ML13024A105

Redacted Letter, Regulatory Audit Report for 11/13-16/12 Audit (Cyber Security) at Invensys Operations Management in Lake Forest, CA, to Support Digital Replacement of Process Protection System License Amendment Request

ML13024A105
Person / Time
Site:	Diablo Canyon
Issue date:	02/12/2013
From:	Joseph Sebrosky Plant Licensing Branch IV
To:	Halpin E Pacific Gas & Electric Co
Sebrosky J
References
TAC ME7522, TAC ME7523
Download: ML13024A105 (3)

Text

OFFICIAL USE ONtI.. SECURITY-RELATED INFORMATION r UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555.0001 February 12, 2013 Mr. Edward D. Halpin Senior Vice President and Chief Nuclear Officer Pacific Gas and Electric Company Diablo Canyon Power Plant P.O. Box 56, Mail Code 104/6 Avila Beach, CA 93424

SUBJECT:

DIABLO CANYON POWER PLANT, UNIT NOS. 1 AND 2 - REGULATORY AUDIT REPORT FOR NOVEMBER 13-16, 2012, CYBER SECURITY AUDIT AT THE INVENSYS OPERATIONS MANAGEMENT FACILITY IN LAKE FOREST, CALIFORNIA, TO SUPPORT REVIEW OF DIGITAL INSTRUMENTATION AND CONTROL LICENSE AMENDMENT REQUEST (TAC NOS. ME7522 AND ME7523)

Dear Mr. Halpin:

By letter dated October 26, 2011, as supplemented by letters dated December 20, 2011, and April 2, April 30, June 6, August 2, September 11, November 27 and December 5, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession Nos.

ML113070457, ML113610541, ML12094A072, ML12131A513, ML12170A837, ML12222A094, ML12256A308, ML13004A468, and ML12342A149, respectively), Pacific Gas and Electric (PG&E, the licensee), requested the U.S. Nuclear Regulatory Commission (NRC) staffs approval of an amendment for the Diablo Canyon Power Plant, Unit Nos. 1 and 2 (DCPP). The proposed license amendment request would provide a digital replacement of the Process Protection System (PPS) portion of the Reactor Trip System and Engineered Safety Features Actuation System at DCPP.

To support the NRC review. staff from the Office of Nuclear Security and Incident Response (NSIR), Cyber Security and Integrated Response Branch, is conducting a pilot study to determine if security measures taken by the licensee and vendor address regulatory requirements for cyber security under Title 10 of the Code of Federal Regulations Section 73.54, "Protection of digital computer and communication systems and networks." As part of this study, the staff visited the Invensys Operations Management facility in Lake Forest, California, on November 13-16, 2012. A regulatory audit report outlining staff observations from this visit is enclosed for your review and consideration. A summary audit report will be developed at a later date that details the results of this audit and follow-on reviews (subsequent audits related to the PPS replacement) conducted by NSIR staff for other design elements associated with the PPS replacement.

The Enclosure to this letter contains Security-related Sensitive Unclassified Non-safeguards Information. Upon separation from the EnClosure, this letter is DECONTROLLED.

OFFICIAL USE ONLY SECURITY-RELATED INFORMATIONr

OFFICIAL USE ONLY - SECURITY RELATED INFORMATION r

-2 The life cycle processes review activities performed in conjunction with this audit are documented in a separate report that is being written by the staff from the NRC's Office of Nuclear Reactor Regulation (NRR) Instrumentation and Controls Branch.

If you have any questions, please contact me at 301-415-1132 or via e-mail at joseph.sebrosky@nrc.gov.

Docket Nos. 50-275 and 50-323

Enclosure:

As stated cc (letter only): Distribution via Ustserv OFFIOIAL USE ONLY SECURITY RELATED INFORMATION r

- 2 The life cycle processes review activities performed in conjunction with this audit are documented in a separate report that is being written by the staff from the NRC's Office of Nuclear Reactor Regulation (NRR) Instrumentation and Controls Branch.

If you have any questions. please contact me at 301-415-1132 or via e-mail at joseph.sebrosky@nrc.gov.

Sincerely, IRAJ Joseph M. Sebrosky, Senior Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-275 and 50-323

Enclosure:

As stated cc (letter only): Distribution via Listserv DISTRIBUTION:

PUBLIC LPL4 RlF RidsAcrsAcnw_MaiICTR Resource RidsNrrDeEicb Resource RidsNrrDorlLpl4 Resource RidsNrrLAJBurkhardt Resource RidsNrrPMDiabloCanyon Resource RidsNsirDsp Resource RidsOgcRp Resource RidsRgn4MailCenter Resource WKemper, NRR/DE/EICB RStattel, NRRlDE/EICB RAlvarado, NRR/DE/EICB SMakor, RIV/DRS/EB2 ELee, NSIR ADAMS Accession Nos.: Non-PubliC LTR ML13024A098 Public LTR ML13024A105 OFFICE NRRlDORULPL4IPM NRRJDORULPL4ILA NSIRIDSP/CSIRBIBC NRRlDORULPL4/BC NRRlDORLlLPL4/PM

• NAME JSebrosky JBut1<hardl CErlange (THarris for) MMarkley JSebrosky DATE 214/13 211/13 216/13 217113 2/12113 OFFICIAL RECORD COpy OFFICIAL Y6E ONLY6ECIJRITY RELATED INFORM/liFION r