ML102300168

Units 1 & 2 - Supplement 2 to License Amendment Request for Duke Energy Cyber Security Plan

ML102300168
Person / Time
Site:	Oconee, Mcguire, Catawba, McGuire
Issue date:	08/16/2010
From:	Glover M Duke Energy Corp
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML102300168 (18)

Text

Mike Glover SDuke GeneralManager, Nuclear Support

• WEnergy NuclearGeneration Duke Energy Corporation 526 South Church Street Enclosure 3 contains sensitive information. Charlotte,NC 28202 Withhold from public disclosure under 10 CFR 2.390. Mailing Address:

Upon removal of this enclosure, the letter is uncontrolled. P. o. Box 1006 EC07H Charlotte, NC 28201-1006 704-382-6108 Mike. Glover@duke-energy.com 10 CFR 50.90 August 16, 2010 U. S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001

Subject:

Duke Energy Carolinas, LLC (Duke Energy)

Oconee Nuclear Station, Units 1, 2, and 3, Docket Nos. 50-269, 50-270, and 50-287 Renewed Facility Operating License Nos. DPR-38, DPR-47, DPR-55 McGuire Nuclear Station, Units 1 and 2, Docket Nos. 50-369 and 50-370 Renewed Facility Operating License Nos. NPF-9 and NPF-17 Catawba Nuclear Station, Units 1 and 2, Docket Nos. 50-413 and 50-414 Renewed Facility Operating License Nos. NPF-35 and NPF-52 Supplement 2 to License Amendment Request for Duke Energy Cyber Security Plan In accordance with 10 CFR 50.90, Duke Energy proposes to amend Renewed Facility Operating Licenses (FOL) for Oconee Units 1, 2, and 3; McGuire Units 1 and 2; and Catawba Units 1 and 2. This License Amendment Request (LAR) proposes NRC approval for the Duke Energy Cyber Security Plan which complies with the requirements of 10 CFR 73.54.,

Enclosure 3 of this LAR also follows the guidance provided in Appendix A of NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors," dated April 2010.

By letter dated November 20, 2009, Duke Energy submitted a LAR for Cyber Security Plan and Proposed Implementation Schedule based on NEI 08-09 Revision 3. Supplement 1 to this initial LAR was provided by letter dated January 08, 2010.

By letter dated June 16, 2010, the NRC provided its initial response to the, prior Duke Energy submittals. The NRC decided to forgo the traditional acceptance review due to the complexity and "first-of-a-kind" nature of the application. While the NRC has docketed Duke Energy LAR, no judgment was rendered as to the acceptability of the submittal within the context of an acceptance review.

In response to the NRC letter dated June 16, 2010, Duke Energy has prepared this supplement to its November 20, 2009, submittal that supersedes prior submittals in its entirety.

Duke Energy has taken this'action in order (1) to minimize the administrative burden of www. duke-energy. corn

US Nuclear Regulatory Commission August 16, 2010 Page 2 withdrawing the original submittal and processing a completely, new LAR and (2) to provide its revised Cyber Security Plan (CSP) and proposed Implementation Schedule in a timely manner.

This submittal consists of three enclosures. provides detailed descriptions of the proposed changes, technical and regulatory evaluations, evaluation of significant hazards consideration pursuant to 10 CFR 50.92, and environmental considerations pursuant to 10 CFR 51.22. The Significant Hazards Consideration (NSHC) provided in this Enclosure is based on an NRC suggested model. Minor editorial changes from the previous submittals have been made to this Enclosure. Enclosure 1 supersedes in its entirety the corresponding portions of the Duke Energy prior submittals. contains commitments for Duke Energy in the proposed Implementation Schedule and supersedes the schedule submitted previously. The revised proposed Implementation Schedule includes specific-milestones, committed completion dates and the bases for these dates. Duke Energy cautions that uncertainties associated with planned implementation efforts may result in schedule adjustments as the activities are implemented. This Implementation Schedule is considered to contain commitments that will be managed within the Duke Energy Nuclear Generation Department commitment management program.

This LAR also addresses the need to adopt a revised definition of cyber attack to address the incorrect definition currently defined in NEI 08-09, Revision 6. The NEI letter dated June 2; 2010, to the NRC provided a proposed new definition of cyber attack that was approved by the NRC in a letter to NEI dated June 7, 2010 (ML101550052). Duke Energy will incorporate this approved definition of cyber attack into applicable policies and implementing procedures as follows (where CDA is "Critical Digital Asset"):

"Any event in which there is reason to believe that an adversary has committed or caused, or attempted tocommit or cause, or has made a credible threat to commit or cause malicious exploitation of a CDA." -

This is also a commitment that will be managed by the Duke Energy Nuclear Generation Department commitment management program. provides Revision 1 of the Duke Energy CSP. This CSP is based on NEI 08-09,,

Revision 6 Appendix A as approved by the NRC letter dated May 5, 2010 (ML101190371).

Duke Energy has taken no deviations from NEI 08-09, Revision 6 except definition of cyber attack as described above. Duke Energy agrees with responses to NRC generic requests for additional information concerning NEI 08-09 that have been provided by NEI in letters dated March 5, March 10, March 26, and April 2, 2010. Duke Energy is hereby submitting a CSP that supersedes the version that was submitted previously. contains sensitive information and, Duke Energy requests it to be withheld from public disclosure pursuant to 10 CFR 2.390.

Duke Energy requests the approval of this license amendment by November, 2010 with an implementation date of July 1, 2015.

US Nuclear Regulatory Commission August 16, 2010 Page 3 In accordance with 10 CFR 50.91 requirements, a copy of this proposed amendment is being provided to the designated officials of the States of North Carolina and South Carolina.

If you have any questions concerning this submittal, please contact Jeff Thomas at (704) 382-3438 or Tolani Owusu at (704) 382-1420.

Sincerely, Mike Glover ) - Evaluation of Proposed Change - Revised Proposed Cyber Security Plan ImplementationSchedule - Duke Energy Cyber Security Plan

References:

1. Letter, Ronald A. Jones, Duke Energy to NRC, "License Amendment Request for Approval of Duke Energy Cyber Security Plan," dated November 20, 2009.

2. Conference call, of December 8, 2009, between NEI and the NRC about the quality of the No Significant Hazards Consideration (NSHC) submitted by majority of licensees and the need for a supplement to provide a revised NSHC.

3. Letter, Jack W. Roe, NEI to Scott A. Morris, NRC, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors, April 2010," dated April 28, 2010.

4. Letter, Richard Correia, NRC to Jack W. Roe, NEI, "Nuclear Energy Institute 08-09, Cyber Security Plan Template, Rev. 6," dated May 5, 2010.

5. Letter, Christopher E. Earls, NEI to Richard P. Correia, NRC, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors, April 2010," dated June 2, 2010.

6. Letter, Richard Correia, NRC to Christopher E. Earls, NEI, "Nuclear Energy Institute 08-09. Cyber Security Plan Template, Rev. 6," dated June 7, 2010.

7. Letter, Jon Thompson for John Stang, NRC to Duke Energy Carolinas, LLC, "Catawba Nuclear Station, Units 1 & 2, McGuire Units 1 & 2, and Oconee Nuclear Station, Units 1, 2, and 3, Regarding Amendment Request for Approval of the Cyber-Security Plan," dated June 16, 2010.

US Nuclear Regulatory Commission August 16, 2010 Page 4 xc:

L. A. Reyes, Region II Administrator U.S. Nuclear Regulatory Commission Marquis One Tower 245 Peachtree Center Ave. NE, Suite 1200 Atlanta, GA 30303-1257 J. F. Stang, Jr., Senior Project Manager (ONS)

U. S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 0-8 G9A Rockville, MD 20852-2738 J. H. Thompson, Project Manager (CNS & MNS)

U. S. Nuclear Regulatory Commission 11555 Rockville Pike Mail Stop 0-8 G9A Rockville, MD 20852-2738 A. T. Sabisch, NRC Senior Resident Inspector Oconee Nuclear Station J. B. Brady, NRC Senior Resident Inspector McGuire Nuclear Station G. A. Hutto, NRC Senior Resident Inspector Catawba Nuclear Station S. E. Jenkins, Manager Radioactive & Infectious Waste Management Division of Waste Management South Carolina Department of Health and Environmental Control 2600 Bull St.

Columbia, SC 29201 W. Lee Cox, III, Section Chief Division of Environmental Health, Radiation Protection Section North Carolina Department of Environment and Natural Resources 1645 Mail Service Center Raleigh, NC 27699

US Nuclear Regulatory Commission August 16, 2010 Page 5 Oath or Affirmation Mike Glover affirms that he is the person who subscribed 'his name to the foregoing statement, and that all the matters and facts set forth herein are true and correct to the best of his knowledge.

Mike Glover, General Manager Nuclear Plant Support Subscribed and sworn to me: / 'DK*62/t aizýý  !

Notary Public My Commission Expires: /~k4vs$ do3/4llI Date SEAL

ENCLOSURE 1 EVALUATION OF PROPOSED CHANGE

Enclosure 1 Page 1 of 5 Evaluation of Proposed Change

Subject:

License Amendment Request for Approval of the Duke Energy Cyber Security Plan

1.

SUMMARY

DESCRIPTION

2. DETAILED DESCRIPTION

3. TECHNICAL EVALUATION

4. REGULATORY EVALUATION

.4.1 Applicable Regulatory Requirements/Criteria 4.2 Significant Hazards Consideration 4.3 Conclusions

5. ENVIRONMENTAL CONSIDERATIONS

6. REFERENCES

Enclosure 1 Page 2 of 5

1.

SUMMARY

DESCRIPTION This License Amendment Request (LAR) proposes NRC approval for the Duke Energy Carolinas, LLC (Duke Energy) proposed Implementation Schedule and Cyber Security Plan (Plan) which complies with the requirements of 10 CFR 73.54. The Plan also follows the guidance provided in Appendix A of NEI 08-09, Revision 6 as approved by NRC letter dated May 5, 2010.

2. DETAILED DESCRIPTION The regulations in 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks," establish the requirements for a Cyber Security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under 10 CFR 50 to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must also include a proposed implementation schedule. The background for this application is addressed by the NRC Notice of Availability published in the Federal Register, 74 FR 13926 (Reference 1) on March 27, 2009.

3. TECHNICAL EVALUATION FederalRegister notice 74 FR 13926 issued the final rule that amended 10 CFR Part 7,3. Cyber Security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat. The requirements are improvements to the requirements imposed by EA-02-026 (Reference 2).

Duke Energy's Plan is based on NEI 08-09 Revision 6, with the exception of the definition of cyber attack. Duke Energy is adopting the new definition of cyber attack that was approved by the NRC letter to NEI dated June 7, 2010 (ML101550052). The Plan provides a description of how the requirements of the Rule will be implemented and also establishes the licensing basis for the Cyber Security Program at Oconee, McGuire, and Catawba Nuclear Stations. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, and security, or emergency preparedness functions.

The Plan is in Enclosure 3.

Enclosure 1.

Page 3 of 5

4. REGULATORY EVALUATION 4.1 Applicable Regulatory Requirements/Criteria This LAR is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 Significant Hazards Consideration Duke Energy has evaluated the proposed changes using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. The Cyber Security Plan is based on NEI 08-09 Revision 6 and provides a' description of how the requirements of the Rule will be implemented at Oconee, McGuire, and Catawba Nuclear Stations. The Cyber Security Plan establishes the licensing basis for the Duke Energy Cyber Security Program for Oconee, McGuire, and Catawba Nuclear Stations. The Cyber Security Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which if compromised, would adversely impact safety, and security, or emergency preparedness functions.

The proposed change is designed to achieve high assurance that the systems are protected from cyber attacks. The Cyber Security Plan itself does not require any plant modifications.

However, the Plan does'describe how existing digital computer systems and plant modifications which involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis' threat as defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected.

Duke Energy has evaluated whether or not a significant hazard consideration is involved, with the proposed changes by analyzing the three standards set forth in 10 CFR 50.92 as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

Inclusion of the Cyber Security Plan in the Facility Operating License itself does not involve any modifications to safety-related structures, systems or components. Rather, the Cyber Security Plan describes how the requirements of 10 CFR 73.54 are to be

Enclosure 1 Page 4 of 5 implemented to identify, evaluate, and mitigate cyber attacks up to and including the design basis cyber attack threat, thereby achieving high assurance that the facility's digital computer and communications systems and networks are protected from cyber attacks. The Cyber Security Plan will not alter previously evaluated Updated Final Safety Analysis Report design basis accident analysis assumptions, add any accident initiators or affect the function of the plant safety-related structures, systems or components as to how they are operated, maintained, modified, tested or inspected.

Therefore, the proposed amendment does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No This proposed amendment provides assurance that safety-related structures, systems or components are protected from cyber attacks. Implementation of 10 CFR 73.54 and the inclusion of a plan in the Facility Operating License do not result in the need of any new or different Updated Final Safety Analysis Report design basis accident analysis. It does not introduce new equipment that could create a new or different kind of accident, and no new equipment failure modes are created. As a result, no new accident scenarios, failure mechanisms, or limiting single failures are introduced by this proposed amendment. Therefore, the proposed amendment does not create a possibility for an accident of a new or different type than those previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

The margin of safety is associated with the confidence. in the ability of the fission product barriers (i.e., fuel cladding, reactor coolant pressure boundary, and containment structure) to limit the level of radiation to the public. The proposed amendment would not alter the way any safety-related structures, systems 'or components functions and would not alter the way the plant is operated. The amendment provides assurance that safety-related structures, systems or components are protected from cyber attacks. The proposed amendment would not introduce any new uncertainties or change any existing uncertainties associated with any safety limit. The proposed amendment would have no impact on the structural integrity of the fuel cladding, reactor coolant pressure boundary, or containment structure. Based on the above considerations, the proposed amendment would not degrade the confidence in the ability of the fission product barriers to limit the level of radiation to the public. Therefore, the proposed change does not involve a significant reduction in a margin of safety.

4.3 Conclusions In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed

Enclosure 1 Page 5 of 5 manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Based on the above, Duke Energy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

5. Environmental Consideration The proposed amendment establishes the licensing basis for a Cyber Security Program for Oconee, McGuire, and Catawba Nuclear Stations and will be a part of the Physical Security Plan. This proposed amendment will not involve any significant construction impacts. Pursuant to 10 CFR 51.22(c)(12) no environmental impact statement or environmental assessment need to be prepared in connection with the issuance of the amendment.

6. References

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

3. NEI 08-09 Revision 6, Cyber Security Plan for Nuclear Power Reactors dated April, 2010.

ENCLOSURE 2 REVISED PROPOSED CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE

Cyber Security Plan Implementation Schedule Generic RAI Question # 29 includes reference to previous regulatory guidance and industry initiatives related to cyber security. As referenced, current industry guidance for cyber security is described in NEI 04-04, Cyber Security Programfor Power Reactors. However, the scope of requirements in the NRC accepted implementation guidance contained in NEI 08-09 Revision 6 is significantly greater than the previously implemented cyber security program. The defensive model design requirements, the new digital asset assessment methodology and the resultant digital asset remediation actions will require a significant expenditure of labor resources.

Duke Energy has developed a prioritized approach to establish the NRC Rule 73.54 implementation schedule. Activities include:

Deploying a uni-directional communication barrier to protect the most critical functions from remote attacks. While the deployment of the barrier is critical to protection from external cyber threats, it also impacts remote access to plant data systems by authorized personnel. This elimination of remote access will require Duke Energy to develop and implement a detailed change management plan.

Identification and assessment of critical digital asset (CDA) to identify individual asset security control remediation actions. Programs and procedures are being developed to implement the programmatic requirements of the regulation. The cyber security assessment teams are also being established for execution of program requirements. These teams are required to have extensive knowledge of plant systems and cyber security control technology. A comprehensive training program will be required to ensure competent personnel for program execution.

Page 1 of 6

Cyber Security Plan Implementation Schedule The following are the Cyber Security Implementation Milestones for Catawba, McGuire, and Oconee stations.

Implementation Completion Milestone. Basis Milestone' Date '. Deliverable, Develop and 10/31/2011 Approval of Completion includes:

Issue Cyber directive(s)/procedure(s) to 9 Obtain resources for Security be used by the Cyber procedure team, Assessment Security Assessment Team

• Development of cyber Procedure(s) in the identification and security assessment assessment of Critical Digital procedures, and Assets (CDAs).

• Development of cyber security assessment/documentation tool as deemed necessary by the project team (including software quality assurance (SQA) documentation for the tool).

I1. Train and Qualify 02/28/2012 Training of the CSAT. Training to be developed Cyber Security based on approved Assessment procedures, using the nuclear Team (CSAT) industry's approved Systematic Approach to Training.

Development of training cannot begin until significant work is accomplished with the development of assessment procedures in milestone I of this schedule.

Ill. Identify Critical 03/31/2012 Identification of critical Completion date of this Systems (CSs) systems. milestone includes a review of and Critical Digital all structures, systems or Assets (CDAs) Identification of CDAs. components to identify critical systems, identify critical digital assets and document this review.

Training (milestone II) must be completed prior to finalizing the lists of critical systems and critical digital assets.

Page 2 of 6

Cyber Security Plan Implementation Schedule Implementation_

.. ... M.. Completion Milestbne  : Basis Ba si ..

Milestone Date.Deliverab.e IV. Install Data 06/30/2012 Installation of data diodes Significant software revisions Diode (as described in Section 4.3 are required to support the of the Cyber Security Plan) data diode. Work is already in at all 3 sites. progress for this milestone at the Catawba, McGuire, and Oconee stations.

NOTE: Current Duke Energy Infrastructure (at all three nuclear sites) already includes a multi-layer defensive model with levels segregated by firewalls.

Page 3 of 6 K

Cyber Security Plan Implementation Schedule Implementation Milestone Completion Date Milestone Deliverable.

I _ _

Basis V. Cyber Security 03/31/2014 Cyber security assessments Based on the existing cyber Assessment performed and documented. security program, it is known Team assess that the number of digital Critical Digital assets requiring assessment is Assets extensive. The CDA assessment methodology required for this regulation is extremely rigorous and deterministic. The completion of these assessments will require a significant commitment of resources.

Performing the assessments will require participation of multiple disciplines and involve document reviews, system configuration evaluation, physical walk downs or electronic verification of every communication pathway for each CDA, and documentation of results. These tasks will need to be coordinated and scheduled to align with department resource availability and system access requirements.

CDA assessments will be performed on a priority basis with highest priority CDAs being assessed first (e.g.,

safety, important to safety, security, etc). Upon completion of each CDA assessment, any potential modifications identified will be placed into the Modification Process outlined in Milestone VI. In this manner, modification for the highest priority CDAs will be processed first and be installed at the earliest Dossible date.

a a a Page 4 of 6

Cyber Security Plan Implementation Schedule Implementation Completion Milestone Basis Milestone Date Deliverable VI. Modifications 01/31/2015 Required plant modifications Identification of modifications Slotted for the application of security will require the following:

controls will be identified and e Completion of the CDA slotted, assessments,

• Initiation of engineering change requests,

• Justification to and approval of recommended solution by Plant Health Working Group 1 ,

• Modification Review Prioritization Team scope/schedule/cost estimation, and

• Modification Review Prioritization Team approval and slotting (e.g.,

a range of dates (outage/innage) in which the modification will be implemented).

VII. Procedures for 06/30/2015 New policies/procedures or The implementation of the Program revision of existing cyber security program is Implementation policies/procedures in areas expected to require impacted by cyber security policy/procedure development requirements will be and/or upgrades for nearly developed, every plant department. Many Iof the security controls will Policies/procedures require development of the impacted by cyber security technical processes for will be implemented. implementing the control in a nuclear plant environment including development of new procedures for surveillances, periodic monitoring and reviews.

' Modifications often have more than one possible solution to adequately address the issue. This is to approve the selected solution. This is not meant to undermine the responsibility of the CSAT.

Page 5 of 6

Cyber Security Plan Implementation Schedule Implementation Completion Milestone Basis Milestone Date Deliverable VIII. Program in 07/01/2015 Modifications are scheduled Promptly after completion of Maintenance for development and Milestone VII.

Mode implementation according to the schedule developed in milestone VI of this schedule.

All other requirements of the CSP are established, implemented and are being maintained.

Page 6 of 6