (Mark-Ups)

Attachment 2 - Proposed Operating License Changes (Re-Typed)

Attachment 3 - NEI 08-09, Revision 6 Deviation Table - Cyber Security Plan (Security-Related Information) - Cyber Security Plan Implementation Schedule (Security-Related Information)

Commitments made in this letter: Enclosure 3, Cyber Security Plan Implementation Schedules cc: U. S. Nuclear Regulatory Commission, Region I Regional Administrator 475 Allendale Road King of Prussia, PA 19406-1415 U. S. Nuclear Regulatory Commission, Region II Regional Administrator 245 Peachtree Center Ave., NE Suite 1200 Atlanta, Georgia 30303-1257 U. S. Nuclear Regulatory Commission, Region III Regional Administrator 2443 Warrenville Road Suite 210 Lisle, Illinois 60532-4352 State Health Commissioner (w/o Enclosures 2 and 3)

Virginia Department of Health James Madison Building - 7 th floor 109 Governor Street Room 730 Richmond, VA 23219 Director (w/o Enclosures 2 and 3)

Bureau of Air Management Monitoring and Radiation Division Department of Environmental Protection 79 Elm Street Hartford, Connecticut 06106-5127 Public Service Commission of Wisconsin (w/o Enclosures 2 and 3)

Electric Division P. 0. Box 7854 Madison, WI 53707 Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Page 4 of 5 Mr. P. S. Tam (w/o Enclosures 2 and 3)

NRC Senior Project Manager Kewaunee U. S. Nuclear Regulatory Commission Mail Stop 0-8 H4A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Mr. K. D. Feintuch (w/o Enclosures 2 and 3)

NRC Senior Project Manager Kewaunee U. S. Nuclear Regulatory Commission Mail Stop 0-8 H4A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Ms. C. J. Sanders (w/o Enclosures 2 and 3)

NRC Project Manager Millstone Units 2 & 3 U. S. Nuclear Regulatory Commission Mail Stop 0-8-B 3 One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Ms. K. R. Cotton (w/o Enclosures 2 and 3)

NRC Project Manager Surry U. S. Nuclear Regulatory Commission Mail Stop 0 8 G-9A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 Dr. V. Sreenivas (w/o Enclosures 2 and 3)

NRC Project Manager North Anna U. S. Nuclear Regulatory Commission Mail Stop 0 8 G-9A One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Millstone Power Station NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Kewaunee Power Station Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No: 10-349 Page 5 of 5 NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

North Anna Power Station NRC Senior Resident Inspector (w/o Enclosures 2 and 3)

Surry Power Station Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this letter is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1 Evaluation of Proposed Change Request for Approval of the Cyber Security Plan 1.0 Summary Description 2.0 Detailed Description 3.0 Technical Evaluation 4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements / Criteria 4.2 Significant Hazards Consideration 5.0 Environmental Consideration 6.0 References ATTACHMENTS - Proposed Operating License Changes (Mark-Ups) - Proposed Operating License Changes (Re-Typed) - NEI 08-09, Revision 6 Deviation Table Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric'and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Page 1 of 5 1.0

SUMMARY

DESCRIPTION The license amendment requests (LARs) include the proposed Cyber Security Plan (Plan) and a proposed sentence to be added to the existing license condition regarding the physical protection license conditions.

2.0 DETAILED DESCRIPTION The amended regulations in 10 CFR 73.54, "Protection of digital computer and communication systems and networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of 10 CFR 73.54. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the Nuclear Regulatory Commission (NRC) Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1) (the Rule). The LARs include two parts: the proposed Cyber Security Plan and the addition of a proposed sentence to the existing facility license condition regarding physical protection which requires Dominion Energy Kewaunee, Inc., (DEK)

Dominion Nuclear Connecticut, Inc. (DNC) and Virginia Electric and Power Company (Dominion) to fully implement and maintain in effect all provisions of the Commission approved Cyber Security Plan as required by 10 CFR 73.54 at Kewaunee, Millstone, North Anna, and Surry Power Stations (the Sites). Please note, the Implementation Schedules, which address compliance with the Rule and are provided in Enclosure 3 to the letter are not considered part of the requested LARs.

3.0 TECHNICAL EVALUATION

FederalRegister notice 74 FR 13926 issued the final rule which amended 10 CFR 73. Cyber security requirements are codified as new 10 CFR 73.54 and are intended to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including, the design basis threat established by 10CFR 73.1(a)(1)(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

The LARs include the proposed changes to the existing facility license conditions for "Physical Protection" (Attachments 1 and 2). These LARs include the proposed Plan (Enclosure 2) that conforms to the template provided in NEI 08-09, "Cyber Security Plan Template," Revision 6, except as noted in the NEI 08-09, Revision 6 Deviation Table that is provided as Attachment 3.

Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Page 2 of 5

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS I CRITERIA These LARs are submitted pursuant to 10 CFR 73.54 which requires, licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 50.90.

4.2 SIGNIFICANT HAZARDS CONSIDERATION DEK, DNC, and Dominion have evaluated the proposed changes using the criteria in 10 CFR 50.92 and have determined that the proposed changes do not involve a significant hazards consideration. An analysis of the issue of no significant hazards consideration is presented below:

Criterion 1: The proposed change does not involve a significant increase in the probabilityor consequences of an accident previously evaluated.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09, Revision 6 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the. systems are protected from cyber attacks. The Plan describes how plant modifications that involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule. The proposed change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Page 3 of 5 evaluated. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant enhancement to cyber security where no requirement existed before.

The second part of the proposed change adds a sentence to the existing facility license conditions for Physical Protection. These changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, it is concluded that these changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

Criterion 2: The proposed change does not create the possibility of a new or different kind of accident from any accidentpreviously evaluated.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09, Revision 6 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Plan describes how plant modifications that involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The proposed change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant enhancement to cyber security where no requirement existed before.

Hence, it addresses a new threat programmatically.

Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Page 4 of 5 The second part of the proposed change adds a sentence to the existing facility license conditions for Physical Protection. These changes are administrative and do not create the possibility of a new or different kind of accident from any previously evaluated.

Therefore, the proposed changes do not create the possibility of a new or different kind of accident from any previously evaluated.

Criterion3: The proposedchange does not involve a significantreduction in a margin of safety.

The proposed change is required by 10 CFR 73.54 and includes two parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided in NEI 08-09, Revision 6 (except as noted in Attachment 3) and provides a description of how the requirements of the Rule will be implemented at the Sites. The Plan establishes the licensing basis for the Cyber Security Program for the Sites. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through Limiting Conditions for Operation, Limiting Safety System Settings and Safety limits specified in the Technical Specifications! Because there is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety. The proposed change implements a Cyber Security Plan as a requirement not previously formally addressed. As such, the proposed Plan provides a significant enhancement to cyber security where no requirement existed before.

The second part of the proposed change adds a sentence to the existing facility license conditions for Physical Protection. These changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Enclosures 2 and 3 to this letter contains Security Related Information'. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Page 5 of 5 Based on the above, DEK, DNC, and Dominion conclude that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

4.3 CONCLUSION

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendments establish the licensing basis for a Cyber Security Program for the Sites and will be a part of the Physical Security Plan. These proposed amendments will not involve any, significant construction impacts. Pursuant to 10 CFR 51.22(c)(12) no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of the amendments.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Interim Safeguards and Security Compensatory Measures, issued February 25, 2002.

Enclosures 2 and 3 to this letter contains Security Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Attachment 1 Proposed Facility Operating License Changes (Mark-Ups)

Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 1 Insert A is to be included as indicated on the following marked-up License pages.

Insert A:

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on _ , including the provisions for implementation.

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 1 Kewaunee License Condition Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR, Chapter 1: (1) Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70, (2) is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and (3) is subject to the additional conditions specified or incorporated below:.

(1) Maximum Power Level The licensee is authorized to operate the facility at steady-state reactor core power levels not in excess of 1772 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 206, are hereby incorporated in the license. The licensee ,4/

shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the licensee's Fire Plan, and as referenced in the Updated Safety Analysis Report, and as approved in the Safety Evaluation Reports, dated November 25, 1977, and December 12, 1978 (and supplement dated February 13, 1981) subject to the following provision:

The licensee may. make changes to the approved Fire Protection Program without prior approval of the Commission, only ifthose changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire, (4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security' Plan (Revision 0)" submitted by letter dated October 18, as supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

(5) Deleted Inserth Aendment No. 206 06/01/2009

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 1 Millstone Units 2 and 3 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled. ]

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

ýi (3) fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report and as approved in the SER dated September 19, 1978, and supplements dated October 21, 1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995, subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protectibn The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendmerits made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans,submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation

, A 14Security F' L Program,'Revislon 0" The set contains Safeguards Information rotected under 10 CFR 73.21.

(5) Relocated Technical Specifications The licensee shall relocate certain technical specification requirements to licensee-controlled documents as described below. The location of these requirements shall be retained by the licensee.

a. This license condition approves the relocation of certain technical specification requirements to licensee-controlled documents (Technical Requirements Manual), as described in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997. The approval is documented in the stafi's safety evaluation dated November 19, 1997. This license condition is effective as of its date of issuance by Amendment No. 210 and shall be implemented 90 days from the date of issuance.

Implementation shall include the relocation of technical specification requirements to the appropriate licensee-controlled document as identified in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997.

Renewed Lice o. D 5 ised by Letter dated May 29,'200

September 18, 20008 .a0z

-7, E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training, and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Station Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent o, tFuel Storage Installation Security Program, Revision 0" The set contains Safeguards Information protected under 10 CFR 73.21.

F. Deleted.

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. Fire protection (Section 9.5.1. SER. SSER 2. SSER 4. SSER 5)

DNC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as approved in the SER (NUREG-1 031) issued July 1985 and Supplements Nos. 2, 4, and 5 issued September 1985, November 1985, and January 1986, respectively, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

This renewed operating license is effective as of its date of issuance and shall expire at midnight on November 25, 2045.

FOR THE NUCLEAR REGULATORY COMMISSION IRAI J. E. Dyer, Director Office of Nuclear Reactor Regulation Attachments:

1. Appendix A - Technical Specifications

2. Appendix B - Environmental Protection Plan Date of Issuance: November 28, 2005 Renewed License No. NPF-49 Amendment No. 243-

)

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 1 North Anna Units I and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

(4) The licensee is authorized to receive from the Surry Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Sumry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 197, is hereby Incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior.approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Secudty Program" with revisions submitted through May 15, 2006.

e,*

NORTH ANNA - UNIT 1 (ýRevlsed enewe

ýbyleter dLicense No.

date~dOcober 206NPF-4 0

.10-31-07 (4) The licensee is authorized to receive from the Surry Nuclear Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station Irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 178, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordafice with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described In the licensee's Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only Ifthose changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans Including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 GFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency.Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

Ur16 /eA NORTH ANNA - UNIT 2 Renewed License No. NPF-7

• ~~ed October 20, 20_*0

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment I Surry Units I and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclos.ure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without'prior approval of the Commission only Ifthose changes would not adversely, affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain In effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, ahd Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security

'J1.rl Se/79 Program" with revisions submitted through May 15, 2006.

K. Deleted by Amendment 227 L Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment No. 203

0. Deleted by Amendment 227 P. Updated Final Safety Analysis Rep.ort (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on July 25, October 1, November 4, and December 2, 2002, describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than May 25, 2012, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

Surry - Unit I Renewed License No. DPR-32 ,

("-Revised by leter datea. November 8, 2006 i

I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979 (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain ineffect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security

- Program" with revisions submitted through May 15, 2006.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment 203

0. Deleted by Amendment 227 SURRY - UNIT 2 wed License No. DPR-37 Revised by letter dated Novem e ,06

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1 Attachment 2 Proposed Facility Operating License Change (Re-Typed)

Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 2 Kewaunee License Condition Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR, Chapter 1: (1) Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70, (2) is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and (3) is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level The licensee is authorized to operate the facility at steady-state reactor core power levels not in excess of 1772 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 206, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved Fire Protection Program as described in the licensee's Fire Plan, and as referenced in the Updated Safety Analysis Report, and as approved in the ,

Safety Evaluation Reports, dated November 25, 1977, and December 12, 1978 (and supplement dated February 13, 1981) subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission, only if those changes would not adversely affect the ability-to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security Plan (Revision 0)" submitted by letter dated October 18, as supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on including the provisions for implementation.

(5) Deleted

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 2 Millstone Units 2 and 3 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390

(3) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report. and as approved in the SER dated September 19, 1978, and supplements dated October 21, 1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995, subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision 0" The set contains Safeguards Information protected under 10 CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on , including the provisions for implementation.

(5) Relocated Technical Specifications The licensee shall relocate certain technical specification requirements to licensee-controlled documents as described below. The location of these requirements shall be retained by the licensee.

a. This license condition approves the relocation of certain technical specification requirements to licensee-controlled documents (Technical Requirements Manual), as described in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997. The approval is documented in the staff's safety evaluation dated November 19, 1997. This license condition is effective as of its date of issuance by Amendment No. 210 and shall be implemented 90 days from the date of issuance.

Implementation shall include the relocation of technical specification requirements to the appropriate licensee-controlled document as identified in the licensee's application dated May 20, 1997, as supplemented on September 23, 1997.

Renewed License No. DPR-65 Amendment No.

E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training, and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision 0." The set contains Safeguards Information protected under 10 CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on _ , including the provisions for implementation.

F. Deleted.

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. Fire Protection (Section 9.5.1, SER, SSER 2. SSER 4. SSER 5)

DNC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as approved in the SER (NUREG-1031) issued July 1985 and Supplements Nos. 2, 4, and 5 issued September 1985, November 1985, and January 1986, respectively, subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

This renewed operating license is effective as of its date of issuance and shall expire at midnight on November 25, 2045.

FOR THE NUCLEAR -REGULATORY COMMISSION

/RA/

J. E. Dyer, Director Office of Nuclear Reactor Regulation Attachments:

1. Appendix A - Technical Specifications

2. Appendix B - Environmental Protection Plan Date of Issuance: November 28, 2005 Renewed License No. NPF-49 Amendment No. 243,

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 2 North Anna Units 1 and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

(4) The licensee is authorized to receive from the Surry Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 197, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection' program as described in the Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on , including the provisions for implementation.

NORTH ANNA - UNIT I Renewed License No- NPF-4

(4) The licensee is authorized to receive from the Surry Nuclear Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:

a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.

c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 178, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection

'VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensee's Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on ,including the provisions for implementation.

NORTH ANNA - UNIT 2 Renewed License No. NPF-7

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 2 Surry Units I and 2 License Conditions Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on ,including the provisions for implementation.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment No. 203

0. Deleted by Amendment 227 P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on July 25, October 1, November 4, and December 2, 2002, describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than May 25, 2012, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

Surry - Unit 1 Renewed License No. DPR-32

I. Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September 19, 1979 (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December 4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Cyber Security Plan that the Commission approved on __,including the provisions for implementation.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment 203

0. Deleted by Amendment 227 Surry - Unit 2 Renewed License No. DPR-37

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1 Attachment 3 NEI 08-09, Revision 6 Deviation Table Dominion Energy Kewaunee, Inc.

Dominion Nuclear Connecticut, Inc.

Virginia Electric and Power Company Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosures 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION-WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 3 Page 1 of 2 Deviations from NEI 08-09 Rev. 6 Black Text Only SECTION DESCRIPTION JUSTIFICATION 1, and throughout Removed "of NEI 08-09 DEK, DNC, and Dominion are document Revision 6" from the referencing appendices which references to appendices have incorporated the NEI throughout the document appendices with some exceptions and/or clarifications.

3.1.1, first sentence Changed " develops", Grammatical correction "disseminates", "reviews" and "updates" to " develop",

"disseminate", "review" and "update" 4, 2nd paragraph, last Add "utilizing the process Clarify that the process sentence described in Section 3.1.6 of described in Section 3.1.6 that 4.3, 1st paragraph, this Plan" is generally used for all security last sentence controls is also permitted for these specific security controls 4.4.3.2, 1st sentence 4.2, 4th paragraph Changed "programs" to Grammatical correction "Program" 4.4.3.1, 1st sentence Removed "and efficiency" Efficiency is not required by the Rule and will not necessarily be included in effectiveness analysis processes.

4.4.3.2, Removed "because of the There are conditions other than 4th paragraph, 3rd potential for an adverse "adverse impact on SSEP sentence impact on SSEP functions," functions" when vulnerability scanning cannot be performed.

This change will permit alternate controls to be used when these conditions exist.

4.9.1, 1st sentence Replaced "computer and There are "computer and control systems" with "CDA" control systems" that are not S Enclosures disclosure under2 and 3 to 2.390.

10 CFR this letter contains Upon Security-Related removal of Enclosure 2 Information. Withhold is and 3, this Enclosure from public decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 1

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Serial No.10-349 Enclosure 1, Attachment 3 Page 2 of 2 CDAs and not in the scope of this Plan. Clarify that this applies only to CDAs.

4.13, 1st sentence Replaced "has" with "have" Grammatical correction 4.11, 6th bullet under Deleted bullet "Initiates and Responsibility for initiating and Cyber Security coordinates Cyber Security coordinating CSIRT should not Program Manager Incident Response Team be assigned to a single (CSIRT) functions as individual particularly for a fleet required" based organization. This is a responsibility that must be continuously supported by multiple individuals.

4.13, 3rd paragraph, Replaced "12 months" with Appendix D, Section 2.6 1st sentence "90 days" requires a review of audit 4.13, 4th paragraph, records every 31 days.

1st sentence Retention of 90 days of audit data will support all audit reviews and investigations. A 90 day retention period is also consistent with NERC Standard CIP-005oR5.3.

Appendix B, Cyber Replaced "SSEP Function" Revise definition of Cyber Attack definition with "CDA" Attach to align with definition accepted by the NRC, Appendix E, Section Added "Data flow from lower Clarify that data flow is only, 6, 4th bullet security levels to higher restricted to one way when the security levels is restricted levels are directly connected between levels that are and that this does not apply indirectly connected through when the levels are indirectly a security boundary control connected through a boundary

'device such as a firewall." device such as a firewall.

Enclosures 2 and 3 to this letter contains Security-Related Information. Withhold from public disclosure under 10 CFR 2.390. Upon removal of Enclosure 2 and 3, this Enclosure is decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390