ML110030661

Issuance of Request for Additional Information - Cyber Security Plan (Tac ME4356)

ML110030661
Person / Time
Site:	Palisades
Issue date:	01/07/2011
From:	Mahesh Chawla Plant Licensing Branch III
To:	Entergy Nuclear Operations
Chawla M, NRR/DORL, 415-8371
References
TAC ME4355
Download: ML110030661 (4)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 7, 2011 Vice President, Operations Entergy Nuclear Operations, Inc.

Palisades Nuclear Plant 27780 Blue Star Memorial Highway Covert, MI 49043-9530 SUB~IECT: PALISADES PLANT - REQUEST FOR ADDITIONAL INFORMATIOI\I- CYBER SECURITY PLAN (TAC NO. ME4355)

Dear Sir:

By letter dated July 26, 2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102110090), Entergy Nuclear Operations, Inc. (ENO, the licensee),

withdrew the request to amend the Renewed Facility Operating License (RFOL)

No. DPR-20 for Palisades Nuclear Plant (PNP), as submitted in ENO's letter dated November 19,2009 (ADAMS Accession No. ML093230831).

In the letter dated July 26, 2010, ENO submitted a new request for an amendment to the RFOL for PNP in accordance with provisions of Title 10 of the Code of Federal Regulations (10 CFR) 50.4 and 10 CFR 50.90. The proposed amendment requests Nuclear Regulatory Commission (NRC) approval of the PNP Cyber Security Plan (CSP), provides an implementation schedule, and revises the existing RFOL Physical Protection license condition to require ENO to fully implement and maintain in effect all provisions of the NRC-approved CSP for PNP.

The NRC staff of the Integrated Security Coordination and Policy Branch is reviewing the CSP and the proposed CSP Implementation Schedule and has determined that additional information is required to complete its technical review. A supplemental request for additional information is included in Enclosure 1 and was reviewed in accordance with the guidance provided in 10 CFR Section 2.390 and the NRC staff has determined that no security related or proprietary information is contained therein. The specific questions are found in the enclosed request for additional information (RAI).

-2 Please contact me @ 301-415-8371 or Mahesh.chawla@nrc.gov to schedule a telephone conference between the NRC staff and the licensee to ensure that the NRC staff concerns are clear to the licensee and also to obtain a firm commitment date for the response to the RAls.

Please let me know if you have any questions or concerns relating to this issue.

Sincerely,

>>:1ftrJ1/--

Mahesh L. Chawla, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-255

Enclosure:

Request for Additional Information cc w/encl: Distribution via ListServ

REQUEST FOR ADDITIONAL INFORMATION REGARDING APPROVAL OF THE CYBER SECURITY PLAN ENTERGY NUCLEAR OPERATIONS, INC.

PALISADES NUCLEAR PLANT Cyber Security Plan (CSP) Section 4: Establishing, Implementing, and Maintaining the Cyber Security Program RAI1:

RAI

Title:

Defense-in-Depth Protective Strategies - Critical Digital Asset (CDA) Isolation Strategies Title 10 of the Code of Federal Regulations (10 CFR) Section 73.54(c)(2) requires the licensee to apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. Section 4.3, "Defense-in-Depth Protective Strategies," of the Palisades CSP states in several instances when referring to protections which isolate or secure CDAs within various cyber security defensive levels, that boundaries may be secured via "an air gap or deterministic one-way isolation device such as a data diode or hardware VPN [virtual private network]."

Please clarify how hardware VPNs will sufficiently protect CDAs within defensive boundaries, including an explanation of the technical configurations that would enable it to mimic the capabilities of a deterministic one-way isolation device.

RAI2:

RAI

Title:

Defense-in-Depth Protective Strategies - Protection of CDAs Associated with Emergency Preparedness Functions Section 73.54(a)(1) of 10 CFR requires that "The licensee shall protect digital computer and communication systems and networks associated with ... (iii) Emergency preparedness functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions."

Section 4.3, "Defense in Depth Protective Strategies" of the Palisades CSP, in describing its site defensive model, states that CDAs that "are not required to be within Level 4 due to their safety or security significance, and that perform security or Emergency Plan functions and security or Emergency Plan data acquisition or that perform safety monitoring, are within Level 3."

Furthermore, the CSP states that "CDAs that are not required to be in at least Level 3 and that perform or support Emergency Plan functions are within Level 2."

The CSP does not indicate which protective strategies will be implemented for CDAs that perform Emergency Preparedness functions. Please clarify: (1) the distinction between CDAs that perform Emergency Planning and Emergency Preparedness functions; and (2) which protective strategies will be implemented for CDAs that perform "emergency preparedness" functions.

ENCLOSURE

-2 Please contact me @ 301-415-8371 or Mahesh.chawla@nrc.gov to schedule a telephone conference between the NRC staff and the licensee to ensure that the NRC staff concerns are clear to the licensee and also to obtain a firm commitment date for the response to the RAls.

Please let me know if you have any questions or concerns relating to this issue.

Sincerely, IRAJ Mahesh L. Chawla, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-255

Enclosure:

Request for Additional Information cc w/encl: Distribution via ListServ DISTRIBUTION:

PUBLIC LPL3-1 rlf RidsAcrsAcnw_MailCTR Resource RidsNrrDirsltsb Resource RidsNrrDorlDpr Resource RidsNrrDorlLpl3-1 Resource RidsNrrPMPalisades Resource RidsNrrLABTully Resource RidsOgcRp Resource RidsRgn3MailCenter Resource RidsNsirlscpb CErlanger, NSIR/ISCPB ADAMS Accession No ML110030661

• Memo dated 12/14/10 - ML103410025 OFFICE LPL3-1/PM LPL3-1/LA NSIR/ISCPB/BC* LPL3-1/BC NAME MChawla BTuily THarris for CErlanger RPascarelli DATE 01/06/11 01/06/11 12/14/10 01/07/11 OFFICIAL RECORD COpy