CP-201400165, (CPNPP) - Redacted Version of License Amendment Request (LAR) 13-003, for Approval of the Revised CPNPP Cyber Security Plan Implementation Schedule

(CPNPP) - Redacted Version of License Amendment Request (LAR)13-003, for Approval of the Revised CPNPP Cyber Security Plan Implementation Schedule

ML14051A531
Person / Time
Site:	Comanche Peak
Issue date:	02/04/2014
From:	Thomas McCool Luminant Generation Co, Luminant Power
To:	Document Control Desk, Office of Nuclear Material Safety and Safeguards, Office of Nuclear Reactor Regulation
References
CP-201400165, LAR 13-003, TXX-14021
Download: ML14051A531 (24)

Text

Rafael Flores Luminant Power Senior Vice President P.O. Box 1002

& Chief Nuclear Officer 6322 North FM 56 rafael.flores@luminant.com Glen Rose, TX 76043 Luminant T 254 897 5590 C 817 559 0403 F 254 897 6652 CP-201400165 Ref: 10 CFR 50.90 Log # TXX-14021 February 4, 2014 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

COMANCHE PEAK NUCLEAR POWER PLANT (CPNPP)

DOCKET NOS. 50-445, 50-446 and 72-74 REDACTED VERSION OF LICENSE AMENDMENT REQUEST (LAR)13-003, FOR APPROVAL OF THE REVISED CPNPP CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE

REFERENCE:

1) Letter logged TXX-13168 dated November 21, 2013, from Rafael Flores to the NRC, "License Amendment Request (LAR)13-003, for Approval of the Revised CPNPP Cyber Security Plan Implementation Schedule"

Dear Sir or Madam:

With the letter in Reference 1, Luminant Generation Company LLC (Luminant Power) submitted License Amendment Request (LAR)13-003 to propose a change to the CPNPP Cyber Security Plan Milestone 8 full implementation date. With this submittal, Luminant Power provides a redacted version of LAR 13-003. The redacted version of the LAR does not contain security related information (SRI) and is suitable for public disclosure.

The Enclosure with this letter contains the redacted version of the Description and Assessment that was included as Attachment 1 to the Reference 1 letter. The redacted version of the Description and Assessment does not contain security related information. The Enclosure with this letter also includes copies of Attachments 2 and 3 from the Reference 1 letter, which are not SRI documents.

The CPNPP Cyber Security Plan Implementation Schedule was enclosed with the Reference 1 submittal.

The implementation schedule in aggregate is security related information and is not included with this submittal.

A member of the STARS Alliance Callaway - Comanche Peak - Diablo Canyon

• Palo Verde

• Wolf Creek

U. S. Nuclear Regulatory Commission T)X(-14021 Page 2 of 2 02/04/2014 This communication contains no new licensing basis commitments regarding Comanche Peak Units 1 and 2 or the Independent Spent Fuel Storage Installation.

Should you have any questions, please contact Jim Barnette at (254) 897-5866 or James.barnette@luminant.com.

Sincerely, Luminant Generation Company, LLC Rafael Flores By: __ _ _ _ _ _ _ _ _ _ _ _

Thomas P.Mcc~ol Vice President, Station Support Enclosure - Attachments from TXX-13168, CPNPP LAR 13-003 c - Marc L. Dapas, Region IV B. K. Singal, NRR Resident Inspectors, Comanche Peak Helen Watkins Inspection Unit Manager Texas Department of State Health Services PO Box 149347 Austin TX 78714-9347

ENCLOSURE with TXX-14021 Attachments from TXX-13168, CPNPP LAR 13-003 to TXX-13168, Description and Assessment (Redacted) to TXX-13168, Proposed Facility Operating License Changes (Mark-Up) to TXX-13168, Retyped Facility Operating License Changes

Security Related- hnform-ationp Withhold unifdepr 10 C-FR 2.390 ATTACHMENT 1 to TXX-13168 DESCRIPTION AND ASSESSMENT Redact edl

..... :*.. T)^1^*-*,-1 T*^*-" xxr.tt,-14 i in fcmn inn('% to TXX-1 3168 Page 1 of 14 11/21/2013 LICENSEE'S EVALUATION

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration 5.2 Applicable Regulatory Requirements/Criteria

6.0 ENVIRONMENTAL CONSIDERATION

7.0 PRECEDENTS

8.0 REFERENCES

. . T'i

. 11) 1^ *, T

• T., 1 1 13 -1 An aCCUA"' 4Q. 4-W- V-4-41k ý --4 to TXX-1 3168 Page 2 of 14 11/21/2013

1.0 DESCRIPTION

By this letter, Luminant Generation Company LLC (Luminant Power) requests an amendment to the Comanche Peak Nuclear Power Plant (CPNPP) Unit 1 Operating License (NPF-87) and CPNPP Unit 2 Operating License (NPF-89) by incorporating the attached change into the CPNPP Unit 1 and 2 Facility Operating License (FOL). License Amendment Request (LAR)13-003 is a request to revise the Operating Licenses (OLs) for Comanche Peak Nuclear Power Plant Units 1 and 2.

No changes to the CPNPP Final Safety Analysis Report are anticipated at this time as a result of this License Amendment Request.

2.0 PROPOSED CHANGE

LAR 13-003 proposes a change to the CPNPP Cyber Security Plan (CSP) full implementation date (Milestone 8) as set forth in the CPNPP Cyber Security Plan Implementation Schedule. The LAR proposes additional text that will add the FOL amendment number for this LAR to the existing cyber security license condition in Paragraph 2.H of Facility Operating License Nos. NPF-87 and NPF-89 for CPNPP Units 1 and 2 respectively.

3.0 BACKGROUND

Cyber security requirements are codified in 10 CFR 73.54 and are designed to provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v). 10 CFR 73.54 specifically requires operating licensees implement a cyber security plan (CSP) that satisfies the requirements of the Rule in accordance with an NRC approved cyber security plan implementation schedule.

On July 26, 2011, the NRC issued amendments to the CPNPP Unit 1 and Unit 2 FOLs (Reference 8.2) in response to CPNPP LAR 10-002 dated July 15, 2010, as supplemented by letters dated September 27 and November 30, 2010, and March 31, 2011 (References 8.3, 8.4, 8.5). The FOL amendments approved the CPNPP Cyber Security Plan and associated implementation schedule, and revised paragraph 2.H of the FOLs to provide a license condition to require CPNPP to fully implement and maintain in effect all provisions of the NRC-approved Cyber Security Plan. Any change to the NRC-approved CSP implementation schedule requires prior NRC approval pursuant to 10 CFR 50.90.

Security Related nfoQr"mation- Withhold under 10 CFR 2.390 to TXX-1 3168 Page 3 of 14 11/21/2013 The first seven milestones of the CPNPP Cyber Security Implementation Plan and the NRC "Good Faith Letter" action items are complete. Higher priority activities are planned for completion by the current Milestone 8 date. Implementation of the remainder of the cyber security implementation plan will require an extension of the Milestone 8 full implementation date.

4.0 TECHNICAL ANALYSIS

The following teclhical analysis provides information concerning eight criteria that serves to explain the current status of the CPNPP cyber security program and the need for the Milestone 8 date revision. The analysis describes how prioritization of CPNPP's completed and planned implementation actions will provide assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v), until the full program is implemented by the proposed date.

Security Related Info-mation- Withhold under 10 CFR 2.390 to TXX-13168 Page 4 of 14 11/21/2013

Necurity iteateci miormatioa- witnnola unaer i II 59 to TXX-13168 Page 5 of 14 11/21/2013

Security Related-nformation Withhold under 10 CFR 2.390 to TXX-1 3168 Page 6 of 14 11/21/2013

Security Related Inforaton- Withhold under 10 CFR 2.390 to TXX-1 3168 Page 7 of 14 11/21/2013

Securit, Related -Inf-ormation- Withhold under 1-0 CFR 2.390 to TXX-1 3168 Page 8 of 14 11/21/2013

Security Related Infonvation Withhold under 10 CFPR 2.390 to TXX-13168 Page 9 of 14 11/21/2013

Security Related nforat.n- With!hold under 1-0 CFR 2.390 to TXX-1 3168 Page 10 of 14 11/21/2013

Security Re lated ,If-a'tion_WV ithholdl undeor 1-0 CFR 2.390 to TXX-1 3168 Page 11 of 14 11/21/2013

Security Related nfrm.ation- Withhold under- 10 CFR 2.390 Attachment I to TXX-13168 Page 12 of 14 11/21/2013

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration Luminant Power has evaluated whether or not a significant hazards consideration is involved with the proposed amendment(s) by focusing on the three standards set forth in 10 CFR 50.92, "Issuance of amendment," as discussed below:

1. Do the proposed changes involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No The amendment proposes a change to the CPNPP Cyber Security Plan (CSP)

Milestone 8 full implementation date as set forth in the CPNPP Cyber Security Plan Implementation Schedule. The revision of the full implementation date for the CPNPP Cyber Security Plan does not involve modifications to any safety-related structures, systems or components (SSCs). Rather, the implementation schedule provides a timetable for fully implementing the CPNPP CSP. The CSP describes how the requirements of 10 CFR 73.54 are to be implemented to identify, evaluate, and mitigate cyber attacks up to and including the design basis cyber attack threat, thereby achieving high assurance that the facility's digital computer and communications systems and networks are protected from cyber attacks. The revision of the CPNPP Cyber Security Plan Implementation Schedule will not alter previously evaluated design basis accident analysis assumptions, add any accident initiators, modify the function of the plant safety-related SSCs, or affect how any plant safety-related SSCs are operated, maintained, modified, tested, or inspected.

Therefore, the proposed changes do not involve a significant increase in the probability or consequences of an accident previously evaluated.

Security Related Informnation- Withhold under 10 CFER 2.390 to TXX-1 3168 Page 13 of 14 11/21/2013

2. Do the proposed changes create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No The implementation of the CPNPP Cyber Security Plan does not introduce new equipment that could create a new or different kind of accident, and no new equipment failure modes are created. No new accident scenarios, failure mechanisms, or limiting single failures are introduced as a result of this proposed amendment.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any previously evaluated.

3. Do the proposed changes involve a significant reduction in a margin of safety?

Response: No The margin of safety is associated with the confidence in the ability of the fission product barriers (i.e., fuel cladding, reactor coolant pressure boundary, and containment structure) to limit the level of radiation to the public. The proposed amendment does not alter the way any safety-related SSC functions and does not alter the way the plant is operated. The Cyber Security Plan provides assurance that safety-related SSCs are protected from cyber attacks. The proposed amendment does not introduce any new uncertainties or change any existing uncertainties associated with any safety limit. The proposed amendment has no effect on the structural integrity of the fuel cladding, reactor coolant pressure boundary, or containment structure. Based on the above considerations, the proposed amendment would not degrade the confidence in the ability of the fission product barriers to limit the level of radiation to the public.

Therefore the proposed change does not involve a reduction in a margin of safety.

Based on the above evaluations, Luminant Power concludes that the proposed amendment(s) present no significant hazards under the standards set forth in 10CFR50.92(c) and, accordingly, a finding of "no significant hazards consideration" is justified.

5.2 Applicable Regulatory Requirements/Criteria The Cyber Security Plan and associated implementation schedule for CPNPP Units I and 2 were approved by the NRC on July 26, 2011 via License Amendment Request 10-002.

The license amendment revised paragraph 2.H of the FOL to provide a license condition to require CPNPP to fully implement and maintain in effect all provisions of the NRC-approved Cyber Security Plan. Any change to the NRC-approved CSP implementation schedule requires prior NRC approval pursuant to 10 CFR 50.90.

In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that

Attachment i to TXX-1 3168 Page 14 of 14 11/21/2013 the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

6.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment revises the Milestone 8 full implementation date for the CPNPP Unit 1 and Unit 2 Cyber Security Plan. This proposed amendment will not involve any significant construction impacts. Pursuant to 10 CFR 51.22(c)(12), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

7.0 PRECEDENTS None

8.0 REFERENCES

8.1 Letter logged TXX-10097 dated July 15, 2010, from Rafael Flores to the NRC submitting License Amendment Request (LAR)10-002, for approval of the CPNPP Cyber Security Plan 8.2 Letter from the NRC to Rafael Flores dated July 26, 2011, approving the CPNPP Cyber Security Plan and proposed Cyber Security Plan Implementation Schedule 8.3 Letter logged TXX-10138 dated September 27, 2010, from Rafael Flores to the NRC, "Notification Letter Designating Comanche Peak Nuclear Power Plant (CPNPP) Balance of Plant Systems Within the Cyber Security Rule Scope" 8.4 Letter logged TXX-10155 dated November 30, 2010, from Rafael Flores to the NRC, "Update to Notification Letter Designating Comanche Peak Nuclear Power Plant (CPNPP) Balance of Plant Systems Within the Cyber Security Rule Scope" 8.5 Letter logged TXX-11043 dated March 31, 2011, from Rafael Flores to the NRC, "Response to the Request for Additional Information Regarding Revision to the Facility Operating License and Request for Review and Approval of the Cyber Security Plan (Tac Nos. ME4251 And ME4252)"

8.6 NEI 08-09, Revision 6, April 2010, "Cyber Security Plan for Nuclear Power Reactors."

8.7 Memorandum dated July 1, 2013 from Barry Westreich of the Cyber Security Directorate to Tom Blount, Director, Division of Reactor Safety, Region IV, "Enhanced Guidance for Licensee Near-Term Corrective Actions to Address Cyber Security Inspection Findings and Licensee Eligibility for 'Good-Faith' Attempt Discretion"

ATTACHMENT 2 to TXX-13168 PROPOSED FACILITY OPERATING LICENSE CHANGES (MARK-UP)

Pages 8 (Unit 1) 8 (Unit 2)

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, guard training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the Office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

Luminant Generation Company LLC CSP was approved by License Amendment No. 155.

I. The li ensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of t Atomic Energy Act of 1954, as amended, to cover public liability claims.

J. NT USED K. his license is effective as of the date of issuance and shall expire at Midnight on ebruary 2, 2033.

as supplemented by a change approved FOR THE NUCLEAR REGULATORY COMMISSION by License Amendment No. XXX original signed by:

Thomas E. Murley, Director Office of Nuclear Reactor Regulation Attachments/Appendices:

1. Appendix A - Technical Specifications (NUREG-1468)

2. Appendix B - Environmental Protection Plan

3. Appendix C - Antitrust Conditions Date of Issuance: April 6, 1993 Unit 2 Amendment No. 68, 82, 80, 00, 13, 155 Revised by letter dated July 26, 2007

(3) Luminant Generation Company LLC shall promptly notify the NRC of any attempts by subsurface mineral rights owners to exercise mineral rights, including any legal proceeding initiated by mineral rights owners against Luminant Generation Company LLC.

G. Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24, subject to the following provision:

Luminant Generation Company LLC may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). Luminant Generation Company LLC CSP was approved by License Amendment No. 155.

The licensees shall have and maintain financial protection of such type and n such amounts as the Commission shall require in accordance with Sectio 170 of the Atomic Energy Act of 1954, as amended, to cover public liability ims.

J. NOT USED

, as supplemented by a change approved by License Amendment XXX Unit 1 Amendment No. 68, 82, 90, 139, 155 Revised by letter dated March 15, 2007

ATTACHMENT 3 to TXX-13168 RETYPED FACILITY OPERATING LICENSE CHANGES Pages 8 (Unit 1) 8 (Unit 2)

(3) Luminant Generation Company LLC shall promptly notify the NRC of any attempts by subsurface mineral rights owners to exercise mineral rights, including any legal proceeding initiated by mineral rights owners against Luminant Generation Company LLC.

G. Luminant Generation Company LLC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment 78 and as approved in the SER (NUREG-0797) and its supplements through SSER 24, subject to the following provision:

Luminant Generation Company LLC may make changes to the approved fire protection program without prior approval of the Commission only ifthose changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). Luminant Generation Company LLC CSP was approved by License Amendment No. 155, as supplemented by a change approved by License Amendment XXX.X The licensees shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

J. NOT USED Unit 1 Amendment No. 68, 82, 90, 139,1*5,

H. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the physical security, guard training and qualification, and safeguards contingency plans, previously approved by the Commission, and all amendments made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain safeguards information protected under 10 CFR 73.21, are entitled: "Comanche Peak Steam Electric Station Physical Security Plan" with revisions submitted through May 15, 2006, with limited approvals as provided for in the Safety Evaluation by the Office of Nuclear Reactor Regulation dated December 5, 2000; "Comanche Peak Steam Electric Station Security Training and Qualification Plan" with revisions submitted through May 15, 2006; and "Comanche Peak Steam Electric Station Safeguards Contingency Plan" with revisions submitted through May 15, 2006. Luminant Generation Company LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

Luminant Generation Company LLC CSP was approved by License Amendment No. 155, as supplemented by a change approved by License Amendment No.

XXX.

1. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

J. NOT USED K. This license is effective as of the date of issuance and shall expire at Midnight on February 2, 2033.

FOR THE NUCLEAR REGULATORY COMMISSION original signed by:

Thomas E. Murley, Director Office of Nuclear Reactor Regulation Attachments/Appendices:

1. Appendix A - Technical Specifications (NUREG-1468)

2. Appendix B - Environmental Protection Plan

3. Appendix C - Antitrust Conditions Date of Issuance: April 6, 1993 Unit 2 Amendment No. 68, 82,89, 90, 139, 155,