View source for RA-10-025, Notification Letter Designing Balance of Plant Systems within the Cyber Security Rule Scope

{{Adams
| number = ML102720415
| issue date = 09/23/2010
| title = Notification Letter Designing Balance of Plant Systems within the Cyber Security Rule Scope
| author name = Alexander D
| author affiliation = Progress Energy Carolinas, Inc, Progress Energy Florida, Inc, Progress Energy Co
| addressee name = 
| addressee affiliation = NRC/Document Control Desk, NRC/NRR, NRC/NSIR
| docket = 05000261, 05000302, 05000324, 05000325, 05000400
| license number = DPR-023, DPR-062, DPR-071, DPR-072, NPF-063
| contact person = 
| case reference number = RA-10-025
| document type = Letter type:RA
| page count = 3
}}

=Text=
{{#Wiki_filter:Progress Emj PO Box 1551 411 Fayetteville Street Mall Raleigh NC 27602 Serial: RA-10-025 September 23, 2010 United States Nuclear Regulatory Commission ATTENTION: Document Control Desk Washington, DC 20555-0001 BRUNSWICK STEAM ELECTRIC PLANT, UNIT NOS. 1 AND 2 DOCKET NOS. 50-325 AND 50-324 / LICENSE NOS. DPR-71 AND DPR-62 CRYSTAL RIVER UNIT 3 NUCLEAR GENERATING PLANT DOCKET NO. 50-302 / LICENSE NO. DPR-72 SHEARON HARRIS NUCLEAR POWER PLANT, ,UNIT NO. 1 DOCKET NO. 50-400 / LICENSE NO. NPF-63 H. B. ROBINSON STEAM ELECTRIC PLANT, UNIT NO. 2 DOCKET NO. 50-261 / LICENSE NO. DPR-23

==SUBJECT:==
NOTIFICATION LETTER DESIGNATING BALANCE OF PLANT SYSTEMS WITHIN THE CYBER SECURITY RULE SCOPE

==REFERENCES:==
: 1. Letter from Jim Hughes (NERC) to David Crews, Brunswick Steam Electric Plant, Unit 1, Requestfor Data or Information: Nuclear Power Plant "Bright-Line" Survey, dated June 15, 2010
: 2. Letter from Jim Hughes (NERC) to David Crews, Brunswick Steam Electric Plant, Unit 2, Request for Data or Information: Nuclear Power Plant "Bright-Line" Survey, dated June 15, 2010
: 3. Letter from Jim Hughes (NERC) to David Crews, Crystal River Nuclear Generating Plant, Unit 3, Requestfor Data or Information: Nuclear Power Plant "Bright-Line" Survey, dated June 15, 2010
: 4. Letter from Jim Hughes (NERC) to David Crews, Shearon Harris Nuclear Power Plant, Unit 1, Requestfor Data or Information. Nuclear Power Plant "Bright-Line" Survey, dated June 15, 2010               1 5.. Letter from Jim Hughes (NERC) to David Crews, Robinson Steam Electric Plant, Unit 2, Request for Data or Information. Nuclear Power Plant "Bright-Line" Survey, dated June 15, 2010
: 6. Letter from Michael Moon (NERC) to David Crews, NERCs Response to the Completed BrightLine Survey: Brunswick Steam Electric Plant, Unit 2, dated August 27, 2010
: 7. Letter from Michael Moon (NERC) to Glenn Dooley, NERC's Response to the Completed BrightLine Survey: Crystal River Nuclear GeneratingPlant, Unit 3, dated August 27, 2010
: 8. Letter from Michael Moon (NERC) to David Crews, NERC's Response to the Completed Bright Line Survey. Shearon HarrisNuclear Power Plant, Unit 1, dated August 27, 2010
: 9. Letter from Michael Moon (NERC) to David Crews, NERC's Response to the Completed Bright Line Survey. Robinson Steam Electric Plant, Unit 2, dated August 27, 2010
: 10. Letter from Michael Moon (NERC) to David Crews, NERC's Response to the Completed Bright Line Survey: Crystal River Nuclear GeneratingPlant, Unit 3, Robinson Steam Electric Plant, Unit 2, Shearon HarrisNuclear Power Plant, Unit],
1,  i /
Brunswick Steam Electric Plant, Unit ] & 2, dated August 31, 2010

United States Nuclear Regulatory Commission RA-10-025 Page 2 Ladies and Gentlemen:
By Order dated March 19, 20091, the Federal Energy Regulatory Commission (FERC) clarified that the "balance of plant" equipment within a nuclear power plant is subject to compliance with the FERC approved Critical Infrastructure Protection (CIP) Reliability Standards. Paragraph 50 of the Order provides for an exception from the CIP Reliability Standards for equipment in the balance of plant that is subject to the Nuclear Regulatory Commission (NRC) cyber security regulations. Pursuant to paragraph 50 of the Order, the North American Electric Reliability Corporation (NERC) has been engaging in a "Bright-Line" determination process (References 1 - 5) to clarify the systems that would be subject to the NRC cyber security rule (10 CFR 73.54), and those that would be subject to the CIP Reliability Standards.
In References 6 - 10, NERC is requiring that Carolina Power & Light Company (CP&L), now doing business as Progress Energy Carolinas, Inc., and Florida Power Corporation (FPC), now doing business as Progress Energy Florida, Inc., provide the NRC with a letter identifying all balance of plant Structures, Systems, and Components (SSCs) considered important to safety with respect to the NRC's cyber security regulation. As documented in the CP&L and FPC responses to the Bright-Line survey, balance of plant SSCs in Attachment 1 of the Survey are important to safety, and thus, are within the scope of 10 CFR 73.54.
In accordance with the requirements of 10 CFR 73.54(b)(1), a comprehensive identification of SSCs subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. The program is implemented in accordance with the schedule submitted to the NRC by letter dated July 8, 2010, with the CarolinaPower
& Light Company and FloridaPower CorporationCyber Security Plan. This identification of SSCs will be available for inspection upon completion and will contain those SSCs as identified in Attachment 1 of the Bright-Line survey. Providing the requested information in this alternate matter satisfies the intent of the NERC letter.
In References 6 - 10, NERC is also requiring that each nuclear power plant submit a revised cyber security plan to the NRC for its review and approval. On or before November 30, 2010, CP&L and FPC will supplement the Cyber Security Plan to clarify the scope of systems described in Section 2.1, "Scope and Purpose." Section 2.1 will be amended to clarify the balance of plant SSCs that will be included in the scope of the cyber security program.
This letter contains the following Regulatory Commitment:
On or before November 30, 2010, CP&L and FPC will supplement Section 2.1, "Scope and Purpose," of the CarolinaPower & Light Company and FloridaPower Corporation Cyber Security Plan. Section 2.1 will be amended to clarify the balance of plant SSCs that will be included in the scope of the cyber security program.
Mandatory Reliability Standardsfor CriticalInfrastructureProtection, order on clarification,Order No. 706-B, 126 FERC &#xb6; 61,229 (2009).

United States Nuclear Regulatory Commission RA-10-025 Page 3 If you have additional questions, please call me at (919) 546-5357.
Sincerely, Donna Alexander Acting Manager - Nuclear Regulatory Affairs DBM c:      J. Wiggins, USNRC Director - Office of Nuclear Security and Incident Response E. Leeds, USNRC Director - Office of Nuclear Reactor Regulation L. Reyes, USNRC Regional Administrator - Region II USNRC Resident Inspector - BSEP, Unit Nos. 1 and 2 USNRC Resident Inspector - CR3 USNRC Resident Inspector - SHNPP, Unit No. 1 USNRC Resident Inspector - HBRSEP, Unit No. 2 J. Paige, NRR Project Manager -CR3 M. Vaaler, NRR Project Manager - BSEP, Unit Nos. 1 and 2; SHNPP, Unit No. 1 T. Orf, NRR Project Manager -HBRSEP, Unit No. 2 Michael Moon Director of Compliance Operations North American Electric Reliability Corporation 116-390 Village Boulevard Princeton, NJ 08540 Jim Hughes North American Electric Reliability Corporation 116-390 Village Boulevard Princeton, NJ 08540}}