NG-12-0207, Redacted Letter NG-12-0207

Redacted Letter NG-12-0207

ML12230A072
Person / Time
Site:	Duane Arnold
Issue date:	06/13/2012
From:	Anderson R L NextEra Energy Duane Arnold
To:	Feintuch K D Plant Licensing Branch III
References
TAC M8948, NG-12-0207
Download: ML12230A072 (16)

Text

DUANE ""'" ARNOLD SECURITY.. RELATES INFORMATION WITIIiIOLS FROM PUBLIC SISCLOSURE UNDER 16 CFR 2.390 June 13, 2012 NG-12-0207 10 CFR 50.90 10 CFR 50.4 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk ReDACTIoN 6Y ..../

Washington, DC 20555-0001 kARL F*JNivc.H 1\ SSt{ Duane Arnold Energy Center LltSNRc..

Docket No. 50-331 AVGus ,14 lc Renewed Op. license No. J license Amendment Request TSCR-136 -Cyber Security Plan Implementation Schedule Milestone Change

References:

(1) Letter from K. Feintuch, NRC, to C. Constanzo, NextEra Energy Duane Arnold, "Issuance of Amendment Pertaining to Cyber Security Plan (TAC NO. ME4287)," dated July 29, 2011. (ML 111940224)

(2) Letter from C. Costanzo, NextEra Energy Duane Arnold to NRC, "Response to Request for Additional Information and Submittal of TSCR-121 C Supplement to License Amendment Request for Approval of the Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC Cyber Plan," dated April 5, 2011. (ML 110950546)

In Reference 1, the NRC issued license Amendment No. 278 to the Renewed Facility Operating License for NextEra Energy Duane Arnold. LLC (hereafter NextEra Energy Duane Arnold) that approved the DAEC (Duane Arnold Energy Center) Cyber Security Plan and associated implementation milestone schedule.

The Cyber Security Plan Tl:tis letter contains seourity related infermatiaA AttashmeAts (Seetiolls 4.0, ' _______________________________________

NextEra Energy Duane Arnold, LLC, 3277 DAEC Road, Palo, IA 52324 f\J l<<...

SECURITY*

RELATED

¥11ft 11101::9' FROM PUBLIC DISCI::OSURE UNDER '10 CFR Document Control Desk NG-12-0207 R*" iJ t\C'\E"SJ Page 2 of 3 Implementation Schedule contained in Reference 2 was utilized as a portion of the basis for the NRC's safety evaluation report provided by Reference

1. NextEra Energy Duane Arnold is planning to implement the requirements of implementation schedule milestone 6 in a slightly different manner than described in the approved implementation schedule.

Although no change to the implementation schedule date is proposed, the change to the description of the milestone activity is conservatively considered to be a change to the implementation schedule, and in accordance with the provisions of 10 CFR 50.4 and 10 CFR 50.90, NextEra Energy Duane Arnold is submitting this request for an amendment to the Facility Operating License (FOL) for DAEC. The DAEC Cyber Security Plan was previously provided in Reference

2. Attachment 1 provides an evaluation of the proposed change. Attachment 2 contains proposed marked-up operating license pages for the Physical Protection license condition for DAEC to reference the change provided in this submittal.

Attachment 3 contains the proposed revised operating license pages. Attachment 4 contains a change to the scope of implementation milestone

6. NextEra Energy Duane Arnold requests that Attachments 1 (Sections 1.0, 2.0 and 3.0) and 4, which contain related information (SRI). be withheld from public disclosure in accordance with 10 CFR 2.390. The proposed changes have been evaluated in accordance with 10 CFR 50.91(a)(1) using criteria in 10 CFR 50.92(c).

and it has been determined that the changes involve no significant hazards consideration.

The bases for these determinations are included in Attachment

1. NextEra Energy DUane Arnold requests this license amendment be effective as of its date of issuance.

Although this request is neither exigent nor emergency, your review and approval is requested prior to December 31, 2012. These changes have been reviewed by the NextEra Energy Duane Arnold Onsite Review Group. A copy of this submittal is also being sent to our appointed state official pursuant to 10 CFR 50.91. The revised obligation contained in this submittal is summarized in Attachment

5. Should you have any questions concerning this letter, or require additional information, please contact Steve Catron, Licensing Manager, at (319) 851-7234.

This letter eontatns seeurity-related-information

• Attachments 1 (Sections 1.0, 2.0, afte 3.0) aftd 4 are 'tvithheld per 10 CFR 2.390 R (DAC.TE"Y SEGI:JRITY RELATED WITHHOLD FROM PUBLIC DISCLOSURE UNDER 10 erR 2.390 Document Control Desk NG-12-0207 Page 3 of 3 I declare under penalty of perjury that the foregoing is true and correct. Executed on June 13, 2012.

r Richard L.

Vice President, Duane Arnold Energy Center NextEra Energy Duane Arnold, LLC 1 -Evaluation of Proposed Change (contains SRI) 2 -Proposed DAEC Operating License Changes (Mark-up) 3 -Proposed DAEC Operating License Changes (Re-typed) 4 -Revised Milestone 6 of the Cyber Security Plan Implementation Schedule (contains 5 -Revised Regional Administrator, USNRC, Region Project Manager, USNRC, Duane Arnold Energy Resident Inspector, Duane Arnold Energy Center, M. Rasmusson (State of Iowa) This letter seol;trity*reJated information Attachments

+(Seetions-'Hl;-" 2.0, and 3.0) and 4 are withheld from publie disclosure per 10 erR 2.390 SECURITY*

RELATED INFORMATION WITIIII01:B FROM PUB1:IO DISCLOSURE UNDER 10 CFR 2.390 ATTACHMENT 1

rZ u A (TEj) EVALUATION OF PROPOSED CHANGE License Amendment Request TSCR-136 -Cyber Security Plan Implementation Schedule Milestone Change 1.0

SUMMARY

DESCRIPTION

2.0 DETAILED

DESCRIPTION

3.0 TECHNICAL

EVALUATION

4.0 REGULATORY EVALUATION

4.1 APPLICABLE

REGULATORY REQUIREMENTS/CRITERIA

4.3 SIGNIFICANT

SAFETY HAZARDS CONSIDERATION

4.4 CONCLUSION

5.0 ENVIRONMENTAL

CONSIDERATION

6.0 REFERENCES

rtlis aU3YtlR1enl centains sSGwrity related information*

Sections 1.0, 2.0 and 3.0 public k p.c SECURITY-RELATED INFORMATION FROM PUBLIC DISClQSURi UNDfiR 10 CFR 2.390 Attachment 1 to NG-12-0207 P-,(. Page 1 of 5 1.0

SUMMARY

DESCRIPTION " --_. -'0' _ 2.0 DETAILED DESCRIPTION

-I ! ' 3.0 TECHNICAL EVALUATION

!This attacnmGnt contains seewrity.relaros information*

Seotions 1.0, 2.0 ane 3.0 are withheld from pwblie EliselosYFe per 10 CFR 2.390 1 SECURITY*

RElJl.TED INfORMATION WITHHOLD FROM PUBLIC IlISC:lOSURi UNDER 10 CFR 2.390 Attachment 1 to AE T\'" Page2of5 This attaGRFAeRt G9RtaiR&

related inforFAation

-SeGtiQn& 1.0,2.0 and 3.0 aPe withheJe frem "uaUe eiselos\i,e per 10 CFR 2.390 Attachment 1 to NG-12-0207 Page 3 of 5

4.0 REGULATORY EVALUATION

4.1 APPLICABLE

REGULATORY REQUIREMENTS/CRITERIA 10 CFR 73.54 requires licensees to maintain and implement a cyber security plan. DAEC Facility Operating License No. DPR-49 includes a Physical Protection license condition that requires NextEra Energy Duane Arnold to fully implement and maintain in effect all provisions of the Commission-approved cyber security plan, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54{p).

4.2 Precedent

Amendment No. 203 (Reference

5) approved an implementation schedule using the NEI template (Reference 3), with the exception of milestone 6 for the Callaway Plant. The Callaway Plant deviated from the template for milestone 6 to address only the NEI 08-09, Revision 6, Appendix D technical controls, excepting for the operational and management controls, on the basis that implementing the technical controls for the target set CDAs provides a high degree of protection against cyber related attacks that could lead to radiological sabotage.

The changes being proposed by NextEra Energy Duane Arnold in this amendment request are similar to those approved in the Callaway Plant Amendment No. 203. 4.3 SIGNIFICANT HAZARDS CONSIDERATION NextEra Energy Duane Arnold is requesting an amendment to the DAEC Facility Operating License to revise the Physical Protection license condition as it relates to the cyber security plan. This change includes a proposed deviation to the scope of a Cyber Security Plan Implementation Schedule milestone and a proposed revision to the DAEC Facility Operating License to include the proposed deviation.

Specifically, NextEra Energy Duane Arnold proposes a change to the scope of implementation milestone 6 to apply to only technical cyber security controls.

NextEra Energy Duane Arnold has evaluated whether or not a significant hazards consideration is involved with the proposed amendment by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below: Does the proposed amendment involve a significant increase in the probability or consequences of an accident previously evaluated?

Response:

No. The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. This change does not alter accident analysiS assumptions, add any accident initiators, or affect the function of plant systems or the manner in Attachment 1 to NG-12-0207 Page 4 of 5 which systems are operated, maintained, modified, tested, or inspected.

The proposed change does not require any plant modifications that affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and has no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response:

No. The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. This proposed change does not alter accident analysis assumptions, add any accident initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected.

The proposed change does not require any plant modifications that affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated. Does the proposed amendment involve a significant reduction in a margin of safety? Response:

No. Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications.

The proposed change to the Cyber Security Plan Implementation Schedule is administrative in nature. Because there is no change to these established safety margins as result of this change, the proposed change does not involve a significant reduction in a margin of safety. Therefore, the proposed change does not involve a significant reduction in a margin of safety. Based on the above, NextEra Energy Duane Arnold concludes that the proposed change presents no Significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and accordingly, a finding of " no significant hazards consideration" is justified.

Attachment 1 to NG-12-0207 Page 5 of 5

4.4 CONCLUSION

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. 5.0 ENVIRONMENTAL CONSIDERATION The proposed amendment provides a change to the Cyber Security Plan Implementation Schedule.

The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12).

Therefore, pursuant to 10 CFR 51.22(b) no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 REFERENCES

Letter from K. Feintuch, NRC. to C. Costanzo.

NextEra Energy Duane Arnold, "Issuance of Amendment Pertaining to Cyber Security Plan (TAC NO. ME4287)," dated July 29. 2011. (ML 111940224) Letter from C. Costanzo, NextEra Energy Duane Arnold to NRC, "Response to Request for Additional Information and Submittal of TSCR-121 C Supplement to License Amendment Request for Approval of the Duane Arnold Energy Center/NextEra Energy Duane Arnold, LLC Cyber Security Plan," dated April 5, 2011. (ML 110950546) Letter from Chris Earls (NEI) to Richard P. Correia (NRC). "Template for the Cyber Security Plan Implementation Schedule," dated February 28,2011. (ML 110600211) Letter from Richard P. Correia (NRC) to Chris Earls (NEI), 'Template for the Cyber Security Plan Implementation Schedule," dated March 1, 2011. (ML 110070348) Letter from M.C. Thadani, NRC, to A. C. Heflin, Union Electric Company, "Callaway Plant. Unit 1 -Issuance of Amendment Re: Approval of Cyber Security Plan (TAC NO. ME4536)," dated August 17,2011. (ML 112140087)

PROPOSED DAEC OPERATING LICENSE 1 Page Follows ... _----_._---

and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21. is entitled: "Duane Arnold Energy Center Physical Security Plan." submitted by letter dated May 16, 2006. NextEra Energy Duane Amold. LLC shall fully implement and maintain in effect all provisions of Commission-approved Duane Arnold Energy Center/NextEra Energy Duane Arnold. LLC Security Plan (CSP). including changes made pursuant to the authority of 10 CFR 50.90 10 CFR 50.54(p).

The Duane Amold Energy Center/NextEra Energy Duane Arnold, LLC CSP approved by License Amendment No. 278, as supplemented by a change approved by Amendment No. Deleted Additional Conditions The Additional Conditions contained in Appendix S, as revised through Amendment No. 260, are hereby incorporated into this license. NextEra Energy Duane Arnold, LLC shall operate the facility in accordance with the Additional Conditions. The licensee is authorized to revise the Updated Final Safety Analysis Report by deleting the footnote for Section 9.1.4.4.5 which states: *'The NRC has not endorsed the reactor building crane as single-failure proof (Reference 9)," and by deleting Reference 9 of the references for Section 9.1. Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and include the following key Fire fighting response strategy with the following elements: Pre-defined coordinated fire response strategy and guidance Assessment of mutual aid fire fighting assets Designated staging areas for equipment and materials Command and control Training of response personnel Operations to mitigate fuel damage considering the following: Protection and use of personnel assets Communications Minimizing fire spread Procedures for implementing integrated fire response strategy Identification of readily-available pre-staged equipment Training on integrated fire response strategy Spent fuel pool mitigation measures Actions to minimize release to include consideration of: Water spray scrubbing Dose to onsite responders The licensee shall implement and maintain all Actions required by Attachment 2 to NRC Order EA-06-137, issued June 20, 2006, except the last action that requires incorporation of the strategies into the site security plan, contingency plan, emergency plan and/or guard training and qualification plan, as appropriate.

Renewed License No. DPR-49 Amendment 2+8 ATTACHMENT PROPOSED DAEC OPERATING LICENSE 1 Page Follows

-4 and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21. is entitled: "Duane Arnold Energy Center Physical Security Plan," submitted by letter dated May 16.2006. NextEra Energy Duane Arnold, LLC shall fully implement and maintain in effect all provisions of the Commission-approved Duane Arnold Energy Center/NextEra Energy Duane Arnold. LLC Cyber Security Plan (CSP). including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The Duane Arnold Energy Center/NextEra Energy Duane Arnold. LLC CSP was approved by License Amendment No. 278, as supplemented by a change approved by License Amendment No. (6) Deleted (7) Additional Conditions The Additional Conditions contained in Appendix B, as revised through Amendment No. 260, are hereby incorporated into this license. NextEra Energy Duane Arnold. LLC shall operate the facility in accordance with the Additional Conditions.

(8) The licensee is authorized to revise the Updated Final Safety Analysis Report by deleting the footnote for Section 9.1.4.4.5 which states: "*The NRC has not endorsed the reactor building crane as failure proof (Reference 9)," and by deleting Reference 9 of the references for Section 9.1. (9) Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas: (a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance 2. Assessment of mutual aid fire fighting assets 1. DeSignated staging areas for equipment and materials

2. Command and control 3. Training of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets 2. Communications

3. Minimizing fire spread 4. Procedures for implementing integrated fire response strategy 5. Identification of readily-available pre-staged equipment

4. Training on integrated fire response strategy 5. Spent fuel pool mitigation measures (c) Actions to minimize release to include consideration of: 1. Water spray scrubbing

2. Dose to onsite responders The licensee shall implement and maintain al\ Actions required by Attachment 2 to NRC Order EA-06-137.

issued June 20.2006, except the last action that requires incorporation of the strategies into the site security plan. contingency plan. emergency plan and/or guard training and qualification plan, as appropriate.

Renewed License No. DPR-49 Amendment

, THIS ATTAeflMENT CONTAINS SeetJRITY*

REt:ATED wtTHHOl:l:>"FROM PtJBI:1e f)iSCt:eStJRE UNDER 10 eFR 2.390 ATTACHMENT 4 NG-12-0207 P-.E DAD Revised Milestone 6 of the Cyber Security Plan Implementation Schedule KED A PAGE I (IF I TWA T FO(Col-) S' J S' Rt;mD V 6}) This attachment GontainS-SeGurity-related WitRR91e Eiisclaswre uAde, 4 G SFR TE";)

Attachment Regulatory Attachment 5 to NG-12-0207 Page 1 of 1 Regulatory Obligation The following table identifies the actions committed to by NextEra Energy Duane Arnold in this document.

Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments or obligations.

TYPE SCHEDULED 1 OBLIGATION ONE* TIME ACTION CONTINUING COMPLIANCE COMPLETION DATE I I NextEra Energy Duane Arnold will implement milestones 1, 2, 3, 4, 5, and 7 described in Enclosure 4 of X December 31, 2012 letter dated April 5, 2011, and the revised Milestone 6 in Attachment 4 of this submittal.