ULNRC-05711, Request for Approval of the Callaway Plant Cyber Security Plan
| ML101610642 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 06/09/2010 |
| From: | Maglio S AmerenUE, Union Electric Co |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LDCN 09-0041, TAC ME2663, ULNRC-05711 | |
| Download: ML101610642 (18) | |
Text
AmerenUf PO Box 620 Callaway Plant Fulton, MO 65251 June 9, 2010 ULNRC-05711 u.s. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001
~~ 10 CFR 50.90 wAmeren UE Ladies and Gentlemen:
DOCKET NUMBER 50-483 CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.
FACILITY OPERATING LICENSE NPF-30 REQUEST FOR APPROVAL OF THE CALLAWAY PLANT CYBER SECURITY PLAN (TAC NO. ME2663)
(LICENSE AMENDMENT REQUEST LDCN 09-0041)
References:
- 1. AmerenUE Letter ULNRC-05663, "Request for Approval of the Callaway Plant Cyber Security Plan (License Amendment Request LDCN 09-0041)," dated November 19,2009
- 2. AmerenUE Letter ULNRC-05674, "Supplement to License Amendment Request LDCN 09-0041 for Approval of the Cyber Security Plan (TAC No. ME2663)," dated January 21,2010 By letter dated November 19,2009 (Reference 1) Union Electric Company (dba AmerenUE) submitted a request for amendment of the facility Operating License for Callaway, including a request for approval of the Callaway Cyber Security Plan. The license amendment request was derived from the model application provided in NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 3, dated September 2009.
Included with the Reference 1 letter were three enclosures. Enclosure 1 provided a description and an evaluation of the proposed license amendment. It included its own attachments wherein Attachment 1 provided a marked-up page from the Callaway Operating License containing the License Condition that would be modified by the amendment, and Attachment 2 provided re-typed pages to reflect that modification.
a subsidiary of Ameren Corporation
ULNRC-05711 June 9, 2010 Page 2 Enclosure 2 provided the Callaway Cyber Security Plan Implementation Schedule.
Enclosure 3 provided the proposed Callaway Cyber Security Plan itself.
The November 19,2009 application was supplemented by a follow-up letter dated January 21,2010 (Reference 2) in which Enclosure 1 ofthe November 19,2009 application was partially replaced (superseded) due to the revision of text within the No Significant Hazards Consideration evaluation. The attachments contained within the original Enclosure 1 were unchanged and thus were not provided with the Reference 2 letter.
In the Reference 1 letter for the application, it was noted that Enclosure 3 (the Cyber Security Plan) contained sensitive information. As such, it was noted that Enclosure 3 should be withheld from public disclosure in accordance with 10 CFR 2.390.
Although it was pointed out that Enclosure 3 was the document containing sensitive information, every page in the Reference 1 cover letter, as well as in all three enclosures, contained a footer and header consisting ofthe words, "Security-Related Information - Withhold Under 10 CFR 2.390." Thus, the entire submittal was required to be withheld from public disclosure.
As the NRC staff is currently reviewing the amendment application, AmerenUE has been asked to submit a version ofthe November 19, 2009 application that is not required to be withheld from public disclosure (except for Enclosure 3). This is consistent with what was intended since only Enclosure 3 contained security-related/sensitive information.
In response to that request, the November 19,2009 application is hereby being supplemented by resubmitting a copy of several portions of the application as attachments to this letter. In particular, exact copies of the cover letter, the attachments provided with Enclosure 1, and all of Enclosure 2 are provided, except that the noted headers and footers have been removed. The documents are thus not identified as being required to be withheld from public disclosure. Enclosure 3 is not included since it has already been provided and is still intended to be withheld from public disclosure. The portion of Enclosure 1 exclusive of its attachments is also not provided since that portion was provided in the Reference 2 letter and was not requested to be withheld from public disclosure.
This supplement provides no new or additional information, does not change any of the evaluations contained in the November 19,2009 application (or in the Reference 2 letter), and contains no new or additional commitments.
ULNRC-05711 June 9, 2010 Page 3 If there are any questions regarding this letter or the attached, please contact Scott Maglio at 573-676-8719 or Tom Elwood at 314-225-1905.
Sincerely, Scott A. Maglio Regulatory Affairs Manager TBE/sik Attachments
ULNRC-05711 June 9, 2010 Page 4 cc: U.S. Nuclear Regulatory Commission (Original and 1 copy)
Attn: Document Control Desk Washington, DC 20555-0001 Mr. Elmo E. Collins, Jr.
Regional Administrator U.S. Nuclear Regulatory Commission Region IV 612 E . Lamar Blvd., Suite 400 Arlington, TX 76011-4125 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Mohan C. Thadani (2 copies)
Senior Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-8G 14 Washington, DC 20555-2738
AmorenUE PO Box 620 Callaway Plant Fulton, MO 66251 November 19, 2009 ULNRC-05663 u.s. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555-0001
~,~ 10CFR 50.90 vAmeren Ladies and Gentlemen:
UE DOCKETNUMBERS~~
CALLAWAY PLANT UNIT 1 UNION ELECTRIC CO.
FACILITY OPERATING UCENSE NPF-30 REQUEST FOR APPROVAL OF THE CALLAWAY PLANT CYBERSECURrIYPLAN (LICENSE AMENDMENT REOUEST LDCN 09-0041)
In accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Union Electric (UE) dba AmerenUE is submitting a request for an amendment to the Facility Operating License (OL) for Callaway Plant Unit 1. Per this amendment request, AmerenUE requests NRC approval of the Callaway Plant Unit I Cyber Security Plan, provides an Implementation Schedule, and adds a sentence to the existing OL Physical Protection license condition to require UE to fully implement and maintain in effect all provisions of the Commission-approved Cyber Security Plan.
This proposed amendment is derived from the model application provided in NEI08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 3, dated September 2009. Essential information is provided in the enclosures to this letter:
- Enclosure I provides an evaluation of the proposed change. Enclosure 1 also contains an attachment that provides the existing OL page marked up and the retyped OL page to show the proposed change.
- Enclosure 2 provides a copy of the Callaway Plant Unit I Cyber Security Plan Implementation Schedule. The implementation milestones listed in Enclosure 2 Enclosure 3 to this letter contains sensitive information.
Withhold from public disclosure under 10 CFR 2.390.
Upon removal of Enclosure 3, this letter is uncontrolled.
a subsidiary 01 Ameren Corporalion
VLNRC-05663 November 19, 2009 Page 2 are considered to be regulatory commitments, and are identified as such in the enclosure. Commitment changes will be managed in accordance with NEI 99-04, "Guidelines for Managing NRC Commitment changes."
- EnclosUre 3 provides a copy of the Callaway Plant Unit 1 Cyber Security Plan which*is a stand-alone document that will be incorporated by reference into the Callaway Plant Physical Security Plan upon approval. UE requests that Enclosure 3, which contains sensitive infonnation, be withheld from public disclosure in accordance with 10 CFR 2.390.
It has been detennined that this amendment application does not involve a significant hazard consideration as detennined per 10 CFR 50.92. Pursuant to 10 CFR. 51.22(b),
no environmental impact statement or environmental assessment need be prepared in connection with the issuance of this amendment.
The Callaway Plant Onsite Review Committee and a subcommittee of the Nuclear Safety Review Board have reviewed and approved the attached licensing evaluation and have approved the submittal of this amendment application.
In accordance with 10 CFR 50.91, a copy of this application, with attachments, is being provided to the designated Missouri State Official.
UE requests an implementation period of90 days following NRC approval of the license amendment.
If there are any questions regarding this matter, please contact Scott Maglio at 573-676-8719.
I declare under penalty of perjury that the foregoing is true and correct.
Sincerely,
~b~
Scott Sandbothe Manager, Plant Support Executed on: --.L-'H<-ill---'-\--'.l1-1J_o_~-,--
ULNRC-05663 November 19,2009 Page 3 DERlEMF/nls
Enclosures:
- Evaluation of Proposed Changes - Callaway Plant Unit 1 Cyber Security Plan Implementation Schedule I Identification of Commitments - Callaway Plant Unit 1 Cyber Security Plan
ULNRC-05663 November 19, 2009 Page 4 cc:
(copy w/out Enclosure 3 except as noted with asterisk*)
Mr. Elmo E. Collins, Jr.
- Regional Administrator U.S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 Senior Resident Inspector Callaway Resident Office U.S. Nuclear Regulatory Commission 8201 NRC Road Steedman, MO 65077 Mr. Mohan C. Thadani (2 copies)*
Senior Project Manager, Callaway Plant Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission Mail Stop 0-8G14 Washington, DC 20555-2738
ULNRC-05663 November 19, 2009 Page 5 Index and send hardcopy to QA File A160.0761 Hardcopy:
Certrec Corporation 4200 South Hulen, Suite 422 Fort Worth, TX 76109 (Certrec receives ALL attachments as long as they are non-safeguards and may be publicly disclosed.)
Electronic distribution for the following can be made via Tech Spec ULNRC Distribution:
(electronic copy w/out Enclosure 3)
A. C. Heflin F. M. Diya L. S. Sandbothe S. A. Maglio E. H. Bradley S. L. Gallagher T. L. Woodward (NSRB)
T. B. Elwood D. E. Rickard E. M. Fast A.M. Lowry Ms. Diane M. Hooper (WCNOC)
Mr. Dennis Buschbaum (Luminant Power)
Mr. Ron Barnes (APS)
Mr. Tom Baldwin (PG&E)
Mr. Wayne Harrison (STPNOC)
Ms. Linda Conklin (SCE)
Mr. John O'Neill (Pillsbury Winthrop Shaw Pittman LLP)
Missouri Public Service Commission Mr. Floyd Gilzow (DNR) to ULNRC-05663 Page 9 Attachment 1 Proposed Operating License Change (Marked-up)
The following text is to be inserted at the end of the Callaway Plant Unit 1 OL Condition 2.E. for Physical Protection:
UE shall fully implement and maintain in effect all provisions of the Commission-approved Callaway Plant Unit 1 Cyber Security Plan submitted by letter dated November 19, 2009 and withheld from public disclosure in accordance with 10 CFR 2.390.
This marked-up OL change is provided on the next page.
to ULNRC-05663 Page 10 Operating License Revision 064 license. UE shall operate the facility in accordance with the Additional Conditions.
D. An Exemption from certain requirements of Appendix J to 10 CFR Part 50, are described in the October 9, 1984 staff letter. This exemption is authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. Therefore, this exemption is hereby granted pursuant to 10 CFR 50.12. With the granting of this exemption the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.
E. UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 10 CFR 73.21, are entitled: "Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision 0" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006.
F. Deleted per Amendment No. 169.
G. UE shall have and maintain financial protection of such type and in ch
. * 'rc i i ction 70 bility Insert UE shall fully implement and maintain in effect all provisions of the Commission-approved Callaway Plant Unit 1 Cyber Security Plan submitted by letter dated November 19. 2009 and withheld from public ISSION disclosure in accordance with 10 CFR 2.390.
Office of Nuclear Reactor Regulation Attachments/Appendices:
- 1. Attachment 1 (Deleted per Amendment No. 169)
- 2. Attachment 2 (Deleted per Amendment No. 169)
- 3. Appendix A - Technical Specifications (NUREG-1058, Revision 1)
- 4. Appendix B - Environmental Protection Plan
- 5. Appendix C - Additional Conditions Date of Issuance: October 18, 1984 Revised by letter dated June 26,2007 A140.0001 to ULNRC-05663 Page 11 Attachment 2 Retyped Operating License Change The following text is to be inserted at the end ofthe Callaway Plant Unit 1 OL Condition 2.E. for Physical Protection:
UE shall fully implement and maintain in effect all provisions of the Commission-approved Callaway Plant Unit 1 Cyber Security Plan submitted by letter dated November 19, 2009 and withheld from public disclosure in accordance with 10 CFR 2.390.
This retyped OL change is provided on the next page.
license. UE shall operate the facility in accordance with the Additional Conditions.
D. An Exemption from certain requirements of Appendix J to 10 CFR Part 50, are described in the October 9, 1984 staff letter. This exemption is authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. Therefore, this exemption is hereby granted pursuant to 10 CFR 50.12. With the granting of this exemption the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.
E. UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 10 CFR 73.21, are entitled: "Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision 0" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006. UE shall fully implement and maintain in effect all provisions of the Commission-approved Callaway Plant Unit 1 Cyber Security Plan submitted by letter dated November 19, 2009 and withheld from public disclosure in accordance with 10 CFR 2.390.
F. Deleted per Amendment No. 169.
G. UE shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.
H. This license is effective as of the date of issuance and shall expire at Midnight on October 18, 2024.
FOR THE NUCLEAR REGULATORY COMMISSION ORIGINAL SIGNED BY H. R. DENTON Harold R. Denton, Director Office of Nuclear Reactor Regulation Amendment ###
Attachments/Appendices:
- 1. Attachment 1 (Deleted per Amendment No. 169)
- 2. Attachment 2 (Deleted per Amendment No. 169)
- 3. Appendix A - Technical Specifications (NUREG-1 058, Revision 1)
- 4. Appendix B - Environmental Protection Plan
- 5. Appendix C - Additional Conditions Date of Issuance: October 18, 1984 Amendment ###
ATTACHMENT 1 Deleted per Amendment No. 169.
Amendment 169
ATTACHMENT 2 Deleted per Amendment No. 169.
to ULNRC-05663 Page 2 IMPLEMENTATION SCHEDULE The following table identifies those actions committed to by AmerenUE in this document. Any other statements in this document are provided for information purposes and are not considered commitments. Please direct questions regarding these commitments to Tom Elwood at 314-225-1905:
Commitment Completion Date
- l. The analysis of digital computer systems and networks in accordance 36 months after with Section 3 of the Callaway Plant Unit 1 Cyber Security Plan will NRC approval of be performed and results documented as required. Cyber Security Plan The Completion Date is based on the time necessary to develop and implement the site governing procedures, revise department and program implementing procedures, train on their use, solicit and obtain contracted support, identify critical digital assets, conduct walkdowns with the plant in an acceptable operating mode, and document the results. This duration equates to approximately two operating cycles, depending upon when the NRC approves the Plan.
- 2. For cyber security controls that have been identified for 54 months after implementation by the process described in Section 3, an NRC approval of implementation plan will be prepared and available for NRC Cyber Security Plan inspection.
The Completion Date is based on the time necessary to complete item 1, above, develop and implement additional procedures, processes and controls based on the analysis, train on their use, solicit and obtain contracted support, identify, develop and plan required configuration changes, conduct planning walkdowns with the plant in an acceptable operating mode for the identified changes, and document the controls and needed actions. This duration equates to one additional operating cycle, depending upon when the NRC approves the Plan.
to ULNRC-05663 Page 3 Commitment Completion Date
- 3. The elements to establish, implement, and maintain the Cyber 72 months after Security Program as described in Section 4 of the Callaway Plant NRC approval of Unit 1 Cyber Security Plan will be implemented. Cyber Security Plan The Completion Date is based on the time necessary to complete items 1 and 2, above, implement identified remediation plan activities with the plant in an acceptable operating mode for the identified activity, and fully implement the ongoing Cyber Security training program. This duration equates to approximately one additional operating cycle, depending upon when the NRC approves the Plan.