RA-11-016, Response to Request for Additional Information Regarding Exelon Cyber Security Plan; Braidwood, Byron, Clinton, Dresden, LaSalle, Limerick, Oyster Creek, Peach Bottom, Quad Cities and Three Mile Island

Response to Request for Additional Information Regarding Exelon Cyber Security Plan; Braidwood, Byron, Clinton, Dresden, LaSalle, Limerick, Oyster Creek, Peach Bottom, Quad Cities and Three Mile Island

ML110940225
Person / Time
Site:	Dresden, Peach Bottom, Oyster Creek, Byron, Three Mile Island, Braidwood, Limerick, Clinton, Quad Cities, LaSalle
Issue date:	03/31/2011
From:	Benyak D Exelon Nuclear, Exelon Nuclear Generation Corp
To:	Document Control Desk, Office of Nuclear Reactor Regulation, Office of Nuclear Security and Incident Response
Shared Package
ML110940223	List: RA-11-016, Response to Request for Additional Information Regarding Exelon Cyber Security Plan; Braidwood, Byron, Clinton, Dresden, LaSalle, Limerick, Oyster Creek, Peach Bottom, Quad Cities and Three Mile Island
References
RA-11-016, RS-11-034, TMI-11-029
Download: ML110940225 (3)

Text

n Nuclear SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 10 CFR 50.90 TMI-11-029 RA-11-016 RS-11-034 March 31, 2011 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555-0001 Braidwood Station, Units 1 and 2 Facility Operating License Nos. NPF-72 and NPF-77 NRC Docket Nos. STN 50-456 and STN 50-457 Byron Station, Units 1 and 2 Facility Operating License Nos. NPF-37 and NPF-66 NRC Docket Nos. STN 50-454 and STN 50-455 Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 NRC Docket No. 50-461 Dresden Nuclear Power Station, Units 2 and 3 Renewed Facility Operating License Nos. DPR-19 and DPR-25 NRC Docket Nos. 50-237 and 50-249 LaSalle County Station, Units 1 and 2 Facility Operating License Nos. NPF-11 and NPF-18 NRC Docket Nos. 50-373 and 50-374 Limerick Generating Station, Units 1 and 2 Facility Operating License Nos. NPF-39 and NPF-85 NRC Docket Nos. 50-352 and 50-353 Oyster Creek Nuclear Generating Station Renewed Facility Operating License No. DPR-16 NRC Docket No. 50-219 Peach Bottom Atomic Power Station, Units 2 and 3 Renewed Facility Operating License Nos. DPR-44 and DPR-56 NRC Docket Nos. 50-277 and 50-278 Enclosures 1, 2 and 3 transmitted herewith contain Security-Related Information.

When separated from Enclosures, this document is decontrolled.

u.s. Nuclear Regulatory Commission March 31,2011 Page 2 Quad Cities Nuclear Power Station, Units 1 and 2 Renewed Facility Operating License Nos. DPR-29 and DPR-30 NRC Docket Nos. 50-254 and 50-265 Three Mile Island Nuclear Station, Unit 1 Renewed Facility Operating License No. DPR-50 NRC Docket No. 50-289

Subject:

Response to Request for Additional Information regarding Exelon Cyber Security Plan

Reference:

(1) Letter from Pamela B. Cowan to the USNRC Document Control Desk, "Request for Approval of the Exelon Cyber Security Plan," dated November 23, 2009 (2) Letter from Pamela B. Cowan to the USNRC Document Control Desk, "Re-submittal of the Exelon Cyber Security Plan," dated July 23, 2010 (3) Letter from Eva A. Brown, (U.S. Nuclear Regulatory Commission) to Mr.

Michael J. Pacilio (Exelon Nuclear), "Request For Additional Information Regarding Approval of Cyber Security Plan," dated March 4, 2011 (4) Letter from Richard P. Correia, (U.S. Nuclear Regulatory Commission) to Mr. Chris Earls, Nuclear Energy Institute, dated January 5, 2011 (5) Letter from Richard P. Correia, (U.S. Nuclear Regulatory Commission) to Mr. Christopher E. Earls, Nuclear Energy Institute, "Cyber Security Plan Generic Request for Additional Information on Records Retention," dated March 1, 2011 (6) Letter from Richard P. Correia, (U.S. Nuclear Regulatory Commission) to Mr. Christopher E. Earls, Nuclear Energy Institute, Template for the Cyber Security Plan Implementation Schedule," dated March 1, 2011 On November 23, 2009, in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Exelon Generation Company, LLC (Exelon) submitted a request for an amendment to the Facility Operating Licenses (FOL) for the above listed facilities. This proposed amendment requested U.S. Nuclear Regulatory Commission (NRC) approval of the Exelon Cyber Security Plan, provided an Implementation Schedule for the Exelon Cyber Security Program, and added to the existing FOL Physical Protection license condition to require Exelon to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan. By letter dated July 23, 2010 (Reference 2), Exelon supplemented the Cyber Security Plan License Amendment Request with a revised Cyber Security Plan based on the template contained in NEI 08-09, Revision 6.

By letter to Exelon dated March 4, 2011 (Reference 3), the NRC issued a Request for Additional Information (RAI) regarding the submitted Exelon Cyber Security Plan. The RAI questions dealt with three generic industry issues. These issues were identified during the course of the NRC's

U.S. Nuclear Regulatory Commission March 31,2011 Page 3 review of industry-submitted cyber security plans and proposed implementation schedules. The generic issues involve a clarification on the scope of 10 CFR 73.54 with respect to Balance of Plant (BOP) systems, cyber security records retention, and the Exelon Cyber Security Plan Implementation Schedule. The Nuclear Energy Institute (NEI) has worked to develop resolutions to these generic issues which have been accepted by the NRC staff (References 4, 5 and 6).

Exelon's responses to the RAls are consistent with the industry guidance and are provided in . Changes to the Exelon Cyber Security Plan are being made in accordance with the RAI response and the revised plan is provided in Enclosure 2. Note that the deviations submitted as part of the July 23, 2010, supplement (Reference 2) remain applicable to the Exelon Cyber Security Plan. Enclosure 3 contains an updated Exelon Implementation Schedule which has been revised as a response to the RAI. Exelon requests that Enclosures 1,2 and 3, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.

There is no adverse impact to the previously submitted No Significant Hazards Consideration Determination. As stated in Reference 3, it is the NRC's intention to develop license conditions based on this RAI response. As a result, the previously submitted Regulatory Commitments regarding the Exelon Cyber Security Plan Implementation Schedule are superseded by the Regulatory Commitments contained in Enclosure 3, Revised Implementation Schedule. There are no additional Regulatory Commitments contained within this letter.

In accordance with 10 CFR 50.91, a copy of this letter is being provided to the designated State Officials. If you have any questions or require additional information, please contact Mr. Doug Walker at (610) 765-5952.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 31 sl day of March 2011.

Respectfully,

~Yu Darin M. Benyak Director - Licensing and Regulatory Affairs Exelon Generation Company, LLC - Exelon Response to the Cyber Security Plan Request for Additional Information - Cyber Security Plan For Exelon Nuclear - Exelon Cyber Security Plan Revised Implementation Schedule cc: USNRC Region I, Regional Administrator USNRC Region III, Regional Administrator NRC Project Manager, NRR - Braidwood Station NRC Project Manager, NRR - Byron Station NRC Project Manager, NRR - Clinton Power Station NRC Project Manager, NRR - Dresden Nuclear Power Station