NRC 2011-0068, Response to Request for Additional Information Regarding License Amendment 263, Request for Approval of Revised Cyber Security Plan

Response to Request for Additional Information Regarding License Amendment 263, Request for Approval of Revised Cyber Security Plan

ML111810098
Person / Time
Site:	Point Beach
Issue date:	06/29/2011
From:	Meyer L Point Beach
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
NRC 2011-0068, TAC ME4248, TAC ME4249
Download: ML111810098 (3)

Text

/

BEACH June 29,201 1 NRC 2011-0068 10 CFR 50.90 10 CFR 50.4 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001 Point Beach Nuclear Plant, Units Iand 2 Dockets 50-266 and 50-301 Renewed License Nos. DPR-24 and DPR-27 Res~onseto Request for Additional lnformation Regarding License Amendment 263, Request for Awwroval of the Point Beach Nuclear Plant Revised Cyber Security Plan

References:

(1) NextEra Energy Point Beach, LLC, letter to NRC, dated July 8, 2010, License Amendment Request 263A, Request for Approval of the Point Beach Nuclear Plant Revised Cyber Security Plan (MLI 01900312)

(2) NextEra Energy Point Beach, LLC, letter to NRC, dated September 28, 2010, Notification Letter Designating Point Beach Nuclear Plant Balance of Plant Systems Within the Cyber Security Rule Scope (MLI 02720248)

(3) NextEra Energy Point Beach, LLC, letter to NRC, dated November 12,2010, Supplement to License Amendment Request 263, Request for Approval of the Point Beach Nuclear Plant Revised Cyber Security Plan (MLI 03200081)

(4) NextEra Energy Point Beach, LLC, letter to NRC, dated November 23, 2010, Supplement to License Amendment Request 263, Request for Approval of the Point Beach Nuclear Plant Revised Cyber Security Plan (ML093310298)

(5) NextEra Energy Point Beach, LLC, letter to NRC, dated March 31, 2011, Supplement to License Amendment Request 263, Response to Request for Additional lnformation (MLI 10950164)

(6) NRC letter to NextEra Energy Point Beach, LLC, dated June 8, 2011, Request for Additional lnformation Regarding License Amendment Request for Approval of Cyber Security Plan (TAC Nos. ME4248 and ME4249) (MLI 147A117)

Via Reference ( I ) and as supplemented by References (2), (3), (4), and (5), NextEra Energy Point Beach, LLC, (NextEra) submitted a license amendment request for the Point Beach Nuclear Plant, Units 1 and 2. The proposed amendment requested approval of the Point Beach Cyber Security Plan.

Via Reference (6), the NRC staff determined that additional information is required to complete its review of the submittal. The enclosure to this letter provides the NextEra response to the request for additional information.

NextEra Energy Point Beach, LLC, 6610 Nuclear Road, Two Rivers, WI 54241

Document Control Desk Page 2 The information contained in this letter does not alter the no significant hazards consideration contained in References (I), (3), and (5) and continues to satisfy the criteria of 10 CFR 51.22 for categorical exclusion from the requirements for an environmental assessment.

This letter contains no new Regulatory Commitments and no revisions to existing Regulatory Commitments.

In accordance with 10 CFR 50.91, a copy of this letter is being provided to the designated Wisconsin Official.

If you have any questions or require additional information, please contact Jim Costedio, Licensing Manager, at (920) 755-7427.

I declare under penalty of perjury that the foregoing is true and correct.

Executed on June 29,201 1.

Very truly yours, NextEra Energy Point Beach, LLC Larry Meyer Site Vice President Enclosure cc: Administrator, Region Ill, USNRC Project Manager, Point Beach Nuclear Plant, USNRC Resident Inspector, Point Beach Nuclear Plant, USNRC PSCW

ENCLOSURE NEXTERA ENERGY POINT BEACH, LLC POINT BEACH NUCLEAR PLANT, UNITS I AND 2 CYBER SECURITY PLAN RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION Via letter dated June 8, 201 1 , the NRC staff determined that additional information was required to complete their review of License Amendment Request (LAR)263, Cyber Security Plan (CSP). The following is the NextEra Energy Point Beach, LLC (NextEra) response to the request.

NRC Request for Additional Information The requirements of 10 CFR 73.54(a) are that each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in Section 73.I. Furthermore, 10 CFR 73.54(a)(I) states that the licensee shall protect digital computer and communication systems and networks associated with:

(i) safety-related and important-to-safety functions; (ii) security functions; (iii) emergency preparedness functions, including offsite communications; and (iv) support systems and equipment that, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Section 3.0 of Enclosure I to the cyber security plan, Evaluation of Proposed Change, includes clarifications to the Nuclear Energy Institute 08-09 Cyber Security Plan template with regard to Emergency Preparedness and states, "Therefore, the systems and portions of systems to be protected from cyber attack in accordance with 10 CFR 73.54(a)(l)(iii), must: ( I ) Perform a RSPS [Risk Significant Planning Standards]-related EP [emergency preparedness] function, and (2) Be within the licensee's complete custody and control."

The rule clearly states that digital computer and communication systems and networks associated with emergency preparedness functions, including offsite communications, shall be adequately protected against cyber attacks. For systems and networks that are not within the licensee's complete custody and control, the licensee is still required to ensure protection against cyber attacks.

Explain NextEra Energy Point Beach's deviation from the 10 CFR 73.54(a)(I),

NextEra Response NextEra Energy Point Beach, LLC, (NextEra) withdraws the clarification regarding Emergency Preparedness.

Prior to a conference call with the NRC staff on May 24, 201 I , NextEra did not consider the clarification regarding Emergency Preparedness to be a deviation from the requirements of 10 CFR 73.54(a)(l). However, NextEra now understands how the clarification could result in a deviation from the requirements of 10 CFR 73.54(a)(I). Therefore, NextEra withdraws the clarification regarding Emergency Preparedness included in Section 3.0, Technical Evaluation, of References ( I ) ,(3),and (5).

Page I of 1