JAFP-10-0132, James A. FitzPatrick - Notification Letter Designating Jaf Balance of Plant Systems within the Cyber Security Rule Scope

James A. FitzPatrick - Notification Letter Designating Jaf Balance of Plant Systems within the Cyber Security Rule Scope

ML102700602
Person / Time
Site:	FitzPatrick
Issue date:	09/27/2010
From:	Peter Dietrich Entergy Nuclear Northeast, Entergy Nuclear Operations
To:	Office of Nuclear Reactor Regulation, Document Control Desk
References
JAFP-10-0132
Download: ML102700602 (6)

Text

JAFP-10-0132 September 27, 2010

U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555-0001

Subject:

Notification Letter Designating JAF Balance of Plant Systems within the Cyber Security Rule Scope James A. FitzPatrick Nuclear Power Plant Docket No. 50-333 License No. DPR-59

Reference:

(1) Letter from Jim Hughes (NERC) to Entergy, "Request for Data or Information: Nuclear Power Plant 'Bright-Line' Survey," dated June 15, 2010 (2) Letter from Michael Moon (NERC) to JAF, "NERC's Response to the Completed Bright Line Survey," dated August 27, 2010

Dear Sir or Madam:

By Order dated March 19, 2009 1, the Federal Energy Regulatory Commission (FERC) clarified that the "balance-of-plant" equipment within a nuclear power plant is subject to compliance with the FERC approved Critical Infrastructure Protection (CIP) Reliability

Standards. Paragraph 50 of the Order provides for an exception from the CIP Reliability Standards for equipment in the balance-of-plant that is subject to the NRC cyber security regulations. Pursuant to paragraph 50 of the Order, the North American Electric Reliability Corporation (NERC) has been engaging in a "Bright-Line" determination process (Reference 1) to clarify the systems that would be subject to the NRC cyber security rule (10 CFR 73.54), and those that would be subject to the CIP Reliability Standards.

1 Mandatory Reliability Standards for Critical Infrastructure Protection , order on clarification , Order No. 706-B, 126 FERC ¶ 61,229 (2009).

Entergy Nuclear NortheastEntergy Nuclear Operations, Inc. James A. FitzPatrick NPP P.O. Box 110 Lycoming, NY 13093 Tel 315-342-3840

Pete Dietrich Site VP - JAF NPP JAFP-10-0132 Page 2 of 3 In the Reference 2 letters, NERC is requiring that James A.FitzPatrick (JAF)Nuclear Power Plant provide the NRC with a letter identifying all balance-of-plant systems, structures, and components (SSCs)considered important-to-safety with respect to the NRC's cyber security regulation.

As documented in our response to the Bright-Line survey, balance-of-plant SSCs in Attachment 1 of the survey are important-to-safety, and thus, are within the scope of 10 CFR 73.54.In accordance with the requirements of 10 CFR 73.54 (b)(1), a comprehensive identification of SSCs subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program.The program is implemented in accordance with the schedule submitted to the NRC by letter dated July 15, 2010 (JAFP-1 0-0075)with JAF's Cyber Security Plan.This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey.Providing the requested information in this alternate manner satisfies the intent of the NERC letter.In Reference 2, NERC is also requiring that JAF submit a revised cyber security plan to the NRC for its review and approval.On or before November 30, 2010, JAF will supplement the Cyber Security Plan submittal to clarify the scope of systems described in Section 2.1,"Scope and Purpose." Section 2.1 will be amended to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program.The new commitments contained in this submittal are summarized in the Attachment.

Should you have any questions concerning this letter, or require additional information, please contact Mr.Joseph Pechacek at (315)349-6766.Respectfully, Pete Dietrich Site Vice President PD:JP:mh

Attachment:

List of Regulatory Commitments cc: Next page JAFP-10-0132 Page 2 of 3 In the Reference 2 letters, NERC is requiring that James A. FitzPatrick (JAF) Nuclear Power Plant provide the NRC with a letter identifying all balance-of-plant systems, structures, and components (SSCs) considered important-to-safety with respect to the NRC's cyber security regulation. As documented in our response to the Bright-Line survey, balance-of-plant SSCs in Attachment 1 of the survey are important-to-safety, and thus, are within the scope of 10

CFR 73.54.

In accordance with the requirements of 10 CFR 73.54 (b)(1), a comprehensive identification of SSCs subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. The program is implemented in accordance with the schedule submitted to the NRC by letter dated July 15, 2010 (JAFP-10-0075) with JAF's Cyber Security Plan. This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey. Providing the requested information in this alternate manner satisfies the intent of the NERC letter.

In Reference 2, NERC is also requiring that JAF submit a revised cyber security plan to the NRC for its review and approval. On or before November 30, 2010, JAF will supplement the Cyber Security Plan submittal to clarify the scope of systems described in Section 2.1, "Scope and Purpose." Section 2.1 will be amended to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program.

The new commitments contained in this submittal are summarized in the Attachment. Should you have any questions concerning this letter, or require additional information, please contact Mr. Joseph Pechacek at (315) 349-6766.

Respectfully,

Pete Dietrich Site Vice President

PD:JP:mh

Attachment:

List of Regulatory Commitments

cc: Next page JAFP-10-0132 Page 3 of 3 CC:

Mr. Mark Dapas Acting Regional Administrator, Region I U.S. Nuclear Regulatory Commission

475 Allendale Road King of Prussia, Pennsylvania 19406-1415

Mr. Bhalchandra Vaidya, Project Manager Plant Licensing Branch I-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop O-8-C2A Washington, DC 20555-0001 Resident Inspector's Office U.S. Nuclear Regulatory Commission James A. FitzPatrick Nuclear Power Plant P.O. Box 136 Lycoming, New York 13093 Mr. Paul Eddy New York State Department of Public Service 3 Empire Plaza, 10 th Floor Albany, New York 12223

Mr. Francis J. Murray, Jr.

President and CEO NYSERDA 17 Columbia Circle Albany, NY 12203-6399

Michael Moon Director of Compliance Operations North American Electric Reliability Corporation 116-390 Village Boulevard Princeton, NJ 08540

Document Component(s): 001 Transmittal Letter JAFP-10-0132 with Attachment

Attachment JAFP-10-0132 List of Regulatory Commitments JAFP-10-0132 Attachment Page 1 of 1 List of Regulatory Commitments The following table identifies those actions committed to by Entergy in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE (Check One) COMMITMENT ONE-TIME ACTION CONTINUING COMPLIANCESCHEDULED COMPLETION DATE (If Required)

Entergy will supplement the Cyber Security Plan submittal to clarify the

scope of systems described in Section 2.1, "Scope and Purpose" to clarify the balance-of-plant SSCs that will be included in the scope of the cyber security program. X November 30, 2010 In accordance with the requirements of 10 CFR 73.54 (b)(1), a comprehensive identification of systems, structures, and components (SSCs) subject to the requirements of 10 CFR 73.54 will be developed during the implementation of the cyber security program. This identification of SSCs will be available for inspection upon completion and will contain, at a minimum, those SSCs as identified in Attachment 1 of the Bright-Line Survey. X September 30, 2014