JAFP-10-0075, James A. FitzPatrick - License Amendment Withdrawal and Request - Cyber Security Plan

James A. FitzPatrick - License Amendment Withdrawal and Request - Cyber Security Plan

ML102000012
Person / Time
Site:	FitzPatrick
Issue date:	07/15/2010
From:	Peter Dietrich Entergy Nuclear Northeast, Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
JAFP-10-0075
Download: ML102000012 (14)

Text

SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 Entffffl(Entergy Nuclear Northeast Entergy Nuclear Operations, Inc.James A. FitzPatrick NPP P.O. Box 110 Lycoming, NY 13093 Tel 315-342-3840 Pete Dietrich -Site Vice President

-JAF JAFP-10-0075 July 15, 2010 U.S. Nuclear Regulatory Commission Document Control Desk Washington, D.C, 20555

SUBJECT:

License Amendment Withdrawal and Request -'Cyber Security Plan Entergy Nuclear Operations, Inc.James A. FitzPatrick Nuclear Power Plant Docket No. 50-333 License No. DPR-59

REFERENCE:

1. Entergy Letter dated November 23, 2009 (JAFP-09-01280), Request for approval of the James A. FitzPatrick Cyber Security Plan 2. NRC letter dated May 17, 2010, Entergy Nuclear Operations, Inc.Cyber Security Plan James A. FitzPatrick Nuclear Power Plant, Indian Point Generating Unit Nos. 1, 2, and 3, Pilgrim Nuclear Power Station, and Vermont Yankee Nuclear Power Station (TAC Nos. ME2802, ME2743, ME2744, ME2745, ME2747, and ME2138)3. NRC letter to Nuclear Energy Institute (NEI) dated June 7, 2010, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors"

Dear Sir or Madam,

In accordance with the 60-day request provided in Reference 2, Entergy Nuclear Operations, Inc. (Entergy) is hereby withdrawing the request for an amendment to the operating license for James A. FitzPatrick Nuclear Power Plant (JAF), as submitted in Reference 1; and, in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, Entergy is submitting a new request for an amendment to the operating license for JAF.The proposed amendment requests NRC approval of the JAF Cyber Security Plan, provides an implementation schedule, and revises the existing operating license's Physical Protection license condition to require Entergy to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan. Entergy utilized NEI 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, in development of the JAF Cyber Security Plan which resolves the NRC's generic issues with the previous submittal (Reference 1). In addition, Entergy is also providing a detailed milestone implementation schedule as requested.

Therefore, this submittal supersedes, in its entirety, the previous submittal (Reference 1).This submittal contains Security-Related Information, when separated from I Attachments 4, 5, and 6 this submittal is not restricted sou AýAd-SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 JAFP-10-0075 Page 2 of 3 Attachment 1 provides an evaluation of the proposed change. Attachment 2 provides the existing JAF operating license pages marked-up to show the proposed change.Attachment 3 provides the proposed operating license changes in final typed format for JAF. Attachment 4 provides the list of new regulatory commitments made in this submittal.

Attachment 5 provides the JAF Cyber Security Plan implementation schedule.Attachment 6 provides a copy of the JAF Cyber Security Plan which is a standalone document that will be incorporated by reference into the JAF Security Plan. In addition, Entergy is utilizing the definition of "cyber attack" as delineated in Reference

3. Entergy requests that Attachments 4, 5, and 6, which contain security-related information, be withheld from public disclosure in accordance with 10 CFR 2.390.The proposed changes have been evaluated in accordance with 10 CFR'50.91(a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards. The bases for this determination is included in Attachment 1.Entergy requests this license amendment be effective as of its date of issuance.

Once approved, the amendment will be implemented.

in accordance with the approved implementation schedule.The commitments made in this submittal are identified in Attachment 4.If you should have any questions regarding this submittal, please contact Mr. Joseph Pechacek at (315) 349-6766.I declare under penalty of perjury that the foregoing is true and correct.Executed on this 1 5 th day 2010.7Q: -.1 Site Vice President PD:JP:mh Attachments:

cc: next page Attachment 1 -Evaluation of Proposed Change Attachment 2 -Marked-up Facility Operation License (FOL) Pages Attachment 3 -Final Typed Facility Operation License (FOL) Pages Attachment 4 -List of Regulatory Commitments Attachment 5 -Cyber Security Plan Implementation Schedule Attachment 6 -James A. FitzPatrick Cyber Security Plan This submittal contains Security-Related Information, when separated from Attachments 4, 5, and 6 this submittal is not restricted SECURITY-RELATED INFORMATION -WITHHOLD UNDER 10 CFR 2.390 JAFP-10-0075 Page 3 of 3 cc: Mr. Samuel Collins Regional Administrator, Region I U.S. Nuclear Regulatory Commission 475 Allendale Road King of Prussia, Pennsylvania 19406-1415 Mr. Bhalchandra Vaidya, Project Manager Plant Licensing Branch I-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop O-8-C2A Washington,_DC 20555-0001 Resident Inspector's Office U.S. Nuclear Regulatory Commission James A. FitzPatrick Nuclear Power Plant P.O. Box 136 Lycoming, New York 13093 Mr. Paul Eddy New York State Department of Public Service 3 Empire Plaza, 1 0 th Floor Albany, New York 12223 Mr. Francis J. Murray, Jr.President and CEO NYSERDA 17 Columbia Circle Albany, NY 12203-6399 Document Component(s):

001 Transmittal Letter JAFP-10-0075 with Attachments This submittal contains Security-Related Information, when separated from Attachments 4, 5, and 6 this submittal is not restricted JAFP-10-0075 Attachment 1 Evaluation of Proposed Change (4 Pages)

JAFP-10-0075 Attachment 1 Evaluation of Proposed Change 1.0

SUMMARY

DESCRIPTION The proposed license amendment request (LAR) includes the proposed James A. FitzPatrick (JAF) Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition.

2.0 DETAILED

DESCRIPTION The proposed LAR includes three parts: the proposed JAF Cyber Security Plan, an implementation schedule, and a proposed sentence to be added to the existing operating license Physical Protection license condition for JAF requiring Entergy to fully implement and maintain in effect all provisions of the Commission-approved JAF Cyber Security Plan as required by 10 CFR 73.54. Federal Register notice dated March 27, 2009, issued the final rule that amended 10 CFR Part 73. The regulations in 10 CFR 73.54, "Protection of Digital Computer and Communication Systems and Networks," establish the requirements for a cyber security program. This regulation specifically requires each licensee currently licensed to operate a nuclear power plant under Part 50 of this chapter to submit a cyber security plan that satisfies the requirements of the Rule. Each submittal must include a proposed implementation schedule and implementation of the licensee's cyber security program must be consistent with the approved schedule.

The background for this application is addressed by the NRC Notice of Availability published on March 27, 2009, 74FR13926 (Reference 1).3.0 TECHNICAL EVALUATION Federal Register notice 74FR1 3926 issued the final rule that amended 10 CFR Part 73. Cyber security requirements are codified as new 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v).

These requirements are more in depth than the requirements imposed by NRC Order EA-02-026 (Reference 2).This proposed amendment conforms to the model Cyber Security Plan contained in Appendix A of Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors," Revision 6, dated April 2010, for use by licensees in development of their own cyber security plans. A deviation to Appendix B of NEI 08-09, Revision 6 is the use of a revised definition of"cyber attack" as delineated in NRC letter dated June 2, 2010 (Reference 3). The revised definition of cyber attack is "any event in which there is reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a critical digital asset." This LAR includes the proposed JAF Cyber Security Plan (Attachment

6) that conforms to the template provided in Appendix A of NEI 08-09, Revision 6. In addition, the LAR includes the proposed change to the existing operating license condition for "Physical Protection" (Attachments 2 and 3) for JAF. The LAR contains the proposed implementation schedule (Attachment

5) as required by 10 CFR 73.54. The LAR also provides a list of regulatory commitments (Attachment 4).Page 1 of 4 JAFP-10-0075 Attachment 1 Evaluation of Proposed Change

4.0 REGULATORY EVALUATION

4.1 Applicable

Regulatory Requirements/Criteria This LAR is submitted pursuant to 10 CFR 73.54 which requires licensees currently licensed to operate a nuclear power plant under 10-CFR Part 50 to submit a cyber security plan as specified in 10 CFR 50.4 and 10 CFR 50.90.4.2 No Significant Safety Hazards Consideration Entergy has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below: 1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response:

No.As required by 10 CFR 73.54 Entergy is submitting a cyber security plan for NRC review and approval for JAF. The JAF Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems' or the manner in ,which systems are operated, maintained, modified, tested, or inspected.

The JAF Cyber Security Plan does not require any plant modifications which affect the performance capability of the, structures, systems, and components relied upon to mitigate the consequences of postulated accidents.

The JAF Cyber Security Plan is designed to achieve high assurance that the systems within the scope of 10 CFR 73.54 are protected from cyber attacks and has no impact on the probability or consequences of an accident previously evaluated.

The second part of the proposed change is an implementation sche~dule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response:

No.As required by 10 CFR 73.54 Entergy is submitting a cyber security plan for NRC review and approval for JAF. The JAF Cyber Security Plan does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, rnaintained, modified, tested, or inspected.

The JAF Cyber Security Plan does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the Page 2 of 4 JAFP-10-0075 Attachment 1 Evaluation of Proposed Change consequences of postulated accidents.

The JAF Cyber Security Plan is designed to achieve high assurance that the systems.within the scope of the 10 CFR 73.54 Rule are protected from cyber attacks and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and do not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?Response:

No.As required by 10 CFR 73.54 Entergy is submitting a cyber security plan for NRC review and approval for JAF Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications.

Because there is no change to these established safety margins as result of the implementation of the JAF Cyber Security Plan, the proposed change does not involve a significant reduction in a margin of safety.The second part of the proposed change is an implementation schedule, and the third part adds a sentence to the existing operating license condition for Physical Protection.

Both of these changes are administrative in nature and do not involve a significant reduction in a margin of safety.Therefore, the proposed change does not involve a significant reduction in a margin of safety.4.3 Conclusion Based on the above, Entergy concludes that the proposed change presents no significant hazards under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.Page 3 of 4 JAFP-1 0-0075 Attachment 1 Evaluation of Proposed Change 5.0 ENVIRONMENTAL CONSIDERATION The proposed amendment establishes the licensing basis for a Cyber Security Program for JAF and will be a part of the JAF Cyber Security Plan. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12).

Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. Federal Register Notice, Final Rule 10 CFR Part 73, Power Reactor Security Requirements, published on March 27, 2009, 74 FR 13926 2. EA-02-026, Order Modifying Licenses, Safeguards and Security Plan Requirements, issued February 25, 2002 3. NRC letter to NEI dated June 7, 2010, NEI 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors" Page 4 of 4 JAFP-10-0075 Attachment 2 Marked-up Facility Operation License (FOL) Pages (2 pages)FOL Page 3 FOL Page 5 J (4) ENO pursuant to the Act and 10 CFR Parts 30, 40, and 70 to receive, possess, and use, at any time, any byproduct, source and special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration; or associated with radioactive apparatus, components or tools..(5) Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.C. This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter I: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below: (1) Maximum Power Level ENO is authorized to operate the facility at steady state reactor core power levels not in excess of 2536 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 295, are hereby incorporated in the renewed operating license.The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection ENO shall implement and maintain in effect all provisions of the approved fire protections program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated November 20, 1972; the SER Supplement No. I dated February 1, 1973; the SER Supplement No. 2 dated October 4, 1974; the SER dated August 1, 1979; the SER Supplement dated October 3, 1980; the SER Supplement dated February 13, 1981; the NRC Letter dated February 24, 1981;Technical Specification Amendments 34 (dated January 31, 1978), 80 (dated May 22, 1984), 134 (dated July 19, 1989), 135 (dated September 5, 1989), 142 (dated October 23, 1989), 164 (dated August 10, 1990), 176 (dated January 16, 1992), 177 (dated February 10, 1992), 186 (dated February 19, 1993), 190 (dated June 29, 1993), 191 (dated July 7, 1993), 206 (dated February 28, 1994) and 214 (dated June 27, 1994); and NRC Exemptions and associated safety evaluations dated April 26, 1983, July 1, 1983, January 11, 1985, April 30, 1986, September 15, 1986 and September 10, 1992 subject to the following provision:

Amendment 295 Safeguards Contingency Plan, Revision 0," submitted by letter dated October 26, 2004, as supplemented by letter dated May 17, 2006.ENO shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved JAF Cyber Security Plan submitted by letter dated July 16, 2010.E. Power Uprate License Amendment Implementation The licensee shall complete the following actions as a condition of the approval of the power uprate license amendment.

(1) Recirculation Pump Motor Vibration Perform monitoring of recirculation pump motor vibration during initial Cycle 13 power ascension for uprated power conditions.

(2) Startup Test Program The licensee will follow a startup testing program, during Cycle 13 power ascension, as described in GE Licensing Topical Report NEDC-31897P-1, "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." The Startup test program includes system testing of such process control systems as the feedwater flow and main steam pressure control systems. The licensee will collect steady-state operational data during various portions of the power ascension to the higher licensed power level so that predicted equipment performance characteristics can be verified.

The licensee will do the startup testing program in accordance with its procedures.

The licensee's approach is in conformance with the test guidelines of GE Licensing Topical Report NEDC-31897P-1,"Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." June 1991 (proprietary), GE Licensing Topical Report NEDO-31897, "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." February 1992 (nonproprietary), and NEDC-31897P-AA, Class III (proprietary), May 1992.(3) Human Factors The licensee will review the results of the Cycle 13 startup test program to determine any potential effects on operator training.

Training issues identified will be incorporated in Licensed Operator training during 1997. Simulator discrepancies identified will be addressed in accordance with simulator Configuration Management procedural requirements.

F. Additional Conditions The Additional Conditions contained in Appendix C, as revised through Amendment No. 289, are herby incorporated into this renewed operating license. ENO shall operate the facility in accordance with the Additional Conditions.

Renewed .Leeý-. DPR-69-Amendment JAFP-10-0075 Attachment 3 Final Typed Facility Operation License (FOL) Pages (2 Pages)FOL Page 3 FOL Page 5 (4) ENO pursuant to the Act and 10 CFR Parts 30, 40, and 70 to receive, possess, and use, at a~ny time, any byproduct, source and special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration; or associated with radioactive apparatus, components or tools..(5) Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.C. This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter I: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below: (1) Maximum Power Level ENO is authorized to operate the facility at steady state reactor core power levels not in excess of 2536 megawatts (thermal).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. , are hereby incorporated in the renewed operating license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3) Fire Protection ENO shall implement and maintain in effect all provisions of the approved fire protections program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated November 20, 1972; the SER Supplement No. 1 dated February 1, 1973; the SER Supplement No. 2 dated October 4, 1974; the SER dated August 1, 1979; the SER Supplement dated October 3, 1980; the SER Supplement dated February 13, 1981; the NRC Letter dated February 24, 1981;Technical Specification Amendments 34 (dated January 31, 1978), 80 (dated May 22, 1984), 134 (dated July 19, 1989), 135 (dated September 5, 1989), 142 (dated October 23, 1989), 164 (dated August 10, 1990), 176 (dated January 16, 1992), 177 (dated February 10, 1992), 186 (dated February 19, 1993), 190 (dated June 29, 1993), 191 (dated July 7, 1993), 206 (dated February 28, 1994) and 214 (dated June 27, 1994); and NRC Exemptions and associated safety evaluations dated April 26, 1983, July 1, 1983, January 11, 1985, April 30, 1986, September 15, 1986 and September 10, 1992 subject to the following provision:

Amendment Safeguards Contingency Plan, Revision 0,"'submitted by letter dated October 26, 2004, as'supplemented by letter dated May 17, 2006. /ENO shall fully implement in accordance with an NRC-approved implementation schedule and maintain in effect all provisions of the Commission-approved JAF Cyber Security Plan submitted by letter dated July 16, 2010.E. Power Uprate License Amendment Implementation The licensee shall complete the following actions as a condition of the approval of the power uprate license amendment.

(1) Recirculation PumD Motor Vibration Perform monitoring of recirculation pump motor vibration during initial Cycle 13 power ascension for uprated power conditions.

(2) Startup Test Program The licensee will follow a startup testing program, during Cycle 13 power ascension, as described in GE Licensing Topical Report NEDC-31897P-1, "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." The Startup test program includes system testing of such process control systems as the feedwater flow and main steam pressure control systems. The licensee will collect steady-state operational data during various portions of the power ascension to the higher licensed power level so that predicted equipment performance characteristics can be verified.

The licensee will do the startup testing program in accordance with its procedures.

The licensee's approach is in conformance with the test guidelines of GE Licensing Topical Report NEDC-31897P-1,"Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." June 1991 (proprietary), GE Licensing Topical Report NEDO-31897, "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate." February 1992 (nonproprietary), and NEDC-31897P-AA, Class Ill (proprietary), May 1992.(3) Human Factors The licensee will review the results of the Cycle 13 startup test program to determine any potential effects on operator training.

Training issues identified will be incorporated in Licensed Operator training during 1997. Simulator discrepancies identified will be addressed in accordance with simulator Configuration Management procedural requirements.

F. Additional Conditions The Additional Conditions contained in Appendix C, as revised through Amendment No. 289, are herby incorporated into this renewed operating license. ENO shall operate the facility in accordance with the Additional Conditions.

Amendment