ML12255A278

Supplement to Request for Revision of the PVNGS Cyber Security Plan Implementation Schedule

ML12255A278
Person / Time
Site:	Palo Verde
Issue date:	09/04/2012
From:	Mims D Arizona Public Service Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
102-06577-DCM/TNW/RKR
Download: ML12255A278 (5)

Text

10 CFR 50.90 iA6 A subsidiary of PinnacleWest CapitalCorporation Dwight C. Mims Mail Station 7605 Palo Verde Nuclear Senior Vice President Tel: 623-393-5403 P.O. Box 52034 Generating Station Nuclear Regulatory and Oversight Fax: 623-393-6077 Phoenix, Arizona 85072-2034 102-06577-DCM/TNW/RKR September 4, 2012 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

Subject:

Palo Verde Nuclear Generating Station (PVNGS)

Units 1, 2, and 3 Docket Nos. STN 50-528, 50-529, and 50-530 Supplement to Request for Revision of the PVNGS Cyber Security Plan Implementation Schedule On August 10, 2012 (letter number 102-06567), Arizona Public Service Company (APS) requested NRC approval of a revision to the PVNGS Cyber Security Plan (CSP)

Implementation Schedule. Subsequently, the NRC staff requested that APS reevaluate the 10 CFR 2.390 security-related classification of Section 4.3 "Significant Hazards Consideration" of the submittal to determine if it could be made available to the public.

APS has reevaluated Section 4.3 and has determined that it can be decontrolled.

Accordingly, the enclosure to this submittal contains a decontrolled version of Section 4.3. Other than removal of the 10 CFR 2.390 page designations, no other changes have been made to Section 4.3 of the referenced submittal.

Should you need further information regarding this submittal, please contact Robert K.

Roehler, acting Licensing Section Leader, at (623) 393-5241.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on 9A9*

(Date)

Sincerely, DCM/TNW/RKR A member of the STARS (Strategic Teaming and Resource Sharing) Alliance C Callaway

• Comanche Peak

• Diablo Canyon

• Palo Verde

• San Onofre

• South Texas

• Wolf Creek Per L Y-l

ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Supplement to Request for Revision of the PVNGS Cyber Security Plan Implementation Schedule Page 2 Enclosure - Section 4.3 Significant Hazards Consideration cc: E. E. Collins Jr. NRC Region IV Regional Administrator L. K. Gibson NRC NRR Project Manager for PVNGS M. A. Brown NRC Senior Resident Inspector for PVNGS E. T. Byre Sr. Physical Security Inspector, RIV/DRS/PSB A. V. Godwin Arizona Radiation Regulatory Agency (ARRA)

T. Morales Arizona Radiation Regulatory Agency (ARRA)

Enclosure Section 4.3 Significant Hazards Consideration

4.3 SIGNIFICANT HAZARDS CONSIDERATION Cyber security requirements are codified in 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1 (a)(1)(v).

This application requests NRC approval of a revision to the PVNGS CSP Implementation Schedule. PVNGS has a fully dedicated Cyber Security Project, approved budget, a detailed Implementation Schedule in place, and APS is committed to full implementation of the revised CSP. APS has evaluated the proposed changes as required by 10 CFR 50.91 (a) using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. An analysis of the issue of no significant hazards consideration is presented below:

Criterion 1: Does the proposedamendment involve a significantincrease in the probabilityor consequences of an accidentpreviously evaluated?

Response: No.

The proposed amendment revises the Implementation Schedule of the PVNGS CSP.

Implementation of the CSP itself does not involve any modifications to the safety-related structures, systems, or components (SSCs). The Implementation Schedule for the CSP describes how the requirements of 10 CFR 73.54 are to be implemented. The revision to the CSP Implementation Schedule will have no appreciable negative effect on the ability to identify, evaluate, and mitigate cyber attacks up to and including the design basis cyber attack threat, thereby achieving high assurance that the facility's digital computer and communications systems and networks are protected from cyber attacks.

The revision of the CSP Implementation Schedule will not alter previously evaluated Updated Final Safety Analysis Report (UFSAR) design basis accident analysis assumptions, add any accident initiators, or affect the function of the plant safety-related SSCs as to how they are operated, maintained, modified, tested, or inspected.

Therefore, it is concluded that this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

Criterion 2: Does the proposedamendment create the possibility of a new or different kind of accident from any accidentpreviously evaluated?

Response: No.

This proposed revision to the CSP Implementation Schedule continues to provide assurance that safety-related SSCs are protected from cyber attacks. Implementation of 10 CFR 73.54 with a revision to the CSP Implementation Schedule does not result in the need for any new or different UFSAR design basis accident analysis. It does not introduce new equipment that could create a new or different kind of accident, and no I

new equipment failure modes are created. As a result, no new accident scenarios, failure mechanisms, or limiting single failures are introduced as a result of this proposed amendment.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

Criterion3: Does the proposedamendment involve a significant reduction in a margin of safety?

Response: No.

The proposed revision to the CSP Implementation Schedule is administrative in nature and would not alter the way any safety-related SSC functions and would not alter the way the plant is operated. The proposed change provides an acceptable, interim level of "high assurance of adequate protection against cyber attacks." The proposed revision would not introduce any new uncertainties or change any existing uncertainties associated with any safety limit.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, APS concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

2