W3F1-2009-0063, License Amendment Request, Cyber Security Plan & Implementation Schedule - 10 CFR 73.54

License Amendment Request, Cyber Security Plan & Implementation Schedule - 10 CFR 73.54

ML093280370
Person / Time
Site:	Waterford
Issue date:	11/21/2009
From:	Kowelewski J Entergy Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
W3F1-2009-0063
Download: ML093280370 (14)

Text

Entergy Operations, Inc.

17265 River Road Kilona, LA 70057 Jii'itff~gi Tel 504-739-6660 Fax 504-739-6678 jkowale@entergy.com Joe Kowelewski Vice President, Operations Waterford 3 W3F1 -2009-0063 November 21, 2009 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, DC 20555

SUBJECT:

License Amendment Request, Cyber Security Plan and'Implementation Schedule - 10 CFR 73.54 Waterford Steam Electric Station, Unit 3 Docket No. 50-382 License No. NPF-38

Dear Sir or Madam:

In accordance with the provisions of 10CFR 50.4 and 10CFR 50.90, Entergy Operations, Inc.

(Entergy) is submitting a request for an amendment to the Facility Operating Licenses (FOL) for Waterford 3 Steam Electric Station, Unit 3 (Waterford 3). The FOL amendment revises the existing FOL Physical Protection license condition to require Entergy to fully implement and maintain in effect all provisions of the Commission approved cyber security plan.

Additionally, Entergy requests NRC approval of the Waterford 3 Cyber Security Plan and associated implementation schedule in accordance with 10 CFR 73.54. provides an evaluation of the proposed change. Attachment 2 provides the existing operating license page marked-up to show the proposed change. Attachment 3 provides the proposed operating license changes in final typed format. Attachment 4 provides the Waterford 3 Cyber Security Plan Implementation Schedule. Attachment 5 provides the guidance deviations taken by Entergy. Attachment 6 provides a copy of the Waterford 3 Cyber Security Plan, which is a standalone document that will be incorporated by reference into the Waterford 3 Security Plan upon approval. Entergy requests that Attachments 4, 5, and 6, which contain security-related information, be withheld from public disclosure in accordance with 10CFR 2.390.

The proposed change has been evaluated in accordance with 10CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that this change involves no significant hazards consideration. The bases for these determinations are included in . In accordance with 10CFR 50.91, a copy of this application, with enclosures, is being provided to the designated Louisiana State Official.

The list of new regulatory commitments is provided in Attachment 4.

This letter contains security-sensitive information - Attachments 4, 5, and 6 are withheld from public disclosure per 10CFR 2.390

W3F1 -2009-0063 Page 2 Entergy requests approval of the proposed amendment, Cyber Security Plan and associated implementation schedule as soon as practical. Although this request is neither exigent nor emergency, your prompt review is requested. Once approved, the amendment is to be implemented within 60 days. The implementation of the Cyber Security Plan is to be in accordance with the approved schedule (Attachment 4).

If you have any questions or require additional information, please contact Robert J. Murillo, Manager, Licensing at (504) 739-6715.

I declare under penalty of perjury that the foregoing is true and correct. Executed on November 21, 2009.

Sincerely, JAK/j Attachments: 1. Analysis of Proposed Operating License Change

2. Proposed Operating License Changes (mark-up)

3. Revised Operating License Page

4. Implementation Schedule/List of Regulatory Commitments

5. Entergy (Waterford 3) Deviation Table to NEI 08-09, Revision 3

6. Waterford 3 Cyber Security Plan U

This letter contains security-sensitive information - Attachments 4, 5, and 6 are withheld from public disclosure per 10CFR 2.390

W3F1 -2009-0063 Page 3 cc: Mr. Elmo Collins Regional Administrator U. S. Nuclear Regulatory Commission Region IV 612 E. Lamar Blvd., Suite 400 Arlington, TX 76011-4125 NRC Senior Resident Inspector Waterford Steam Electric Station, Unit 3 P.O. Box 822 Killona, LA 70066-0751 U. S. Nuclear Regulatory Commission Attn: Mr. Kaly Kalyanam MS 0-8 B1 Washington, DC 20555-0001 Wise, Carter, Child & Caraway ATTN: J. Smith P.O. Box 651 Jackson, MS 39205 Winston & Strawn ATTN: N.S. Reynolds 1700 K Street, NW Washington, DC 20006-3817 Morgan, Lewis & Bockius LLP ATTN: T.C. Poindexter 1111 Pennsylvania Avenue, NW Washington, DC 20004 Louisiana Department of Environmental Quality Office of Environmental Compliance Surveillance Division P. O. Box 4312 Baton Rouge, LA 70821-4312 This letter contains security-sensitive information - Attachments 4, 5, and 6 are withheld from public disclosure per 10CFR 2.390

Attachment I W3F1 -2009-0063 Analysis of Proposed Operating License Change to W3F1 -2009-0063 Page 1 of 5 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) adds a sentence to the existing FOL Physical Protection license condition requiring Entergy to fully implement and maintain in effect all provisions of the Commission approved cyber security plan. This submittal also includes the proposed Waterford 3 Cyber Security Plan and Implementation Schedule.

2.0 DETAILED DESCRIPTION The proposed change includes three parts: the proposed Waterford 3 Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved Waterford 3 Cyber Security Plan as required by 1 OCFR73.54. FederalRegister notice dated March 27, 2009, issued the final rule that amended 1 OCFR Part 73. The regulations in 10CFR73.54, "Protection of digital computer and communication systems and networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule. The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74FR1 3926 (Reference 1).

3.0 TECHNICAL EVALUATION

Federal Register notice 74FR1 3926 issued the final rule that amended 1 OCFR Part 73.

Cyber security requirements are codified as new 10CFR73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10CFR73.1(a)(1)(v). These requirements are substantial improvements upon the requirements imposed by EA-02-026 (Reference 2).

This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of NEI 08-09, "Cyber Security Plan Template," Revision 3, dated September 2009, for use by licensees in development of their own cyber security plans with deviations as identified and justified in Attachment 5. Deviations to Appendices D and E of NEI 08-09, Revision 3 are detailed in Attachment 1 of the Waterford 3 Cyber Security Plan.

This LAR includes the proposed Waterford 3 Cyber Security Plan (Attachment 6) that conforms to the template provided in NEI 08-09 with deviations. In addition, the LAR includes the proposed change to the existing operating license condition for "Physical Protection" (Attachments 2 and 3). The LAR contains the proposed implementation schedule (Attachment 4) as required by 1 OCFR73.54. Attachment 5 explains deviations from NEI 08-09, Revision 3, Appendix A to reflect later industry and NRC discussions.

to W3F1 -2009-0063 Page 2 of 5

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria This LAR is submitted pursuant to 10CFR73.54 which requires licensees currently licensed to operate a nuclear power plant under 10CFR Part 50 to submit a cyber security plan as specified in 10CFR50.4 and 10CFR50.90.

4.2 Significant Safety Hazards Consideration Entergy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10CFR50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change is required by 10CFR73.54 and includes three parts. The first part is the submittal of the Waterford 3 Cyber Security Plan for NRC review and approval. The Waterford 3 Cyber Security Plan conforms to the template provided in NEI 08-09 with deviations, and provides a description of how the requirements of the Rule will be implemented at Waterford 3. The Waterford 3 Cyber Security Plan establishes the licensing basis for the Waterford 3 Cyber Security Program. The Waterford 3 Cyber Security Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems are protected from cyber attacks. The Waterford 3 Cyber Security Plan itself does not require any plant modifications. However, the Waterford 3 Cyber Security Plan does describe how plant modifications which involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat as defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and has no impact on the probability or consequences of an accident to W3F17-2009-0063 Page 3 of 5 previously evaluated.

The.second part of the proposed change is an implementation schedule. The third part adds a sentence to the existing operating'license condition for Physical Protection. Both of these changes are administrative and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, it is concluded that this change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change is required by 10CFR73.54 and includes three parts. The first part is the submittal of the Waterford 3 Cyber Security Plan for NRC review and approval. The Waterford 3 Cyber Security Plan conforms to the template provided by NEI 08-09 with deviations, and provides a description of how the requirements of the Rule will be implemented at Waterford 3. The Waterford 3 Cyber Security Plan establishes the licensing basis for the Waterford 3 Cyber Security Program. The Waterford 3 Cyber Security Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important'to-safety functions,

2. Security functions,

3. Emergency preparedness functions includihg offsite communications, and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. The Waterford 3 Cyber Security Plan itself does not require any plant modifications.

However, the Waterford 3 Cyber Security Plan does describe how plant modifications which involve digital computer systems are reviewed to provide high assurance of adequate protection against cyber attacks, up to and including the design basis threat defined in the Rule. The proposed change does not alter the plant configuration, require new plant equipment to be installed, alter accident analysis assumptions, add any initiators, or effect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The first part of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any previously evaluated.

The second part of the proposed change is an implementation schedule. The third part adds a sentence to the existing operating license cdndition for Physical Protection. Both of these changes are administrative and do not create the possibility to W3F1-2009-0063 Page 4 of 5 of a new or different kind of accident from any previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change is required by 10CFR73.54 and includes three parts. The first part is the submittal of the Waterford 3 Cyber Security Plan for NRC review and approval. The Waterford 3 Cyber Security Plan conforms to the template provided by NEI 08-09 with deviations, and provides a description of how the requirements of the Rule will be implemented at Waterford 3. The Waterford 3 Cyber Security Plan establishes the licensing basis for the Waterford 3 Cyber Security Program. The Waterford 3 Cyber Security Plan establishes how to achieve high assurance that nuclear power plant digital computer and communication systems and networks associated with the following are adequately protected against cyber attacks up to and including the design basis threat:

1. Safety-related and important-to-safety functions,

2. Security functions,

3. Emergency preparedness functions including offsite communications, and

4. Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.

Part one of the proposed change is designed to achieve high assurance that the systems within the scope of the Rule are protected from cyber attacks. Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. Because there is no change to these established safety margins, the proposed change does not involve a significant reduction in a margin of safety.

The second part of the proposed change is an implementation schedule. The third part adds a sentence to the existing operating license condition for Physical ý Protection. Both of these changes are administrative and do not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, Entergy concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10CFR50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

to W3F1 -2009-0063 Page 5 of 5 4.3 Conclusion In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment establishes the licensing basis for a Cyber Security Program for Waterford 3 and will be incorporated by reference into the Waterford 3 Cyber Security Plan.

The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10CFR51.22(c)(1 2). Therefore, pursuant to 10CFR51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926

2. Federal EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002 C

Attachment 2 W3F1-2009-0063 Proposed Operating License Changes (mark-up)

(a) The first performance of SR 6.5.17, in accordance with Specification 6.5.17.c.(i), shall be within the specified Frequency of 6 years, plus the 18-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 18 months if the time period since the most recent successful tracer gas test is greater than 6 years.

(b) The first performance of the periodic assessment of CRE habitability, Specification 6.5.17.c.(ii), shall be within 3 years, plus the 9-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 9 months if the time period since the most recent successful tracer gas test is greater than 3 years.

(c) The first performance of the periodic measurement of CRE pressure, Specification 6.5.17.d, shall be within 18 months, plus the 138 days allowed by SR 4.0.2, as measured from August 13, 2008, the date of the most recent successful pressure measurement test, or within 138 days if not performed previously.

D. The facility requires an exemption from certain requirements of Appendices E and J to 10 CFR Part 50. These exemptions are described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 10 (Section 6.1.2) and Supplement No. 8 (Section 6.2.6), respectively. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. These exemptions are, therefore, hereby granted pursuant to 10 CFR 50.12. With the granting of these exemptions, the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.

E. EOI shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan, which contains Safeguards Information protected under 10 CFR 73.21, is entitled:

"Physical Security, Safeguards Contingency and Training & Qualification Plan," and was submitted on October 4, 2004.

insert

............ EOI shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved Waterford 3 Cyber Security Plan submitted by letter dated November 21, 2009, and

• withheld from public disclosure in accordance with 10CFR2.390.

AMENDMENT NO. 4-7 218 Revised by Ileter dated July 26, 2007 Revised by letter dated November 21, 2009

Attachment 3 W3F1 -2009-0063 Revised Operating License Page

(a) The first performance of SR 6.5.17, in accordance with Specification 6.5.17.c.(i), shall be within the specified Frequency of 6 years, plus the 18-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 18 months if the time period since the most recent successful tracer gas test is greater than 6 years.

(b) The first performance of the periodic assessment of CRE habitability, Specification 6.5.17.c.(ii), shall be within 3 years, plus the 9-month allowance of SR 4.0.2, as measured from April 17, 2004, the date of the most recent successful tracer gas test, as stated in the October 8, 2004 letter response to Generic Letter 2003-01, or within the next 9 months if the time period since the most recent successful tracer gas test is greater than 3 years.

(c) The first performance of the periodic measurement of CRE pressure, Specification 6.5.17.d, shall be within 18 months, plus the 138 days allowed by SR 4.0.2, as measured from August 13, 2008, the date of the most recent successful pressure measurement test, or within 138 days if not performed previously.

D. The facility requires an exemption from certain requirements of Appendices E and J to 10 CFR Part 50. These exemptions are described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 10 (Section 6.1.2) and Supplement No. 8 (Section 6.2.6), respectively. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. These exemptions are, therefore, hereby granted pursuant to 10 CFR 50.12. With the granting of these exemptions, the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.

E. EOI shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan, which contains Safeguards Information protected under 10 CFR 73.21, is entitled:

"Physical Security, Safeguards Contingency and Training & Qualification Plan," and was submitted on October 4, 2004.

EOI shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved Waterford 3 Cyber Security Plan submitted by letter dated November 21, 2009, and withheld from public disclosure accordance with 10CFR2.390.

AMENDMENT NO. 1-7 24-8 Revised by Ietter dated July 26, 2007 Revised by letter dated November 21, 2009

Attachment 4 W3F1 -2009-0063 Implementation Schedule/List of Regulatory Commitments