NLS2009084, License Amendment Request for Approval of the Cyber Security Plan

License Amendment Request for Approval of the Cyber Security Plan

ML093270076
Person / Time
Site:	Cooper
Issue date:	11/19/2009
From:	Minahan S Nebraska Public Power District (NPPD)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NLS2009084
Download: ML093270076 (16)

Text

N SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Nebraska Public Power District "Always there when you need us" NLS2009084 50.90 November 19, 2009 U.S. Nuclear Regulatory Commission Document Control Desk Washington, D.C. 20555-0001

Subject:

License Amendment Request for Approval of the Cyber Security Plan Cooper Nuclear Station, Docket No. 50-298, License No. DPR-46

Dear Sir or Madam:

The purpose of this letter is for the Nebraska Public Power District (NPPD) to request an amendment to the Facility Operating License (FOL) for Cooper Nuclear Station (CNS) in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90. This proposed amendment requests Nuclear Regulatory Commission (NRC) approval of the CNS Cyber Security Plan, provides an implementation schedule, and revises the existing FOL Physical Protection license condition to require NPPD to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan..

The proposed Cyber Security Plan is based on Nuclear Energy Institute (NEI) 08-09, Revision 3, Cyber Security Plan for Nuclear Power Reactors.

Attachment 1 provides NPPD's evaluation of the proposed change, including the no significant hazards consideration and environmental consideration. Attachment 2 provides the existing FOL pages marked up to show the proposed change. Attachment 3 provides the FOL changes in final typed format. Attachment 4 provides a copy of the CNS Cyber Security Plan which is a stand-alone document that will be incorporated by reference into the CNS Physical Security Plan upon approval. Attachment 5 provides a listing of the CNS deviations from NEI 08-09, Revision 3, Appendix A. Attachment 6 provides the CNS Cyber Security Plan implementation schedule.

NPPD requests that Attachments 4 and 5, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

In accordance with 10 CFR 50.91 (b)(1), a copy of this application, with attachments, is being provided to the designated State of Nebraska Official. Copies are also being provided to the NRC Region IV Office and the CNS Resident Inspector in accordance with 1.0 CFR 50.4(b)(2).

NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 CO OPER NUCLEAR STATION P.O. Box 98 / Brownville, NE 68321-0098 Telephone: (402) 825-3811 / Fax: (402) 825-5211 www.nppd.com

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Page 2 of 2 The proposed license amendment has been reviewed by the necessary Safety Review Committees (Station Operations Review Committee and Safety Review and Audit Board).

Should you have any questions regarding this submittal, please contact David Van Der Kamp, Licensing Manager, at (402) 825-2904.

I declare under penalty of perjury that the foregoing is true and correct.

Executed On: 1111q k)0 (Date)

Sincerely, Stewart B. Minahan Vice President - Nuclear and Chief Nuclear Officer

/lb Attachments cc: Regional Administrator w/attachments USNRC - Region IV Cooper Project Manager w/attachments USNRC - NRR Project Directorate IV- 1 Senior Resident Inspector w/attachments USNRC - CNS Nebraska Health and Human Services w/attachments Department of Regulation and Licensure NPG Distribution w/attachments 1, 2, 3, 6 CNS Records w/attachments NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 1 of 7 Evaluation of Proposed Change License Amendment Request for Approval of the Cyber Security Plan Cooper Nuclear Station, Docket No. 50-298, DPR-46 1.0 Summary Description 2.0 Detailed Description 3.0 Technical Evaluation 4.0 Regulatory Evaluation 4.1 Applicable Regulatory Requirements/Criteria 4.2 No Significant Hazards Consideration 4.3 Conclusions 5.0 Environmental Consideration 6.0 References NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 2 of 7 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed Cooper Nuclear Station (CNS) Cyber Security Plan (Plan), an implementation schedule, and a proposed sentence to be added to the existing Facility Operating License (FOL) Physical Protection license condition.

2.0 DETAILED DESCRIPTION The proposed LAR includes three parts: the proposed CNS Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing FOL Physical Protection license condition to require Nebraska Public Power District (NPPD) to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan as required by 10 CFR 73.54 (Rule). Federal Register notice dated March 27, 2009, issued the final rule that amended 10 CFR Part 73. The regulations in 10 CFR 73.54, "Protection of digital computer and communication systems and networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the Nuclear Regulatory Commission (NRC) Notice of Availability published on March 27, 2009, 74 FR 13926 (Reference 1).

3.0 TECHNICAL EVALUATION

Federal Register notice 74 FR 13926 issued the final rule that amended 10 CFR Part 73.

Cyber security requirements are codified as new §73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1 (a)(1)(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of Nuclear Energy Institute (NEI) 08-09, Revision 3, "Cyber Security Plan for Nuclear Power Reactors" (Reference 3), with deviations as identified and justified in Attachment 5 to this LAR. Deviations to Appendices D and E of NEI 08-09, Revision 3 are detailed in Attachment 1 of the CNS Cyber Security Plan.

NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 3 of 7 This LAR includes the proposed Plan (Attachment 4) that conforms to the template provided in NEI 08-09, Revision 3, with the exception of the items listed on the deviation table in Attachment 5. In addition, the LAR includes the proposed change to the existing FOL license condition for "Physical Protection" (Attachments 2 and 3). Finally, the LAR contains the proposed implementation schedule (Attachment 6) as required by 10 CFR 73.54.

4.0 REGULATORY EVALUATION

4.1 APPLICABLE REGULATORY REQUIREMENTS/CRITERIA This LAR is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10 CFR Part 50 to submit a Cyber Security Plan as specified in 10 CFR 50.4 and 10 CFR 50.90.

4.2 NO SIGNIFICANT HAZARDS CONSIDERATION Nebraska Public Power District (NPPD) has evaluated the proposed changes using the criteria in 10 CFR 50.92 and has determined that the proposed changes do not involve a significant hazards consideration. An analysis of the issue of no significant hazards consideration is presented below:

1. Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The proposed change is required by 10 CFR 73.54 (Rule) and includes three parts. The first part is the submittal of the Cyber Security Plan (Plan) for Nuclear Regulatory Commission (NRC) review and approval.

The Plan conforms to the template provided in Nuclear Energy Institute (NEI) 08-09 and provides a description of how the requirements of the Rule will be implemented at Cooper Nuclear Station (CNS). The Plan establishes the licensing basis for the CNS Cyber Security Program. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions;

2. Security functions; NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 4 of 7

3. Emergency preparedness functions, including offsite communications; and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Plan itself does not require any plant modifications.

However, the Plan does describe how plant modifications which involve digital computer systems will be reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule. The Plan does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or affect the capability of structures, systems, or components to perform their design function. The Plan is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation schedule.

The third part adds a sentence to the existing Facility Operating License (FOL) license condition for Physical Protection. Both of these changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, it is concluded that this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The proposed change is required by 10 CFR 73.54 and includes three parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided by NEI 08-09 and provides a description of how the requirements of the Rule will be implemented at CNS. The Plan establishes the licensing basis for the CNS Cyber Security Program. The Plan establishes how to achieve high NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 5 of 7 assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions;

2. Security functions;

3. Emergency preparedness functions, including offsite communications; and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Plan itself does not require any plant modifications.

However, the Plan does describe how plant modifications which involve digital computer systems will be reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The Plan does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or affect the capability of structures, systems, or components to perform their design function. The Plan is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated.

The second part of the proposed change is an implementation schedule.

The third part adds a sentence to the existing FOL license condition for Physical Protection. Both of these changes are administrative and do not create the possibility of a new or different kind of accident from any previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 6 of 7 The proposed change is required by 10 CFR 73.54 and includes three parts. The first part is the submittal of the Plan for NRC review and approval. The Plan conforms to the template provided by NEI 08-09 and provides a description of how the requirements of the Rule will be implemented at CNS. The Plan establishes the licensing basis for the CNS Cyber Security Program. The Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions;

2. Security functions;

3. Emergency preparedness functions, including offsite communications; and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through limiting conditions for operation, limiting safety system settings and safety limits specified in the Technical Specifications. Because there is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an implementation schedule.

The third part adds a sentence to the existing FOL license condition for Physical Protection. Both of these changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, NPPD concludes that the proposed amendment presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of no significant hazards consideration is justified.

NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 1 Page 7 of 7

4.3 CONCLUSION

S In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Cyber Security program for CNS and will be a part of the Physical Security Plan. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926.

2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002.

3. NEI 08-09, Revision 3, Cyber Security Plan for Nuclear Power Reactors.

NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled. I SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 2 Page 1 of 2 Attachment 2 Proposed Facility Operating License Change (Mark-Up)

Cooper Nuclear Station, Docket No. 50-298, DPR-46 Revised Facility Operating License Page Page 3 of 5 NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

(5) Pursuant to the Act and 10 CFR Parts 30, 40, and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by operation of the facility.

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations In 10 CFR Chapter 1:Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; issubject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level The licensee isauthorized to operate the facility at steady state reactor core power levels not inexcess of 2419 megawatts (thermal).

(2) TechicalSpecifications The Technical Specifications contained inAppendix A as revised through Amendment No. 235, are hereby incorporated Inthe license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Physical Protection The licensee shall fully implement and maintain ineffect all provisions of the Commission-approved physical security, training and qualification and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, are entitled: "Cooper Nuclear Station Safeguards Plan," submitted by letter The licensee shall dated May 17, 2006.

fully implement and maintain in effect (4) Fire Protection all provisions of The licensee shall implement and maintain in effect all provisions of the the Commission- approved fire protection program as described in the Cooper Nuclear approved Cooper Station (CNS) Updated Safety Analysis Report and as approved in the Nuclear Station Safety Evaluations dated November 29, 1977; May 23, 1979; cyber security November 21, 1980; April 29, 1983; April 16, 1984; June 1,1984; January 3, 1985; August 21, 1985; April 10, 1986; September 9, 1986; plan submitted by November 7, 1988; February 3,1989; August 15, 1995; and July 31, letter dated 1998, subject to the following provision:

November 19, 2009, and withheld from The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those 'Changeswould not public disclosure in adversely affect the ability to achieve and maintain safe shutdown in the accordance with event of a fire.

10 CFR 2.3 90.

Amendment No. 235 Revised by letter dated March 5,2007 3 of 5

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 3 Page 1 of 3 Attachment 3 Proposed Facility Operating License Change (Re-typed)

Cooper Nuclear Station, Docket No. 50-298, DPR-46 Revised Facility Operating License Pages Page 3 of 5 Page 4 of 5 NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

(5) Pursuant to the Act and 10, CFR Parts 30, 40, and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by operation of the facility.

C. This license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter I: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level The licensee is authorized to operate the facility at steady state reactor core power levels not in excess of 2419 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A as revised through Amendment No. 235, are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, are entitled: "Cooper Nuclear Station Safeguards Plan," submitted by letter dated May 17, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Cooper Nuclear Station cyber security plan submitted by letter dated November 19, 2009, and withheld from public disclosure in accordance with 10 CFR 2.390.

(4) Fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Cooper Nuclear Station (CNS) Updated Safety Analysis Report and as approved in the Safety Evaluations dated November 29, 1977; May 23, 1979; November 21, 1980; April 29, 1983; April 16, 1984; June 1, 1984; January 3, 1985; August 21, 1985; April 10, 1986; September 9, 1986; November 7, 1988; February 3, 1989; August 15, 1995; and July 31, 1998, subject to the following provision:

3 of 5 Amendment No. 235 Revised by letter dated March 5, 2007

The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(5) Additional Conditions The Additional Conditions contained in Appendix C, as revised through Amendment No. 178, are hereby incorporated into this license. Nebraska Public Power District shall operate the facility in accordance with the Additional Conditions.

(6) Deleted (7) Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance

2. Assessment of mutual aid fire fighting assets

3. Designated staging areas for equipment and materials

4. Command and control

5. Training of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets

2. Communications

3. Minimizing fire spread

4. Procedures for implementing integrated fire response strategy

5. Identification of readily-available pre-staged equipment

6. Training on integrated fire response strategy

7. Spent fuel pool mitigation measures (c) Actions to minimize release to include consideration of:

1. Water spray scrubbing

2. Dose to onsite responders (8) The licensee shall implement and maintain all Actions required by Attachment 2 to NRC Order EA-06-137, issued June 20, 2006, except the last action that requires incorporation of the strategies into the site security plan, contingency plan, emergency plan and/or guard training and qualification plan, as appropriate.

4 of 5 Rlevised by letter dated Au.gu.st 9, 2007 Amendment No.-23-E

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 6 Page 1 of 2 Attachment 6 Cooper Nuclear Station Cyber Security Plan Implementation Schedule Cooper Nuclear Station, Docket No. 50-298, DPR-46 NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 NLS2009084 Attachment 6 Page 2 of 2 LIST OF REGULATORY COMMITMENTS Correspondence Number: NLS2009084 The following table identifies those actions committed to by Nebraska Public Power District (NPPD) in this document. Any other actions discussed in the, submittal represent intended or planned actions by NPPD. They are described for information only and are not regulatory commitments. Please notify the Licensing Manager at Cooper Nuclear Station of any questions regarding this document or any associated regulatory commitments.

COMMITMENT COMMITTED DATE COMMITMENT NUMBER OR OUTAGE The analysis of digital computer systems and 36 months after NRC networks in accordance with Section 3 of the NLS2009084-01 approval of Cyber Cooper Nuclear Station Cyber Security Plan will Security Plan be performed and results documented as required.

For cyber security controls that have been identified for implementation by the process 48 months after NRC described in Section 3, an implementation plan NLS2009084-02 approval of Cyber will be prepared and available for NRC Security Plan inspection.

The elements to establish, implement, and 60 months after NRC maintain the Cyber Security Program as NLS2009084-03 approval of Cyber described in Chapter 4 of the Cooper Nuclear NLcurity Pral Station Cyber Security Plan will be implemented. Security Plan NOTE: Attachments 4 and 5 to this letter contain Security-Related Information. Upon separation from Attachments 4 and 5, the cover letter and Attachments 1, 2, 3, and 6 are decontrolled.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390