ML12321A266

Duane Arnold, Issuance of Amendment Revised Cyber Security Plan Implementation Schedule Milestone 6

ML12321A266
Person / Time
Site:	Duane Arnold
Issue date:	11/28/2012
From:	Feintuch K D Plant Licensing Branch III
To:	Anderson R L NextEra Energy Duane Arnold
Feintuch K D
References
TAC ME8948
Download: ML12321A266 (12)

Text

UNITED NUCLEAR REGULATORY WASHINGTON, D.C. 20555-0001 November 28, 2012 Mr. Richard L. Anderson Vice President NextEra Energy Duane Arnold, LLC 3277 DAEC Road Palo, IA 52324-9785 DUANE ARNOLD ENERGY CENTER -ISSUANCE OF AMENDMENT RE: REVISED CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE MILESTONE 6 (TAC NO. ME8948) Dear Mr. Anderson: The Nuclear Regulatory Commission has issued the enclosed Amendment No. 284 to the Renewed Facility Operating License No. DPR-49 for the Duane Energy Center (DAEC). The amendment consists of changes to the Renewed Facility Operating License in response to your application dated June 13, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML 12230A072). The amendment approves the change in scope of Cyber Security Plan Implementation Schedule Milestone 6, and revises license condition 2.C.(5) of the Renewed Facility Operating Licenses for DAEC. During the review prior to issuance, NRC staff noted an incorrect citation on Renewed Operating License page 4, paragraph "(7) Additional Conditions" that is unrelated to the subject licensing action. In a subsequent discussion with a member of your staff, we traced the discrepancy to a failure to replace the amended license pages associated with Amendment 279, issued September 8, 2011 (ADAMS Accession No. ML 111520231). When you replace the license page 4 affected by Amendment No. 284, please also verify that the "Additional Conditions" page changed by Amendment No. 279 is also changed.

R L. Anderson -2 A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Sincerely, Karl D. Feintuch, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-331 Enclosures: 1. Amendment No. 284 to DPR-49 2. Safety Evaluation cc w/encls: Distribution via Listserv UNITED NUCLEAR REGULATORY WASHINGTON, D.C. 20555-0001 NEXTERA ENERGY DUANE ARNOLD, DOCKET NO. DUANE ARNOLD ENERGY AMENDMENT TO RENEWED FACILITY OPERATING Amendment No. 284 License No. DPR-49 The U.S. Nuclear Regulatory Commission (the Commission) has found that: The application for amendment by NextEra Energy Duane Arnold, LLC dated June 13, 2012, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied. Enclosure 1

-2 Accordingly, the license is amended by changes to the renewed operating license, as indicated in the attachments to this license amendment, and paragraph 2.C.{S) of Renewed Facility Operating License No. DPR-49, which is hereby amended to read as follows: (S) Physical Protection NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.SS (S1 FR 27817 and 27822) and to the authority of 10 CFR SO.90 and 10 CFR SO.S4(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Duane Arnold Energy Center Physical Security Plan," submitted by letter dated May 16, 2006. NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR SO.90 and 10 CFR SO.S4(p). The Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC CSP was approved by License Amendment No. 278, as supplemented by a change approved by License Amendment No. 284 This license amendment is effective as of the date of issuance and shall be implemented by December 31, 2012. FOR THE NUCLEAR REGULATORY COMMISSION Robert D. Carlson, Chief Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Attachment: Changes to Renewed Facility Operating License DPR-49 Date of Issuance: November ,2012 ATTACHMENT TO LICENSE AMENDMENT NO. RENEWED FACILITY OPERATING LICENSE NO. DOCKET NO. Replace the following page of Renewed Facility Operating License No. DPR-49 with the attached revised page. The revised page is identified by an amendment number and contains marginal lines indicating the areas of change. Remove Insert Page 4 Page 4 and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21. is entitled: "Duane Arnold Energy Center Physical Security Plan," submitted by letter dated May 16, 2006. NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC CSP was approved by License Amendment No. 278, as supplemented by a change approved by license Amendment No. 284 Deleted Additional Conditions The Additional Conditions contained in Appendix B, as revised through Amendment No. 279, are hereby incorporated into this license. NextEra Energy Duane Arnold, LLC shall operate the facility in accordance with the Additional Conditions. The licensee is authorized to revise the Updated Final Safety Analysis Report by deleting the footnote for Section 9.1.4.4.5 which states: ""The NRC has not endorsed the reactor building crane as single-failure proof (Reference 9)," and by deleting Reference 9 of the references for Section 9.1. (9) Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and include the following key Fire fighting response strategy with the following elements: Pre-defined coordinated fire response strategy and guidance Assessment of mutual aid fire fighting assets Designated staging areas for equipment and materials Command and control Training of response personnel Operations to mitigate fuel damage considering the following: Protection and use of personnel assets Communications Minimizing fire spread Procedures for implementing integrated fire response strategy Identification of readily-available pre-staged equipment Training on integrated fire response strategy Spent fuel pool mitigation measures Actions to minimize release to include consideration of: Water spray scrubbing Dose to onsite responders (10) The licensee shall implement and maintain all Actions required by Attachment 2 to NRC Order EA-06-137, issued June 20,2006, except the last action that requires incorporation of the strategies into the site security plan, contingency plan, emergency plan and/or guard training and qualification plan, as appropriate. Renewed License No. DPR-49 Amendment 284 UNITED NUCLEAR REGULATORY WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 284 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-49 NEXTERA ENERGY DUANE ARNOLD, LLC DOCKET NO. 50-331 1.0 INTRODUCTION By application dated June 13, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12230A072), NextEra Energy Duane Arnold, LLC (NextEra, the licensee) requested a change to the Renewed Facility Operating License for Duane Arnold Energy Center (DAEC). The proposed change would revise the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone NO.6 and the existing license condition in the Renewed Facility Operating License. Milestone NO.6 of the CSP implementation schedule concerns the identification, documentation, and implementation of cyber security controls (technical, operational, and management) for critical digital assets (CDAs) related to target set equipment. NextEra Energy Duane Arnold is requesting to modify the scope of Milestone NO.6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, would be implemented concurrent with the full implementation of the Cyber Security Program (Milestone No.8). Thus, all CSP activities would be fully implemented by the completion date, identified in Milestone NO.8 of the licensee's CSP implementation schedule. Portions of the letter dated June 13, 2012 contain sensitive unclassified non-safeguards information and, accordingly, those portions are withheld from public disclosure. 2.0 REGULATORY EVALUATION The NRC staff reviewed and approved the licensee's existing CSP implementation schedule by License Amendment No. 278 dated July 29, 2011 (ADAMS Accession No. ML111940224). concurrent with the incorporation of the CSP into the facility current licensing basis. The NRC staff considered the following regulatory requirements and guidance in its review of the current license amendment request to modify the existing CSP implementation schedule: Enclosure 2

-Title 10 of the Code of Federal Regulations (10 CFR) 73.54 states: "Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule." The licensee's Renewed Facility Operating License includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP. Amendment No. 278, dated July 29,2011, which approved the licensee's CSP and implementation schedule, included the following statement: 'The implementation of the CSP, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee by letter April 5, 2011, and approved by the NRC staff with this license amendment. All subsequent changes to the NRC-approved CSP implementation schedule will require prior NRC approval pursuant to 10 CFR 50.90." In a letter to the Nuclear Energy Institute (NEI) dated March 1, 2011 (ADAMS Accession No. ML 110070348), the NRC staff acknowledged that the cyber security implementation schedule template was "written generically and licensees that use the template to develop their proposed implementation schedules may need to make changes to ensure the submitted schedule accurately accounts for site-specific activities." 3.0 TECHNICAL EVALUATION Amendment No. 278 to Renewed Facility Operating License No. DPR-49 for DAEC was issued on July 29, 2011 (ADAMS Accession No. ML 111940224). The NRC staff also approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with the amendment. The implementation schedule had been submitted by the licensee based on a template prepared by NEI, which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML 110600218). The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones: Establish the Cyber Security Assessment Team; Identify Critical Systems and Critical Digital Assets; Install a deterministic one-way device between lower level devices and higher level devices; Implement the security control "Access Control For Portable And Mobile Devices"; Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements; Identify, document, and implement cyber security controls as per "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment; 7) Commence ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented; and Fully implement the CSP.

-3 3.1 Licensee's Proposed Change Currently, Milestone No.6 of DAEC's CSP requires NextEra to identify, document, and implement cyber security controls for CDAs that could adversely impact the design function of physical security target set equipment by December 31, 2012. These cyber security controls consist of technical, operational and management security controls. In its June 13, 2012, application, NextEra proposed to modify Milestone NO.6 to change the scope of the cyber security controls due to be implemented on December 31,2012, to include only the NEI 08-09, Revision 6, Appendix D technical security controls. NextEra proposes to amend its CSP to provide that operational and management security controls, identified in Milestone No.6, will be fully implemented by a later date, which is the completion date identified in Milestone No.8 of the CSP implementation schedule. The licensee stated that implementing the technical cyber security controls for target set CDAs provides a high degree of protection against cyber-related attacks that could lead to radiological sabotage. The licensee further stated that many of its existing programs are primarily procedure-based programs and must be implemented in coordination with the comprehensive Cyber Security Program. The licensee also stated that the existing programs currently in place at DAEC (e.g., physical protection, maintenance, configuration management, and operating experience) provide sufficient operational and management cyber security protection during the interim period until the Cyber Security Program is fully implemented. 3.2 NRC Staff Evaluation The intent of the cyber security irnplementation schedule was for licensees to demonstrate ongoing implementation of their cyber security program prior to full implementation, which is set for the date specified in Milestone NO.8. In addition to Milestone NO.6 and its associated activities, licensees will be completing six other milestones (Milestones No.1 through NO.5 and Milestone No.7) by December 31, 2012. Activities include establishing a Cyber Security Assessment Team, identifying critical systems and CDAs, installing deterministic one-way devices between defensive levels, implementing access control for portable and mobile devices, implementing methods to observe and identify obvious cyber related tampering, and conducting ongoing monitoring and assessment activities for target set CDAs. In the aggregate, the interim milestones demonstrate ongoing implementation of the cyber security program at DAEC. The NRC staff has reviewed the licensee's evaluation of the proposed change in its submittal dated June 13, 2012, and finds that by completing Milestones NO.1 through No.5, Milestone NO.6 with implementation of technical controls to target set CDAs, and Milestone No.7, DAEC will have an acceptable level of cyber security protection until full program implementation is achieved. Technical cyber security controls include access controls, audit and accountability, CDA and communications protection, identification and authentication, and system hardening. These controls are executed by computer systems, as opposed to people, and consist of hardware and software controls that provide automated protection to a system or application. Implementation of technical cyber security controls promotes standardization, trust, interoperability, connectivity, automation, and increased efficiency. For these reasons, the NRC staff concludes that the licensee's approach is acceptable. The NRC staff also recognizes that full implementation of operational and management cyber security controls in accordance with requirements of the DAEC CSP will be achieved with full implementation of the DAEC Cyber Security Program by the date set in Milestone NO.8. That is, all required elements for the operational and management cyber security controls in accordance with the DAEC CSP will be implemented in their entirety at the time of full implementation of the CSP. The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that "[ijmplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML 110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRC-approved CSP implementation schedule, thus, will require prior NRC approval pursuant to 10 CFR 50.90. 3.3 Revision to License Condition 2.C.(5) By letter dated June 13, 2012, the licensee proposed to modify Paragraph 2.C.(5), "Physical Protection," of Renewed Facility Operating License No. DPR-49 for DAEC which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the NRC-approved CSP. The license condition in Paragraph 2.C.(5) of the Renewed Operating License No. 49 for DAEC is modified (with changes indicated in bold type) to read as follows: NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Duane Arnold Energy Center Physical Security Plan," submitted by letter dated May 16, 2006. NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC CSP was approved by License Amendment No. 278, as supplemented by a change approved by License Amendment No. 284. 3.4 Summary Based on its review of the licensee's submissions, the NRC staff concludes that the proposed changes to Milestone NO.6 of the licensee's CSP implementation schedule are acceptable. The NRC staff also concludes that, upon full implementation of the licensee's cyber security

-5 program, the requirements ofthe licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff finds the proposed changes acceptable. 4.0 STATE CONSULTATION In accordance with the Commission's regulations, the Iowa State official was notified of the proposed issuance of the amendment. The State official had no comments. 5.0 ENVIRONMENTAL CONSIDERATION This amendment relates to safeguards matters and does not involve any significant construction impacts. Accordingly, this amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of this amendment. 6.0 CONCLUSION The NRC staff has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. Principal Contributor: Monika Coflin, NSIR Date of issuance: November 28, 2012 R. L. Anderson -2 A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Docket No. 50-331 Enclosures: 1. Amendment No. 284 to DPR-49 2. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION: PUBLIC LPL3-1 r/f RidsNrrPMDuane Arnold Resource RidsNrrLABTully Resource RidsNrrDssStsb Resource TWengert, NRR Accession Number: ML12321A266 Sincerely, IRAI Karl D. Feintuch, Project Manager Plant Licensing Branch 111-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation RidsOgcRp Resource CErlanger, NSIR RidsNrrDorlLpl3-1 Resource MCofJin, NSIR RidsRgn3MailCenter Resource CRoman, NRR RidsAcrsAcnw _ MailCTR Resource RidsNrrDorlDpr Resource *Safety evaluation transmitted by memo of August 13, 2012 OFFICE DORL/PM DORL/PM OGC (NLO) DORL/BC DORL/PM NAME CRoman KFeintuch BTuily rlanger

• BMizuno RCarlson KFeintuch DATE 11/07/2012 11/1312012 1112712012 I 08/13/2012 11/20/12 11/2812012 11/28/2012 OFFICIAL RECORDS COPY