ML110060385

Request for Additional Information, Related to the License Amendment Request for Approval of the Perry Cyber Security Plan

ML110060385
Person / Time
Site:	Perry
Issue date:	01/20/2011
From:	Michael Mahoney Plant Licensing Branch III
To:	Bezilla M FirstEnergy Nuclear Operating Co
mahoney, m NRR/DORL/LPLIII-2 415-3867
References
TAC ME4367
Download: ML110060385 (4)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 20, 2011 Mr. Mark B. Bezilla Site Vice President FirstEnergy Nuclear Operating Company Perry Nuclear Power Plant Mail Stop A-PY-A290 P.O. Box 97,10 Center Road Perry,OH 44081-0097

SUBJECT:

PERRY NUCLEAR POWER PLANT, UNIT NO.1 - REQUEST FOR ADDITIONAL INFORMATION RELATED TO THE LICENSE AMENDMENT REQUEST FOR APPROVAL OF THE PERRY CYBER SECURITY PLAN (TAC NO. ME4367)

Dear Mr. Bezilla:

By letter to the Nuclear Regulatory Commission (NRC) dated July 22,2010 (Agencywide Documents Access and Management System Accession No. ML102100033), FirstEnergy Nuclear Operating Company (FENOC or the licensee), submitted a license amendment request for approval of the Perry Nuclear Power Plant, Unit No.1 Cyber Security Plan.

The NRC staff is reviewing your submittal and has determined that additional information is required to complete the review. The specific information requested is addressed in the enclosure to this letter. During a discussion with your staff on January 4, 2011, it was agreed that you would provide a response within 30 days from the date of this letter.

The NRC staff considers that timely responses to requests for additional information help ensure sufficient time is available for staff review and contribute toward the NRC's goal of efficient and effective use of staff resources. If circumstances result in the need to revise the requested response date, please contact me at (301) 415-3867.

Michael Mahoney, Pr 'ect Manager Plant Licensing Branch 111-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-440

Enclosure:

Request for Additional Information cc w/encl: Distribution via Listserv

REQUEST FOR ADDITIONAL INFORMATION FIRSTENERGY NUCLEAR OPERATING COMPANY PERRY NUCLEAR POWER PLANT, UNIT NO.1 DOCKET NO. 50-440 The Nuclear Regulatory Commission (NRC) staff has reviewed the July 22,2010 (Agencywide Documents Access and Management System Accession No. ML102100033) FirstEnergy Nuclear Operating Company submittal regarding the request for approval of the Perry Nuclear Power Plant, Unit No.1 (PNPP) Cyber Security Plan (CSP). The NRC staff has determined that the following information is needed in order to complete its review:

CSP, Section 3: Analyzing Digital Computer Systems and Networks Request for Additional Information (RAI) No.1 Cyber Security Assessment Team Title 10 of the Federal Code of Regulations (10 CFR) Section 73.54(c)(1) requires the licensee to design a cyber security program that implements cyber security controls. In the Nuclear Energy Institute (NEI) 08-09 Rev. 6, Appendix A, Section 3.1.2, the roles and responsibilities of the cyber security team includes the following bullet:

• "Documenting the required cyber security control application per Section 3.1.6 of this Plan."

In the PNPP CSP, Section 3.1.2, the corresponding bullet says:

• "Reviewing and approving the required cyber security control application per Section 3.1.6 of this Plan."

"Documenting" means to provide a written account. "Reviewing and approving" means to conduct an official examination and to accept as satisfactory - it does not necessarily imply that a written account will be prepared on the application of security controls.

Please clarify that the licensee will provide written documentation of the application of the required cyber security controls or explain how "reviewing and approving" will include documentation of the required security controls.

CSP, Section 4: Establishing, Implementing, and Maintaining the Cyber Security Program RAI No.2 Defense-in-Depth Protective Strategies - Critical Digital Asset (CDA) Isolation Strategies Section 73.54(c)(2) of 10 CFR requires the licensee to "apply and maintain defense-in-depth ENCLOSURE

-2 protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks". NEI 08-09 Rev. 6, Appendix A, Section 4.3, directs the licensee to provide a site-specific description of the Defensive Architecture that answers the following questions:

1. In what level or levels are safety and security CDAs located?

2. What are the boundaries, and what are the data flow rules between defensive levels?

3. How are the data flow rules enforced? For example, if a deterministic boundary device is used, the description can be brief (e.g. data flow is enforced between levels 3 and 4 using a data diode). However, if a non-deterministic boundary device is used (e.g., a firewall), the plan needs to include the criteria that the device will apply to enforce the data flow rule (e.g., Section 6 of NEI 08-09, Revision 6, Appendix E non-deterministic data flow criteria).

The description provided in the PNPP CSP differs appreciably from the two examples provided in Section 4.3 of NEI 08-09 Rev. 6. Clarification is required to ensure that the licensee's site-specific description of the Defensive Architecture adequately addresses the above questions. In particular, please clarify the following issues:

• Which safety CDAs does the licensee intend to locate outside of Level 4? What is the justification for locating a safety CDA in Level 3?

• The licensee says that "data flows from one level to other levels only through a device or devices that enforces documented cyber security policy between levels and detects, prevents, delays, mitigates, and recovers from cyber attacks coming from lower cyber security levels." What are the specific sets of security controls the licensee intends to implement to achieve this goal?

• The licensee says the "data transmission across defensive levels are analyzed, evaluated for risk, and protected." What will this analysis consist of? How will data transmission risks be evaluated by the licensee? What security controls will be enforced to achieve acceptable risks?

• The licensee says that "Communications initiated from lower levels to CDAs at higher levels is (1) eliminated, or (2) severely restricted, and cyber security controls and mitigation measures are in place that are analyzed, and described to demonstrate how the communications are severely restricted." What security controls will the licensee implement to "severely restrict communications" across a defensive level?

January 20, 2011 Mr. Mark B. Bezilla Site Vice President FirstEnergy Nuclear Operating Company Perry Nuclear Power Plant Mail Stop A-PY -A290 P.O. Box 97,10 Center Road Perry,OH 44081-0097

SUBJECT:

PERRY NUCLEAR POWER PLANT, UNIT NO.1 - REQUEST FOR ADDITIONAL INFORMATION RELATED TO THE LICENSE AMENDMENT REQUEST FOR APPROVAL OF THE PERRY CYBER SECURITY PLAN (TAC NO. ME4367)

Dear Mr. Bezilla:

By letter to the Nuclear Regulatory Commission (NRC) dated July 22, 2010 (Agencywide Documents Access and Management System Accession No. ML102100033), FirstEnergy Nuclear Operating Company (FENOC or the licensee), submitted a license amendment request for approval of the Perry Nuclear Power Plant, Unit No. 1 Cyber Security Plan.

The NRC staff is reviewing your submittal and has determined that additional information is required to complete the review. The specific information requested is addressed in the enclosure to this letter. During a discussion with your staff on January 4, 2011, it was agreed that you would provide a response within 30 days from the date of this letter.

The NRC staff considers that timely responses to requests for additional information help ensure sufficient time is available for staff review and contribute toward the NRC's goal of efficient and effective use of staff resources. If circumstances result in the need to revise the requested response date, please contact me at (301) 415-3867.

Sincerely, IRA!

Michael Mahoney, Project Manager Plant licensing Branch 111-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-440

Enclosure:

Request for Additional Information cc w/encl: Distribution via Listserv DISTRIBUTION:

PUBLIC LPL3-2 RlF RidsNrrDorlLpl3-2 Resource RidsNrrPMPerry Resource RidsNrrLATHarris Resource RidsAcrsAcnw MailCTR Resource RidsOgcRp Resource RidsRgn3MailCenter Resource RidsNrrDorlDpr Resource CErlanger, NSIR PPederson, NSIR ADAMS Accesslon . No. ML110060385 *Bsy MemoDae t d NRR-088 OFFICE LPL3-21PM LPL3-21LA NSIRlDSPIISCPB b 3-2/ BC LPL3-2/PM NAME MMahoney THarris CErlanger RCarlson MMahoney DATE 0117 111 0117111 12128/10* 01/17/11 01/20/11 OFFICIAL RECORD COPY