ML110030705

Email, Request for Additional Information, License Amendment Request to Revise License Condition and Approve Cyber Security Plan

ML110030705
Person / Time
Site:	Waterford
Issue date:	01/03/2011
From:	Kalyanam N Plant Licensing Branch IV
To:	Mosher N, Steelman W Entergy Operations
Kalyanam N, NRR/DORL/LPL4, 415-1480
References
TAC ME4271
Download: ML110030705 (2)

Text

From: Kalyanam, Kaly Sent: Monday, January 03, 2011 12:46 PM To: STEELMAN, WILLIAM J; MOSHER, NATALIE B Cc: Lent, Susan; Burkhardt, Janet

Subject:

RAI on Waterford 3 LAR on CSP (TAC No. ME4271)

Plant: Waterford Steam Electric Station, Unit 3

Subject:

RAI on License Amendment Request TAC Nos.: ME4271 SUNSI Review Done: Yes. Publicly Available, Normal Release, Non-sensitive, From: N. Kalyanam To: W. Steelman RESUBMITTAL OF REQUEST FOR APPROVAL OF THE WATERFORD STEAM ELECTRIC STATION, UNIT 3 CYBER SECURITY PLAN REQUEST FOR ADDITIONAL INFORMATION (RAI)

By letter dated July 15, 2010, (ADAMS Accession No. ML102000415), Entergy resubmitted a request to amend the Facility Operating license for Waterford Steam Electric Station, Unit 3 (Waterford 3). Per the proposed license amendment, the licensee requested approval of the Waterford 3 Cyber Security Plan (CSP) (ADAMS Accession No. ML102000416), provided a proposed CSP Implementation Schedule, and included a proposed revision to the Facility Operating License to incorporate the provisions for implementing and maintaining in effect the provisions of the approved CSP. The licensees amendment request was based on a generic template developed by the Nuclear Energy Institute (NEI) in concert with the industry.

The NRC Staff is reviewing the CSP and the proposed CSP Implementation Schedule and has determined that additional information is required to complete its technical review (see below). Please provide your response to this RAI by February 15, 2011.

The supplemental request for additional information was reviewed in accordance with the guidance provided in 10 CFR 2.390 and the NRC staff has determined that no security related or proprietary information is contained therein.

CSP Section: 4 Establishing, Implementing, And Maintaining The Cyber Security Program RAI 1, Defense-in-Depth Protective Strategies - Critical Digital Asset isolation strategies

10 CFR 73.54(c)(2) requires the licensee to apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. Section 4.3, Defense-in-Depth Protective Strategies, of the Waterford 3 CSP states in several instances when referring to protections which isolate or secure Critical Digital Assets (CDAs) within various cyber security defensive levels, that boundaries may be secured via an air gap or deterministic one-way isolation device such as a data diode or hardware VPN [virtual private network].

Please clarify how hardware VPNs will sufficiently protect CDAs within defensive boundaries, including an explanation of the technical configurations that would enable it to mimic the capabilities of a deterministic one-way isolation device.

RAI 2, Defense-in-Depth Protective Strategies - Protection of Critical Digital Assets Associated with Emergency Preparedness Functions 10 CFR 73.54(a)(1) requires that The licensee shall protect digital computer and communication systems and networks associated with (iii) Emergency preparedness functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 4.3, Defense in Depth Protective Strategies of the Waterford 3 CSP, in describing its site defensive model and states that CDAs that are not required to be within Level 4 due to their safety or security significance, and that perform security or Emergency Plan (EP) functions and security or EP data acquisition or that perform safety monitoring, are within Level 3. Furthermore, the CSP states that CDAs that are not required to be in at least Level 3 and that perform or support Emergency Plan functions are within Level 2.

The CSP does not indicate which protective strategies will be implemented for CDAs that perform EP functions. Please clarify (1) the distinction between CDAs that perform EP and Emergency Preparedness functions; and (2) which protective strategies will be implemented for CDAs that perform emergency preparedness functions.