Text

License Amendment Request - Cyber Security Plan Implementation Schedule
	ML17101A608
Person / Time
Site:	Pilgrim
Issue date:	03/30/2017
From:	Dent J; Entergy Nuclear Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	CAC MF6517, IR 2015403
	Download: ML17101A608 (19)
	v • d • e

~*Entergy Entergy Nuclear Operations, Inc.

Pilgrim Nuclear Power Station 600 Rocky Hill Road March 30, 2017 Plymouth, MA 02360 John A. Dent, Jr.

Site Vice President U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

License Amendment Request - Cyber Security Plan Implementation Schedule Pilgrim Nuclear Power Station

Docket 50-293 Renewed Facility Operating License No. DPR-35

REFERENCES:

1. NRG letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - Issuance of Amendment To Facility OperatingLicense Re: Cyber Security Plan: (TAC No. ME4351), dated July 22, 2011 (ADAMS Accession No. ML11152A043)

2. NRG Internal Memorandum to Barry Westreich from Russell Felts, Review Criteria for Title 10 of the C9de of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests, dated October 24, 2013 (ADAMS Accession No. ML13295A467)

3. NRG letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - NRG Temporary Instruction 22011004, "Inspection of Implementation of Interim Cyber Security Milestones 1-7" Report 0500029312015403, dated March 9, 2015 (ADAMS Accession No. ML15069A005)

4. Entergy Nuclear Operations, Inc., letter to NRG, Pilgrim Nuclear Power Station's Response to Cyber Security Inspection Report Identified Enforcement Discretion Violations, dated August 15, 2016 (Letter Number 2.16.045)

5. NRG letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - Issuance of Amendment Re: Gyber Security Plan Implementation Schedule (GAG No. MF6517), dated June 6, 2016 (ADAMS Accession No. ML16082A460)

6. Entergy Nuclear Operations, Inc., letter to NRG, Pilgrim Nuclear Power Station; Notification of Permanent Cessation of Power Operations, dated November 10, 2015 (Letter Number 2.15.080)

~ 0 D l SoDI A LETTER NUMBER: 2.17.011

Entergy Nuclear Operations Pilgrim Nuclear Power Station

Dear Sir or Madam:

Letter No. 2.17.011 Page 2 of 3 Pursuant to Title 10 Code of Federal Regulations (CFR) 50.4, Written communications, and Title 10 CFR 50.90, Amendment of License or Construction Permit at Request of Holder, Entergy Nuclear Operations, Inc. (ENO) hereby requests an amendment to the Renewed Facility Operating License (RFOL) for the Pilgrim Nuclear Power Station (PNPS). In accordance with the guidelines provided by Reference 2, this request proposes a change to the PNPS Cyber Security Plan (CSP) Milestone 8 full implementation date as set forth in the CSP Implementation Schedule approved in References 1 and 5.

In Reference 6, ENO notified the NRC that PNPS will cease operation no later than June 1, 2019. To support the decommissioning of PNPS, ENO is requesting a change to the Milestone 8 date that is beyond the cessation of operations date, and also beyond the dates when the reactor has been defueled and when the decay heat from the fuel stored in the spent fuel pool is expected to be capable of being removed by air cooling. During the Milestone 8 extension period, ENO plans to maintain the previously implemented CSP Milestones 1-7, which were inspected by the NRC for compliance as described in References 3 and 4. provides an analysis of the proposed change. Attachment 2 contains the proposed marked-up pages for Section 3.G, Physical Protection of the PNPS RFOL, which references the CSP amendments containing the milestones that are the subject of the commitment change proposed in this submittal. Attachment 3 contains the proposed revised operating license pages. Attachment 4 contains a proposed revised CSP implementation schedule date for the full implementation of Milestone 8. contains one revised commitment related to the full implementation of PNPS the CSP.

The proposed changes have been evaluated in accordance with 10 CFR 50.91(a)(1),

Notice for public comment, using criteria in 10 CFR 50.92(c), Issuance of amendment, and it has been determined that the changes involve no significant hazards consideration. The bases for these determinations are included in Attachment 1.

ENO requests approval of the proposed license amendment by December 15, 2017.

Once approved, the amendment will be effective as of the date of issuance and shall be implemented within 30 days.

If you have any questions or require additional information, please contact Everett P.

Perkins, Jr. at (508) 830-8323.

This letter contains one revised commitment related to the full implementation of the PNPS CSP, which is listed in Attachment 5.

In accordance with 10 CFR 50.91(b), State consultation, ENO is notifying the State of Massachusetts of this proposed license amendment by transmitting a copy of this letter to the designated state official.

Entergy Nuclear Operations, Inc.

Pilgrim Nuclear Power Station Letter No. 2.17.011 Page 3 of 3 I declare under penalty of perjury that the foregoing is true and correct. Executed on March 30, 2017.

Sincerely, ~

Attachments:

1. Analysis of Proposed Operating License Change

2. Proposed PNPS Operating License Changes (mark-up)

3. Operating License Page Change Instructions and Revised PNPS Operating License Pages

4. Revised Cyber Security Plan Implementation Schedule

5. List of Revised Regulatory Commitments cc:

Mr. Daniel H. Dorman Regional Administrator, Region I U.S. Nuclear Regulatory Commission 2100 Renaissance Boulevard, Suite 100 King of Prussia, PA 19406-2713 NRC Senior Resident Inspector Pilgrim Nuclear Power Station Ms. Booma Venkataraman, Project Manager Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop 0-8C2-A Washington, DC 20555-001 Mr. John G. Lamb, Project Manager Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Mail Stop 0-881-A Washington, DC 20555-001 Mr. John Giarrusso Jr.

Planning and Preparedness Section Chief Mass. Emergency Management Agency 400 Worcester Road Framingham, MA 01702

ATTACHMENT 1 Letter Number 2.17.011 Analysis of Proposed Operating License Change (6 Pages)

PNPS Letter2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSED OPERATING LICENSE CHANGE 1.0

SUMMARY

DESCRIPTION This license amendment request (LAR) includes a proposed change to the Entergy Nuclear Operations, Inc. (ENO), Pilgrim Nuclear Power Station (PNPS) Cyber Security Plan (CSP) implementation schedule for Milestone 8, full implementation date and a proposed revision to Section 3.G, Physical Protection of the PNPS renewed facility operating license (RFOL),

which references the CSP amendments containing the milestones. This change is requested to support PNPS's transition, starting on June 1, 2019, from an operating power plant to a decommissioned plant.

2.0 DETAILED DESCRIPTION In Reference 1, the Nuclear Regulatory Commission (NRC) issued a license amendment to the RFOL for PNPS that approved the PNPS CSP and associated implementation schedule for Milestones 1 through 8. In Reference 5, the NRC issued a license amendment that revised the Milestone 8 full implementation date to December 15, 2017. In Reference 6, ENO notified the NRC that PNPS will cease operation no later than June 1, 2019. Since this notification, ENO has continued to maintain the previously implemented cyber security Milestones 1 through 7, which were inspected for compliance by the NRC as described in References 3 and 4. In Reference 2, the NRC provided criteria to be used for evaluation of license amendment requests to revise the CSP Implementation Schedule Milestone 8 date. The information requested by Reference 2 is discussed in Section 3.0 below. To support the planned decommissioning of PNPS, ENO is proposing a change to the Milestone 8 full implementation date from December 15, 2017, to December 31, 2020.

3.0 TECHNICAL EVALUATION

On July 15, 2010, in accordance with 1 O CFR 73.54, Protection of digital computer and communications systems and networks, (nuclear cyber security rule), ENO submitted a proposed schedule for PNPS achieving full compliance with the cyber security rule. The schedule was approved (Reference 1) and consists of eight milestones, with interim Milestones 1 through 7, as amended by Reference 7, having been completed by December 31, 2012 and subsequently inspected for compliance by the NRC in 2015 (References 3 and 4). Presently, Milestone 8 (full compliance with the rule) is required to be completed by December 15, 2017,

, however, as described in Reference 6, ENO intends to permanently cease power operations at PNPS no later than June 1, 2019.

Below is ENO's discussion of the eight evaluation criteria listed in Reference 2:

1. Identification of the specific requirement or requirements of the CSP that the licensee needs additional time to implement.

ENO requests that full implementation of CSP requirements per Milestone 8 be rescheduled from December 15, 2017 to December 31, 2020. The specific requirement is described in Cyber Security Plan, Section 3.1, "Analyzing Digital Computer Systems and Networks and Applying Cyber Security Controls."

During this additional period ENO will continue to comply with the requirements of Milestones 1 through 7.

Page 1 of 6

PNPS Letter 2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSED OPERATING LICENSE CHANGE

2. Detailed justification that describes the reason additional time is required to implement the specific requirement or requirements identified.

On November 10, 2015, in accordance with 10 CFR 50.82, Termination of license, ENO notified the NRC of the intent to permanently cease power operations at PNPS no later than June 1, 2019. Completing the remaining Milestone 8 actions by December 31, 2017 is not a prudent use of ENO resources because digital assets that have been identified as CDAs while the reactor is operating will not be required for significant safety, security, and emergency preparedness (SSEP) functions after the reactor is certified to be permanently shut down and defueled. Therefore, the CDAs associated with those functions will no longer be required and, consequently, the current CDAs associated with those functions will no longer be protected subject to 10 CFR 73.54 after the 10 CFR 50.82 certifications have been submitted. As such, extending the remaining Milestone 8 actions until December 31, 2020 has no adverse effect on nuclear safety given that ENO is required to maintain the previously implemented actions for Milestones 1 through 7.

3. Proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The proposed completion date for Milestone 8 is December 31, 2020. By this date, the PNPS reactor will have been defueled and the decay heat from the fuel stored in the spent fuel pool is expected to be capable of being removed by air cooling. Once this plant condition is achieved, the CSP license condition is no longer required and ENO plans to submit a LAR to remove the condition from PNPS's RFOL.

4. Evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the overall cyber security program in the context of milestones already completed.

Cyber security protections provided by the completion and maintenance of Milestones 1 through 7 actions ensure that the program will continue to be effective in significantly mitigating the risk of the design basis threat (DST) via cyber means. Most notably, safety-related, important-to-safety, and security CDAs will continue to be deterministically isolated from external networks; stringent control of portable media and mobile devices (PMMD) connected to CDAs will continue, including use of standalone scanning kiosks, use of passive media in the file transfer process, and use of level-specific kiosks and media; and implementation of technical cyber security controls and security officer observation for CDAs that support physical security target set functions. Additionally, although not required until Milestone 8, ENO has implemented procedures governing CDA configuration management, cyber security incident response and recovery, and cyber security training.

5. Description of the methodology for prioritizing completion of work for CDAs associated with significant SSEP consequences and with reactivity effects in the balance of plant.

CDAs are plant components that are subject to the maintenance prioritization and normal work management process which places the highest priority on apparent conditions adverse to quality in system, structure, and component (SSC) design function and related factors such as safety risk and nuclear defense-in-depth, as well as threats to continuity of electric power generation in the balance-of-plant (BOP). Further, in regard to deterministic isolation Page 2of6

PNPS Letter 2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSED OPERATING LICENSE CHANGE and control of portable media and mobile devices for safety-related, important-to-safety (including BOP), and security CDAs, maintenance of one-way or air-gapped configurations and implementation of control of PMMDs remains high priority. This prioritization enabled

timely completion of cyber security Interim Milestones 3 and 4. ENO continues to give prompt attention to any emergent issue with CDAs that would potentially challenge the established cyber protective barriers.

6. Discussion of the cyber security program performance up to the date of the license amendment request.

r No compromise of SSEP function by cyber means has been identified. As documented in Reference 3 and 4, an NRC inspection at PNPS of ENO's compliance with Milestones 1 through 7 was concluded on January 30, 2015, and findings were designated as having very low safety significance (green non-cited, granted enforcement discretion). Additionally, at PNPS, an annual ENO quality assurance (QA) audit has been conducted every year since 2013 pursuant to the physical security program review required by 10 CFR 73.55(m),

Security program reviews. The QA audit includes review of cyber security program implementation. There have been no significant audit findings related to overall cyber security program performance and effectiveness during these audits.

7. Discussion of cyber security issues pending in the corrective action program.

No cyber security issues that would constitute a threat to proper CDA function or that would call into question cyber security program effectiveness are currently pending in the corrective action program.

8. Discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

Modifications completed include those required to deterministically isolate Level 3 and 4 CDAs, as required by nuclear cyber security implementation schedule interim Milestone 3.

No modifications are pending.

This LAR includes the proposed change to the existing operating license condition for Section 3.G, Physical Protection of the PNPS renewed facility operating license (RFOL),

which references the CSP amendments containing the milestones (Attachments 2 and 3).

This LAR contains the proposed revised CSP implementation schedule (Attachment 4),

and also provides a revised list of regulatory commitments (Attachment 5).

4.0 REGULATORY EVALUATION

4.1 Applicable Regulatory Requirements/Criteria 1 O CFR 73.54, Protection of digital computer and communications systems and networks, requires licensees to maintain and implement a CSP. PNPS's RFOL No. DPR-35 includes a Physical Protection license condition that requires ENO to fully implement and maintain in effect all provisions of the NRC approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

Page 3of6

PNPS Letter 2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSED OPERATING LICENSE CHANGE 4.2 Significant Safety Hazards Consideration Entergy Nuclear Operations, Inc. (ENO) is requesting an amendment to the Pilgrim Nuclear Power Station (PNPS) Renewed Facility Operating License (RFOL) to revise the Physical Protection license condition as it relates to the Cyber Security Plan (CSP). This change includes a proposed change to a CSP implementation schedule milestone date and a proposed revision to the PNPS RFOL to include the proposed deviation. Specifically, ENO is proposing a change to the implementation Milestone 8 completion date.

ENO has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in Title 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1.

Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change to the CSP implementation schedule is administrative in nature.

This change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents, and has no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2.

Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change to the CSP implementation schedule is administrative in nature.

This proposed change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected.. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3.

Does the proposed change involve a significant reduction in a margin of safety?

Page 4of6

PNPS Letter 2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSED OPERATING LICENSE CHANGE Response: No.

Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. The proposed change to the CSP implementation schedule is administrative in nature. In addition, the milestone date delay for full implementation of the CSP has no substantive impact because other measures have been taken which provide adequate protection during this period of time. Because there is no change to established safety margins as a result of this_ change, the proposed change does not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, ENO concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of "no significant hazards consideration" is justified.

4.3 Conclusion In conclusion, based on the considerations discussed above: ( 1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

5.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment provides a change to the CSP implementation schedule. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

1. NRC letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - Issuance of Amendment To Facility Operating License Re: Cyber Security Plan: (TAC No: ME4351),

dated July 22, 2011 (ADAMS Accession No. ML11152A043)

2. NRC Internal Memorandum to Barry Westreich from Russell Felts, Review Criteria for Title 10 of the Code of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests, dated October 24, 2013 (ADAMS Accession No. ML13295A467)

3. NRC letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - NRC Temporary Instruction 2201/004, "Inspection of Implementation of Interim Cyber Security Milestones 1-7" Report 05000293/2015403, dated March 9, 2015 (ADAMS Accession No. ML15069A005)

Page 5of6

PNPS Letter2.17.011 ATTACHMENT 1 ANALYSIS OF PROPOSE!? OPERATING LICENSE CHANGE

4. Entergy Nuclear Operations, Inc., letter to NRC, Pilgrim Nuclear Power Station's Response to Cyber Security Inspection Report Identified Enforcement Discretion Violations, dated August 15, 2016 (Letter Number 2.16.045)

5. NRC letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - Issuance of Amendment Re: Cyber Security Plan Implementation Schedule (CAC No. MF6517),

dated June 6, 2016 (ADAMS Accession No. ML16082A460)

6. Entergy Nuclear Operations, Inc., letter to NRC, Pilgrim Nuclear Power Station; Notification of Permanent Cessation of Power Operations, dated November 10, 2015 (Letter Number 2.15.080)

7. NRC letter to Entergy Nuclear Operations, Inc., Pilgrim Nuclear Power Station - Issuance of Amendment Re: Revised Cyber Security Plan Implementation Schedule Milestone 6 (TAC No. ME8941), dated November 13, 2012 (ADAMS Accession No. ML12261A130)

Page 6 of 6

ATTACHMENT 2 Letter Number 2.17.011 Proposed PNPS Operating License Changes (mark-up)

(1 Page)

(Showing proposed changes; additions are highligh!ed and deletions are strikethrough)

1) provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A.

Maximum Power Level ENO is authorized to operate the facility at steady state power levels not to exceed 2028 megawatts thermal.

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 244, are hereby incorporated in the renewed operating license.

The licensee shall operate the facility in accordance with the Technical Specifications.

C.

Records ENO shall keep facility operating records in accordance with the requirements of the Technical Specifications.

D.

Equalizer Valve Restriction - DELETED E.

Recirculation Loop Inoperable - DELETED F.

Fire Protection ENO shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated December 21, 1978 as supplemented subject to the following provision:

ENO may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (50 FR 27817 and 27822) and to the authority of 1 O CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 1 O CFR 73.21, is entitled: "Pilgrim Nuclear Power Station Physical Security, Training and Qualification, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 13, 2004, as supplemented by letter dated May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 236, as supplemented by changes approved by: License Amendment Nos. 238, 241, an4 244, and XXX.

Amendment ~.244 Renewed License No. DPR-35

ATTACHMENT 3 Letter Number 2.17.011 Operating License Page Change Instructions and Revised PNPS Operating License Pages (2 Pages)

Page Change Instructions ATTACHMENT TO LICENSE AMENDMENT NO. 2XX RENEWED FACILITY OPERATING LICENSE NO. DPR-35 DOCKET NO. 50-293 Remove the following page of Renewed Facility Operating License, and replace with the attached revised page. The revised page is identified by amendment number and contains a line in the margin indicating the area of change.

REMOVE INSERT Page3 Page 3 provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A.

Maximum Power Level ENO is authorized to operate the facility at steady state power levels not to exceed 2028 megawatts thermal.

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. XXX, are hereby incorporated in the renewed operating license.

The licensee shall operate the facility in accordance with the Technical Specifications.

C.

Records ENO shall keep facility operating records in accordance with the requirements of the Technical Specifications.

D.

Equalizer Valve Restriction - DELETED E.

Recirculation Loop Inoperable - DELETED F.

Fire Protection ENO shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facility and as approved in the SER dated December 21, 1978 as supplemented subject to the following provision:

ENO may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

G.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (50 FR 27817 and 27822) and to the authority of 1 O CFR 50.90 and 1 O CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Pilgrim Nuclear Power Station Physical Security, Training and Qualification, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 13, 2004, as supplemented by letter dated May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 236, as supplemented by changes approved by: License Amendment Nos. 238, 241, 244, and XXX.

Amendment 243,244 Renewed License No. DPR-35 r

ATTACHMENT 4 Letter Number 2.17.011 Revised Cyber Security Plan Implementation Schedule (1 Page)

8 PNPS Letter 2.17.011 ATTACHMENT 4 Revised Cyber Security Plan Implementation Schedule Implementation Milestone Completion Date Basi Full implementation of December 31, 2020 By the completion date, the PNPS Pilgrim Nuclear Power Cyber Security Plan will be fully Station (PNPS) Cyber implemented for all SSEP functions in Security Plan for all safety, accordance with Title 10 CFR 73.54.

security, and emergency This date also bounds the completion preparedness (SSEP) of all individual asset security control functions will be achieved.

design remediation actions including those that require a refueling outage for implementation.

Page 1 of 1

ATTACHMENT 5 Letter Number 2.17.011 List of Revised Regulatory Commitments (1 page)

PNPS Letter 2.17.011 ATTACHMENT 5 List of Revised Regulatory Commitments The following table identifies those actions committed to by EntergylNuclear Operations, Inc. in this document. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments.

TYPE SCHEDULED (Check One)

COMPLETION COMMITMENT ONE-DATE TIME CONTINUING (If Required)

ACTION COMPLIANCE Full implementation of Pilgrim Nuclear Power Station Cyber Security Plan for all safety, security, and emergency x

December 31, 2020 preparedness functions will be achieved.