ML103500274

Request for Additional Information Email, License Amendment Request to Revise License Condition and Approve Cyber Security Plan Based on NEI 08-09, Revision 3

ML103500274
Person / Time
Site:	Grand Gulf
Issue date:	12/16/2010
From:	Wang A Plant Licensing Branch IV
To:	Perino C Entergy Operations
Wang, A B, NRR/DORL/LPLIV, 415-1445
References
TAC ME4379
Download: ML103500274 (2)

Text

From: Wang, Alan Sent: Thursday, December 16, 2010 10:30 AM To: Perino, Christina Cc: JACKSON, RITA R; ENGLAND, LESLEY A; Lent, Susan; Burkhardt, Janet

Subject:

Cyber Security Amendment Request for Additional Information(ME4379)

Christina, By letter dated July 22, 2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102070558), Entergy Operations, Inc. (the licensee), resubmitted a request to amend the Facility Operating License No. NPF-29 for Grand Gulf Nuclear Station (GGNS), Unit 1. The licensee requested approval of the GGNS Cyber Security Plan (CSP),

provided a proposed CSP Implementation Schedule, and included a proposed revision to the Facility Operating License to incorporate the provisions for implementing and maintaining in effect the provisions of the approved CSP. The licensee stated that the amendment request was based on a generic template developed by the Nuclear Energy Institute (NEI) in concert with the industry.

The U.S. Nuclear Regulatory Commission (NRC) staff has determined that the following additional information is needed for the NRC staff to complete our review of the CSP and the proposed CSP Implementation Schedule. This request was discussed with Les England of your staff on December 8, 2010, and it was agreed that a response would be provided by February 15, 2011. In addition, the licensee stated it would provide supplemental information regarding

1) scope of systems, 2) the implementation schedule, and 3) record retention. If circumstances result in the need to revise the requested response date, please contact me at (301) 415-1445 or via e-mail at Alan.Wang@nrc.gov.

The following requests for additional information (RAIs) are related to CSP Section 4, Establishing, Implementing, And Maintaining The Cyber Security Program.

RAI 1 Defense-in-Depth Protective Strategies - Critical Digital Asset Isolation Strategies 10 CFR 73.54(c)(2) requires the licensee to apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks.

Section 4.3, Defense-in-Depth Protective Strategies, of the GGNS CSP states in several instances when referring to protections which isolate or secure Critical Digital Assets (CDAs) within various cyber security defensive levels, that boundaries may be secured via an air gap or deterministic one-way isolation device such as a data diode or hardware VPN.

Please clarify how hardware VPNs will sufficiently protect CDAs within defensive boundaries, including an explanation of the technical configurations that would enable it to mimic the capabilities of a deterministic one-way isolation device.

RAI 2 Defense-in-Depth Protective Strategies - Protection of Critical Digital Assets Associated with Emergency Preparedness Functions 10 CFR 73.54(a)(1) requires that The licensee shall protect digital computer and communication systems and networks associated with (iii) Emergency preparedness

functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 4.3, Defense in Depth Protective Strategies of the GGNS CSP, in describing its site defensive model, states that CDAs that are not required to be within Level 4 due to their safety or security significance, and that perform security or Emergency Plan functions and security or Emergency Plan data acquisition or that perform safety monitoring, are within Level 3. Furthermore, the CSP states that CDAs that are not required to be in at least Level 3 and that perform or support Emergency Plan functions are within Level 2.

The CSP does not indicate which protective strategies will be implemented for CDAs that perform Emergency Preparedness functions. Please clarify (1) the distinction between CDAs that perform Emergency Planning and Emergency Preparedness functions; and (2) which protective strategies will be implemented for CDAs that perform emergency preparedness functions.

RAI 3 Ongoing Assessment of Cyber Security Controls 10 CFR 73.54(g) states that The licensee shall review the cyber security program as a component of the physical security program in accordance with the requirements of 10 CFR 73.55(m), including the periodicity requirements. 10 CFR 73.55(m)(1), in turn states As a minimum the licensee shall review each element of the physical protection program at least every 24 months. Also, 10 CFR 73.55(m)(2) states further that Reviews of the security program must include, but not be limited to, an audit of the effectiveness of the physical security program, security plans, implementing procedures, cyber security programs, safety/security interface activities, the testing, maintenance, and calibration program, and response commitments by local, State, and Federal law enforcement authorities. These Rules require that the CSP (including the security controls that will be implemented to protect the CDAs of the plant) must be reviewed as part of the physical protection program at least every 24 months.

Section 4.4.3 of the GGNS CSP states that The assessment process verifies the status of these cyber security controls approximately every 24 months or in accordance with the specific requirements for utilized cyber security controls as described in Appendices D and E of NEI 08-09, Revision 6, whichever is more frequent.

Clarify how the GGNS CSP assessment process that operates approximately every 24 months meets the requirements as specified 10 CFR 73.55 (m)(1).

Alan Wang Project Manager (Grand Gulf Nuclear Station)

Nuclear Regulatory Commission Division of Operating Reactor Licensing