ML103270357

Fleet (Kewaunee, Millstone 2 & 3, North Anna 1 & 2, Surry 1 & 2) Nuclear Plants Email - Cyber Security Plan (License Amendment (TAC No. ME4319, ME4320,4321, ME4322, 4323, and ME4324, 4325)

ML103270357
Person / Time
Site:	Millstone, Kewaunee, Surry, North Anna
Issue date:	11/22/2010
From:	V Sreenivas Plant Licensing Branch II
To:	Heacock D Virginia Electric & Power Co (VEPCO)
Sreenivas V.NRR/DORL/LPL2-1 415-2597
References
TAC ME4319, TAC ME4320, TAC ME4321, TAC ME4322, TAC ME4323, TAC ME4324, TAC ME4325, FOIA/PA-2011-0115
Download: ML103270357 (2)

Text

From: Sreenivas, V To: "david.heacock@dom.com" Cc: Tom Shaub; Margaret.Earle@dom.com; Cotton, Karen; Sanders, Carleen; Kulesa, Gloria; Feintuch, Karl

Subject:

DOMINION FLEET (KEWAUNEE, MILLSTONE 2 & 3, NORTH ANNA 1 & 2, SURRY 1 & 2) NUCLEAR PLANTS -

CYBER SECURITY PLAN (LICENSE AMENDMENT (TAC NO. ME4319, ME4320/4321, ME4322/4323, AND ME4324/4325)

Date: Monday, November 22, 2010 3:59:00 PM REQUEST FOR ADDITIONAL INFORMATION By letter dated July 12, 2010 (Agencywide Documents Access and Management System (ADAMS),

Accession No. ML1020100910), Dominion (Kewaunee, Millstone 2 & 3, North Anna 1 & 2, Surry 1 &

2) (the licensee) submitted a request to amend the Facility Operating License (DPR-43, DPR-65, NPF-49, NPF-4/7, DPR-32/37 respectively) for the Dominion sites. Per the proposed license amendment, the licensee requested approval of Dominion's Cyber Security Plan (CSP),

(ML1020100920), provided a proposed CSP Implementation Schedule, and included a proposed revision to the Facility Operating License to incorporate the provisions for implementing and maintaining in effect the provisions of the approved CSP. The licensees amendment request was based on a generic template developed by the Nuclear Energy Institute (NEI) in concert with the industry.

The NRC is in the process of reviewing the CSP and the proposed CSP Implementation Schedule. The NRC staff requests that additional information is required to complete its technical review. A supplemental request for additional information is the following:

Section: 4 Establishing, Implementing, and Maintaining the Cyber Security Program, Vulnerability Scanning:

One of the requirements of 10 CFR 73.54(c)(1) requires the cyber security program to implement security controls to protect the assets identified by paragraph 73.54(b)(1) from cyber attacks.

The CSP is based on the template contained in NEI 08-09, Revision 6. In Section 4.4.3.2, Vulnerability Scans, of the Dominion CSP the following text adverse impact to SSEP functions was omitted although this text is included in the NEI 08-09 template. The Dominion CSP notes in its deviation table that there are conditions other than adverse impact on SSEP functions when vulnerability scanning cannot be performed.

Please explain these other conditions when vulnerability scanning cannot be performed. If you have any questions, please contact me at 301-415-2597 or Karl Feintuch at 301-415-3079.

V. Sreenivas, PH.D., C.P.M.,

Project Manager, Rm.#O8F6, LPL2-1 North Anna Power Reactors, Units 1 and 2 Division of Operating Reactor Licensing-NRR (301) 415-2597, v.sreenivas@nrc.gov

• • • This email message, and any files transmitted with it, may contain confidential, non-public, sensitive and proprietary data intended solely for the person(s) to whom this email message is directly addressed. Unauthorized use of the data contained in this message is prohibited. If you are not the intended recipient of this message or have received this message in error, please notify the sender immediately by telephone or email Reply and delete the original message and any attachments without keeping a copy***