ML11152A198

NRR E-mail Capture - ME4287 - Draft 2nd Round RAI for Duane Arnold CSP

ML11152A198
Person / Time
Site:	Duane Arnold
Issue date:	05/31/2011
From:	Feintuch K Division of Operating Reactor Licensing
To:	Barta D Florida Power & Light Co
References
TAC ME4287
Download: ML11152A198 (3)

Text

NRR-PMDAPEm Resource From: Feintuch, Karl Sent: Tuesday, May 31, 2011 4:04 PM To: 'Barta, Doreen'

Subject:

ME4287 - draft 2nd round RAI for Duane Arnold CSP Attachments: DRAFT RAI 2nd round DAEC.docx RAI letters are currently being prepared for the FPL/NextEra plants. For manpower planning you can anticipate a response time of 30 days from the date of the cover letter currently in draft form. Attached is a draft of the expected RAI item associated with the letter being prepared.

I will notify you of the date of issuance of the letter when it becomes available.

Karl Feintuch USNRC 301-415-3079 1

Hearing Identifier: NRR_PMDA Email Number: 57 Mail Envelope Properties (26E42474DB238C408C94990815A02F095FA4714FDB)

Subject:

ME4287 - draft 2nd round RAI for Duane Arnold CSP Sent Date: 5/31/2011 4:03:31 PM Received Date: 5/31/2011 4:03:00 PM From: Feintuch, Karl Created By: Karl.Feintuch@nrc.gov Recipients:

"'Barta, Doreen'" <Doreen.Barta@fpl.com>

Tracking Status: None Post Office: HQCLSTR01.nrc.gov Files Size Date & Time MESSAGE 425 5/31/2011 4:03:00 PM DRAFT RAI 2nd round DAEC.docx 22531 Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date:

Recipients Received:

DRAFT

REQUEST FOR ADDITIONAL INFORMATION REGARDING LICENSE AMENDMENT REQUEST FOR APPROVAL OF THE CYBER SECURITY PLAN DUANE ARNOLD ENERGY CENTER DOCKET NOS. 50-331 The requirements of 10 CFR 73.54(a) are that each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in Section 73.1. Furthermore, 10 CFR 73.54(a)(1) states that the licensee shall protect digital computer and communication systems and networks associated with:

(i) safety-related and important-to-safety functions; (ii) security functions; (iii) emergency preparedness functions, including offsite communications; and (iv) support systems and equipment that, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 3.0 of Enclosure 1 to the cyber security plan, Evaluation of Proposed Change, includes clarifications to the Nuclear Energy Institute 08-09 Cyber Security Plan template with regard to Emergency Preparedness and states, Therefore, the systems and portions of systems to be protected from cyber attack in accordance with 10 CFR 73.54(a)(1)(iii), must: (1) Perform a RSPS [Risk Significant Planning Standards]-related EP [emergency preparedness] function, and (2) Be within the licensees complete custody and control.

The rule clearly states that digital computer and communication systems and networks associated with emergency preparedness functions, including offsite communications, shall be adequately protected against cyber attacks. For systems and networks that are not within the licensees complete custody and control, the licensee is still required to ensure protection against cyber attacks.

Explain Duane Arnold Energy Centers deviation from the 10 CFR 73.54(a)(1).