ML12191A122

License Amendment Request - Cyber Security Plan Implementation Schedule Milestones

ML12191A122
Person / Time
Site:	River Bend
Issue date:	06/20/2012
From:	Olson E Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
RBG-4746
Download: ML12191A122 (14)

Text

Entergy Operations, Inc.

River Bend Station

'Entergya 5485 U.S. Highway 61N St. Francisville, LA 70775 Tel 225-381-4374 Eric W. Olson Site Vice President 10CFR 2.390 Attachments Withheld RBG-47246 June 20, 2012 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

License Amendment Request - Cyber Security Plan Implementation Schedule Milestones River Bend Station - Unit 1 Docket No. 50-458 License No. NPF-47

References:

1. NRC letter to River Bend Station, Issuance of Amendment Re: Approval of Cyber Security Plan, dated July 29, 2011, per RBC-50945

2. River Bend Station letter to NRC, Response to Additional Requests for Additional Information and Revision to the River Bend Station Cyber Security Plan, dated April 4, 2011, per RBG-47129

Dear Sir or Madam:

In Reference 1, the NRC issued License Amendment No. 171 to the Facility Operating License for River Bend Station (RBS) that approved the River Bend Station Cyber Security Plan and associated implementation milestone schedule. The Cyber Security Plan Implementation Schedule contained in Reference 2 was utilized as a portion of the basis for the NRC's safety evaluation report provided by Reference 1. River Bend is planning to implement the requirements of Implementation Schedule Milestone 6 in a slightly different manner than described in the approved Implementation Schedule. Although no change to the Implementation Schedule date is proposed, the change to the description of the milestone activity is conservatively considered to be a change to the Implementation Schedule, and in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Entergy is submitting this request for an amendment to the Facility Operating License for RBS. The River Bend Station Cyber Security Plan, Revision 0 was previously provided in Reference 2.

This letter contains security-related information - Attachments 1 (Swions 1, 2, and 3) and 4 are withheld from public disclosure per 10 CFR V390 '!ýo

RBG-47246 Page 2 of 3 This letter contains security-related information - Attachments I (Sections 1, 2, and 3) and 4 are withheld from public disclosure per 10 CFR 2.390 provides an evaluation of the proposed change. Attachment 2 contains a proposed marked-up operating license page for the Physical Protection license condition for RBS to reference the commitment change provided in this submittal. Attachment 3 contains the proposed revised operating license page. Attachment 4 contains a change to the scope of Implementation Milestone 6. RBS requests that Attachments 1 (Sections 1, 2, and 3) and 4 which contain security-related information (SRI) be withheld from public disclosure in accordance with 10 CFR 2.390.

The proposed changes have been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration. The bases for these determinations are included in .

River Bend requests this license amendment be effective as of its date of issuance.

Although this request is neither exigent nor emergency, your review and approval is requested prior to December 31, 2012.

The revised commitment contained in this submittal is summarized in Attachment 5. Should you have any questions concerning this letter, or require additional information, please contact Mr. Joseph Clark at 225-381-4177.

I declare under penalty of perjury that the foregoing is true and correct. Executed on June 20, 2012.

Sincerely, EWO/JCR/JAC/wjf Attachments: 1. Analysis of Proposed Operating License Change (contains SRI)

2. Proposed RBS Operating License Changes (mark-up)

3. Revised RBS Operating License Page

4. Revised Cyber Security Plan Implementation Schedule (contains SRI)

5. List of Regulatory Commitments This letter contains security-related information - Attachments 1 (Sections 1, 2, and 3) and 4 are withheld from public disclosure per 10 CFR 2.390

RBG-47246 Page 3 of 3 This letter contains security-related information - Attachments 1 (Sections 1, 2, and 3) and 4 are withheld from public disclosure per 10 CFR 2.390 cc: U.S. Nuclear Regulatory Commission Region IV 1600 East Lamar Blvd.

Arlington, TX 76011-4511 NRC Resident Inspector PO Box 1050 St. Francisville, LA 70775 Ms. Tracie Lowrey Public Utility Commission of Texas 1701 N. Congress Ave.

Austin, TX 78711-3326 Department of Environmental Quality Office of Environmental Compliance Radiological Emergency Planning and Response Section JiYoung Wiley P.O. Box 4312 Baton Rouge, LA 70821-4312 Mr. Alan Wang, Project Manager U.S. Nuclear Regulatory Commission MS O-8B1 11555 Rockville Pike Rockville, MD 20852-2738 This letter contains security-related information - Attachments 1 (Sections 1, 2, and 3) and 4 are withheld from public disclosure per 10 CFR 2.390

This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 Attachment 1 RBG-47246 Analysis of Proposed Operating License Change This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 to RBG-47246 Page 2 of 5 This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 10 CFR 73.54 requires licensees to maintain and implement a cyber security plan. River Bend Station Facility Operating License NPF-47 includes a Physical Protection license condition that requires Entergy Operations, Inc. (Entergy) to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

4.2 Precedent Amendment No. 203 for the Callaway Plant (Reference 5) approved an implementation schedule using the Nuclear Energy Institute (NEI) template (Reference 3), with the exception of Milestone 6. The Callaway Plant deviated from the template for Milestone 6 to address only the NEI 08-09, Revision 6, Appendix D technical controls, excepting for the operational and management controls, on the basis that implementing the technical controls for the target set critical digital assets provides a high degree of protection against cyber related attacks that could lead to radiological sabotage.

The changes being proposed by Entergy in this amendment request are similar to those approved in the Callaway Plant Amendment No. 203.

This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 to RBG-47246 Page 3 of 5 This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 4.3 Significant Safety Hazards Consideration River Bend Station is requesting an amendment to the RBS Facility Operating License to revise the Physical Protection license condition as it relates to the cyber security plan. This change includes a proposed deviation to the scope of a Cyber Security Plan Implementation Schedule milestone and a proposed revision to the RBS Facility Operating License to include the proposed deviation. Specifically, River Bend proposes a change to the scope of Implementation Milestone 6 to apply to only technical cyber security controls.

River Bend has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. This change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and has no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. This proposed change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 to RBG-47246 Page 4 of 5 This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. Because there is no change to these established safety margins as result of this change, the proposed change does not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, River Bend concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.4 Conclusion In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment provides a change to the Cyber Security Plan Implementation Schedule. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(1 2). Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390 to RBG-47246 Page 5 of 5 This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390

6.0 REFERENCES

1. NRC letter to River Bend Station, Issuance of Amendment Re: Approval of Cyber Security Plan, dated July 29, 2011, per RBC-50945

2. River Bend Station letter to NRC, Response to Additional Requests for Additional Information and Revision to the River Bend Station Cyber Security Plan,dated April 4, 2011, per RBG-47129

3. Letter from Chris Earls (NEI) to Richard P. Correia (NRC), Template for the Cyber Security Plan Implementation Schedule, dated February 28, 2011 (ADAMS Accession No. ML110600211)

4. Letter from Richard P. Correia (NRC) to Chris Earls (NEI), Template for the Cyber Security Plan Implementation Schedule, dated March 1, 2011 (ADAMS Accession No. ML110070348)

5. NRC letter from M. C. Thadani, USNRC, to A. C. Heflin, Union Electric Company, "Callaway Plant, Unit 1 - Issuance of Amendment Re: Approval of Cyber Security Plan (TAC NO. ME4536)," August 17, 2011 (ADAMS Accession No. ML112140087)

This attachment contains security-related information - Sections 1, 2, and 3 are withheld from public disclosure per 10 CFR 2.390

Attachment 2 RBG-47246 Proposed RBS Operating License Changes (mark-up)

D. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to the provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Physical Security, Safeguards Contingency and Training & Qualification Plan," submitted by letter dated May 16, 2006.

E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority .of 10 CER 50.90 an~d 10 CF is F. Except as otherwise provided in the Technical Specifications or Environmental Protection Plan, EOI shall report any violations of the requirements contained in Section 2, Items C.(1); C.(3) through (9); and C.(11) through (16) of this license in the following manner: initial notification shall be made within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to the NRC Operations Center via the Emergency Notification System with written followup within 60 days in accordance with the procedures described in 10 CFR 50.73(b), (c) and (e).

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. This license is effective as of the date of issuance and shall expire at midnight on August 29, 2025.

FOR THE NUCLEAR REGULATORY COMMISSION Harold R. Denton, Director Office of Nuclear Reactor Regulation

Enclosures:

1. Attachments 1-5

2. Appendix A - Technical Specifications (NUREG-1 172)

3. Appendix B - Environmental Protection Plan

4. Appendix C - Antitrust Conditions Date of Issuance: November 20, 1985 Revised: December 16, 1993 Amendment No. 70 7-95 119 136 471

'Revised by let#er datod Qctobor 28, 2004 Rovicod by lett8r datod Novomber 19, 2001 Revicd by lottor dated

• January 24, 2

Attachment 3 RBG-47246 Revised RBS Operating License Page

D. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to the provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Physical Security, Safeguards Contingency and Training & Qualification Plan," submitted by letter dated May 16, 2006.

E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 171 as supplemented by a change approved by License Amendment No.

F. Except as otherwise provided in the Technical Specifications or Environmental Protection Plan, EOI shall report any violations of the requirements contained in Section 2, Items C.(1); C.(3) through (9); and C.(1 1) through (16) of this license in the following manner: initial notification shall be made within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to the NRC Operations Center via the Emergency Notification System with written followup within 60 days in accordance with the procedures described in 10 CFR 50.73(b), (c) and (e).

G. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

H. This license is effective as of the date of issuance and shall expire at midnight on August 29, 2025.

FOR THE NUCLEAR REGULATORY COMMISSION Harold R. Denton, Director Office of Nuclear Reactor Regulation

Enclosures:

1. Attachments 1-5

2. Appendix A - Technical Specifications (NUREG-1172)

3. Appendix B - Environmental Protection Plan

4. Appendix C - Antitrust Conditions Date of Issuance: November 20, 1985 Revised: December 16, 1993 Amendment No. 70 798 5 !1@ 135 171, Revised by loller datod_ October28 20 Rovised by loller dated Novomfbor 19, 2001 Revised by letrdattedd Januar' 21, 200

Attachment 5 RBG-47246 List of Regulatory Commitments to RBG-47246 Page 1 of 1 i.-

List of Regulatory Commitments The following table identifies those actions committed to by RBS in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE SCHEDULED (Check One) COMPLETION COMMITMENT ONE- DATE TIME CONTINUING (If Required)

ACTION COMPLIANCE River Bend will implement milestones 1, X December 31, 2012 2, 3, 4, 5, and 7 described in Attachment 4 of letter dated April 4, 2011, and the revised Milestone 6 in Attachment 4 of this submittal.