ML110320354

and Prairie Island Nuclear Generating Plant, Units 1 and 2 - Request for Additional Information Related to License Amendment Request for Approval of Cyber Security Plan

ML110320354
Person / Time
Site:	Monticello, Prairie Island
Issue date:	02/15/2011
From:	Thomas Wengert Plant Licensing Branch III
To:	Salamon G Northern States Power Co
Wengert, Thomas
References
TAC ME4272, TAC ME4294, TAC ME4295
Download: ML110320354 (4)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555*0001 February 15, 2011 Mr. Gabor Salamon Director, Nuclear licensing and Emergency Preparedness Northern States Power Company - Minnesota 414 Nicollett Mall- MP4 Minneapolis, MN 55401

SUBJECT:

MONTICELLO NUCLEAR GENERATING PLANT AND PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 - REQUEST FOR ADDITIONAL INFORMATION RELATED TO LICENSE AMENDMENT REQUEST FOR APPROVAL OF CYBER SECURITY PLAN (TAC NOS. ME4272, ME4294 AND ME4295)

Dear Mr. Salamon:

By letter to the U.S. Nuclear Regulatory Commission (NRC) dated July 20, 2010, Northern States Power Company, a Minnesota corporation (NSPM, the licensee), doing business as Xcel Energy, submitted a request for approval of the NSPM Cyber Security Plan and provided a proposed implementation schedule for the Monticello Nuclear Generating Plant and the Prairie Island Nuclear Generating Plant, Units 1 and 2.

The NRC staff is reviewing your submittal and has determined that additional information is required to complete the review. The specific information requested is addressed in the enclosure to this letter. During a discussion with your staff on January 31,2011, it was agreed that you would provide a response by February 28, 2011.

The NRC staff considers that timely responses to requests for additional information help ensure sufficient time is available for staff review and contribute toward the NRC's goal of efficient and effective use of staff resources. If circumstances result in the need to revise the requested response date, please contact me at (301) 415-4037.

Sincerely,

~~d~~

Thomas J. Wengert, seniOr~rOject Manager Plant licensing Branch 111-1 Division of Operating Reactor licensing Office of Nuclear Reactor Regulation Docket Nos. 50-263, 50-282 and 50-306

Enclosure:

Request for Additional Information cc w/encl: Distribution via listServ

REQUEST FOR ADDITIONAL INFORIVIATION (RAI)

REGARDING APPROVAL OF CYBER SECURITY PLAN NORTHERN STATES POWER COMPANY - MINNESOTA MONTICELLO NUCLEAR GENERATING PLANT. UNIT 1 PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 DOCKET NOS. SO-263. SO-282, AND SO-306 In reviewing the Northern States Power Company, a Minnesota corporation (NSPM, the licensee), doing business as Xcel Energy, submittal dated July 20,2010 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML102020164), which requested approval of the Cyber Security Plan (CSP) for the Monticello Nuclear Generating Plant and the Prairie Island Nuclear Generating Plant, Units 1 and 2, the U.S. Nuclear Regulatory Commission (NRC) staff has determined that the following information is needed to complete its review:

Cyber Security Plan (CSP) Section 4: Establishing, Implementing, and Maintaining the Cyber Security Program RAI 1: Clarifying the Site Defensive Model Title 10 of the Code of Federal Regulations (10 CFR) Section 73.S4(c)(2) calls for the licensee to "apply and maintain defense-in-depth protective strategies ... " and 10 CFR 73.S4(d)(2) calls for the licensee to evaluate and manage cyber risks.

Nuclear Energy Institute (NEI) 08-09 Revision 6, page A-12, section 4.3, provides two examples of an effective defensive model to meet the requirements of 10 CFR 73.S4. Example 1 states (in part): Information flows between Levels 3 and 4 are restricted through the use of a firewall and a network-based intrusion detection system. Example 2 states (in part): Information flows between security critical digital assets (CDAs) in one level and security CDAs in another level are restricted through the use of a firewall and a network-based intrusion detection system.

The Monticello and Prairie Island CSP (as found on page 12, section 4.3, third paragraph) states (in part): The boundary between Level 3 and Level 2 is implemented by one or more devices or methods [emphasis added] that isolate CDAs in or above Level 3. Information flows between Levels 3 and 4 are restricted through the use of defense-in-depth techniques that utilize technologies such as [emphasis added] firewalls and network-based intrusion detection systems and strategic local area network architecture designs.

There are two parts to the RAI, but both relate to the defensive architecture:

Enclosure

-2

1. What are the "devices or methods" (these words are not used in the NEI 08-09 template) referred to in the Monticello and Prairie Island CSP? Provide an explanation of how this is equivalent to unidirectional communication devices (e.g., data diodes) or air gaps.

2. The Monticello and Prairie Island CSP uses the term "such as", which means these are just examples and the application of only one approach (e.g., a firewall alone) may suffice. Clarify how this approach is equivalent to an approach that incorporates both a firewall and a network intrusion detection system (i.e., two independent protection methods).

RAI2: Timeframe for Verifying Security Controls Section 73.54(g) of 10 CFR states: "The licensee shall review the cyber security program as a component of the physical security program in accordance with the requirements of § 73.55(m),

including the periodicity requirements." And, 10 CFR 73.55(m) states that the Security Program be reviewed: "(1) As a minimum the licensee shall review each element of the physical protection program at least every 24 months."

Monticello and Prairie Island CSP states on page 14, section 4.4.3, last paragraph: Ongoing assessments are performed to verify that the cyber security controls implemented for CDAs remain in place throughout the life cycle. The assessment process verifies the status of these cyber security controls at least every 36 months [emphasis added] or in accordance with the specific requirements for utilized cyber security controls as described in Appendices 0 and E of NEI 08-09, Revision 6, whichever is more frequent.

Clarify how a periodicity of 36 months for the assessment of cyber security controls meets the requirements of 10 CFR 73.55(m) for 24 months.

February 15, 2011 Mr. Gabor Salamon Director, Nuclear Licensing and Emergency Preparedness Northern States Power Company - Minnesota 414 Nicollett Mall- MP4 Minneapolis, MN 55401

SUBJECT:

MONTICELLO NUCLEAR GENERATING PLANT AND PRAIRIE ISLAND NUCLEAR GENERATING PLANT, UNITS 1 AND 2 - REQUEST FOR ADDITIONAL INFORMATION RELATED TO LICENSE AMENDMENT REQUEST FOR APPROVAL OF CYBER SECURITY PLAN (TAC NOS. ME4272, ME4294 AND ME4295)

Dear Mr. Salamon:

By letter to the U.S. Nuclear Regulatory Commission (NRC) dated July 20, 2010, Northern States Power Company, a Minnesota corporation (NSPM, the licensee), doing business as Xcel Energy, submitted a request for approval of the NSPM Cyber Security Plan and provided a proposed implementation schedule for the Monticello Nuclear Generating Plant and the Prairie Island Nuclear Generating Plant, Units 1 and 2.

The NRC staff is reviewing your submittal and has determined that additional information is required to complete the review. The specific information requested is addressed in the enclosure to this letter. During a discussion with your staff on January 31, 2011, it was agreed that you would provide a response by February 28, 2011.

The NRC staff considers that timely responses to requests for additional information help ensure sufficient time is available for staff review and contribute toward the NRC's goal of efficient and effective use of staff resources. If circumstances result in the need to revise the requested response date, please contact me at (301) 415-4037.

Sincerely, IRAI Thomas J. Wengert, Senior Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-263, 50-282 and 50-306

Enclosure:

Request for Additional Information cc w/encl: Distribution via ListServ DISTRIBUTION:

PUBLIC LPL3-1 R/F RidsNrrPMMonticello Resource RidsNrrDorlDpr Resource RidsNrrDorlLpl3-1 Resource RidsAcrsAcnw_MailCTR Resou rce PPederson, NSIR RidsNRRPMPrairielsland Resource RidsOgcRp Resource RidsNrrLABTully Resource RidsRgn3MailCenter Resource ADAMS Accession Number" IVIL110320354 OFFICE LPL3-1/PM LPL3-1/LA LPL3-1/BC NAME TWengert BTuily RPascarelii DATE 02/07/11 02/02/11 02/15/11 OFFICIAL RECORD COPY