ML11147A114

Request for Additional Information Regarding License Amendment Request for Approval of Cyber Security Plan

ML11147A114
Person / Time
Site:	Duane Arnold
Issue date:	06/08/2011
From:	Feintuch K Plant Licensing Branch III
To:	Costanzo C NextEra Energy Duane Arnold
orf t j
References
TAC ME4287
Download: ML11147A114 (3)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555"()001 June 8, 2011 Mr. Christopher R. Costanzo Duane Arnold Energy Center NextEra Energy Duane Arnold, LLC 3277 DAEC Road Palo, IA 52324-9785

SUBJECT:

DUANE ARNOLD ENERGY CENTER - REQUEST FOR ADDITIONAL INFORMATION REGARDING LICENSE AMENDMENT REQUEST FOR APPROVAL OF CYBER SECURITY PLAN (TAC NO. ME4287)

Dear Mr. Costanzo:

By letter dated July 14, 2010, as supplemented by letters dated September 27,2010, November 17, 2010, and April 5, 2011, NextEra Energy Duane Arnold, LLC, submitted a license amendment request for the Duane Arnold Energy Center. The proposed amendment requested approval of the Duane Arnold Energy Center Cyber Security Plan.

The NRC staff is reviewing your submittals and has determined that additional information is needed to complete its review. The specific question is found in the enclosed request for additional information (RAI). It is requested that your RAI response be provided within 30 days of the date of this letter.

Sincerely, Karl D. Feintuch, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-331

Enclosure:

Request for Additional Information cc w/enclosure: Distribution via Listserv

REQUEST FOR ADDITIONAL INFORMATION REGARDING LICENSE AMENDMENT REQUEST FOR APPROVAL OF THE CYBER SECURITY PLAN DUANE ARNOLD ENERGY CENTER DOCKET NOS. SO-331 The requirements of 10 CFR 73.S4(a) are that each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in Section 73.1. Furthermore, 10 CFR 73.S4(a)(1) states that the licensee shall protect digital computer and communication systems and networks associated with:

(i) safety-related and important-to-safety functions; (ii) security functions; (iii) emergency preparedness functions, including offsite communications; and (iv) support systems and equipment that, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 3.0 of Enclosure 1 to the cyber security plan, Evaluation of Proposed Change, includes clarifications to the Nuclear Energy Institute 08-09 Cyber Security Plan template with regard to Emergency Preparedness and states, "Therefore, the systems and portions of systems to be protected from cyber attack in accordance with 10 CFR 73.S4(a)(1)(iii), must: (1) Perform a RSPS [Risk Significant Planning Standards]-related EP [emergency preparedness] function, and (2) Be within the licensee's complete custody and control."

The rule clearly states that digital computer and communication systems and networks associated with emergency preparedness functions, including offsite communications, shall be adequately protected against cyber attacks. For systems and networks that are not within the licensee's complete custody and control, the licensee is still required to ensure protection against cyber attacks.

Explain Duane Arnold Energy Center's deviation from the 10 CFR 73.S4(a)(1).

ENCLOSURE

June 8,2011 Mr. Christopher R. Costanzo Duane Arnold Energy Center NextEra Energy Duane Arnold, LLC 3277 DAEC Road Palo, IA 52324-9785

SUBJECT:

DUANE ARNOLD ENERGY CENTER - REQUEST FOR ADDITIONAL INFORMATION REGARDING LICENSE AMENDMENT REQUEST FOR APPROVAL OF CYBER SECURITY PLAN (TAC NO. ME4287)

Dear Mr. Costanzo:

By letter dated July 14, 2010, as supplemented by letters dated September 27,2010, November 17, 2010, and April 5, 2011, NextEra Energy Duane Arnold, LLC, submitted a license amendment request for the Duane Arnold Energy Center. The proposed amendment requested approval of the Duane Arnold Energy Center Cyber Security Plan.

The NRC staff is reviewing your submittals and has determined that additional information is needed to complete its review. The specific question is found in the enclosed request for additional information (RAI). It is requested that your RAI response be provided within 30 days of the date of this letter.

Sincerely, IRAJ Karl D. Feintuch, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-331

Enclosure:

Request for Additional Information cc w/enclosure: Distribution via Listserv DISTRIBUTION:

PUBLIC RidsNrrLABTully PPederson, NSIR LPL3-1 rtf RidsAcrsAcnw_MailCTR TWengert, NRRlDORL RidsNrrDorlLpl3-1 RidsNrrDorlDpr BSingal, NRRlDORL RidsNrrPMDuane Arnold RidsOgcRp RidsNrrPMStLucie RidsRgn3MailCenter RidsNrrLABClayton CErlanger, NSIR ADAMS Accession No' ML11147A114

• via email NSIRIDSPIDDRSI OFFICE LPL2-2/PM LPL2-2/LA LPL3-1/BC LPL3-1/PM ISCPB/BC NAME TOrf BClayton CErlanger* BPascarelli KFeintuch DATE 06/01/11 06/01/11 06/08/11 06/08/11 06/08/11 OFFICIAL AGENCY RECORD