ML12279A250
| ML12279A250 | |
| Person / Time | |
|---|---|
| Site: | Wolf Creek  |
| Issue date: | 12/12/2012 |
| From: | Lyon C Plant Licensing Branch IV |
| To: | Matthew Sunseri Wolf Creek |
| Benney B | |
| References | |
| TAC ME8898 | |
| Download: ML12279A250 (12) | |
Text
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 December 12, 2012 Mr. Matthew W. Sunseri President and Chief Executive Officer Wolf Creek Nuclear Operating Corporation Post Office Box 411 Burlington, KS 66839
SUBJECT:
WOLF CREEK GENERATING STATION -ISSUANCE OF AMENDMENT RE:
REVISED CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE MILESTONE 6 (TAC NO. ME8898)
Dear Mr. Sunseri:
The Nuclear Regulatory Commission has issued the enclosed Amendment No. 202 to Renewed Facility Operating License No. NPF-42, for the Wolf Creek Generating Station. The amendment consists of changes to the renewed facility operating license in response to your application dated June 13, 2012.
The amendment revises the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone #6 and paragraph 2.E of the renewed facility operating license. The amendment modifies the scope of Milestone #6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, would be implemented concurrent with the full implementation of the cyber security program (Milestone #8). Thus, all CSP activities would be fully implemented by the completion date, currently identified in Milestone #8 of the licensee's CSP implementation schedule.
A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.
Docket No. 50-482
Enclosures:
- 1. Amendment No. 202 to NPF-42
- 2. Safety Evaluation cc w/encls: Distribution via Listserv
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 WOLF CREEK NUCLEAR OPERATING CORPORATION WOLF CREEK GENERATING STATION DOCKET NO. 50-482 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 202 License No. NPF-42
- 1. The Nuclear Regulatory Commission (the Commission) has found that:
A. The application for amendment to the Wolf Creek Generating Station (the facility)
Renewed Facility Operating License No. NPF-42 filed by the Wolf Creek Nuclear Operating Corporation (the Corporation), dated June 13, 2012, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this license amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.
Enclosure 1
-2
- 2. Accordingly, the license is amended as indicated in the attachment to this license amendment and Paragraph 2.E of Renewed Facility Operating License No. NPF-42 is hereby amended to read as follows:
E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}. The set of combined plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Wolf Creek Security Plan, Training and Qualification Plan, and Safeguard Contingency Plan," and was submitted on May 17, 2006.
The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 197, as supplemented by a change approved by License Amendment No. 202.
- 3. This license amendment is effective as of the date of its issuance and shall be implemented by December 31,2012.
FOR THE NUCLEAR REGULATORY COMMISSION
~~,M~
Michael T. Markley, Chief Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
Attachment:
Changes to the Renewed Facility Operating License Date of issuance: December 12, 2012
AITACHMENT TO LICENSE AMENDMENT NO. 202 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-42 DOCKET NO. 50-482 Replace the following page of the Renewed Facility Operating License No. NPF-42 with the attached revised page. The revised page is identified by amendment number and contains marginal lines indicating the areas of change.
Facility Operating License Remove 7 7
7 (16) Additional conditions The Additional Conditions contained in Appendix D, as revised through Amendment No. 179, are hereby incorporated into this license. Wolf Creek Nuclear Operating Corporation shall operate the facility in Accordance with the Additional Conditions.
D. Exemptions from certain requirements of Appendix J to 10 CFR Part 50, and from a portion of the requirements of General Design Criterion 4 of Appendix A to 10 CFR Part 50, are described in the Safety Evaluation Report. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. Therefore, these exemptions are hereby granted pursuant to 10 CFR 50.12. With the granting of these exemptions the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.
E. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The set of combined plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Wolf Creek Security Plan, Training and Qualification Plan, and Safeguard Contingency Plan,"
and was submitted on May 17, 2006.
The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 197, as supplemented by a change approved by License Amendment No. 202.
F. Deleted per Amendment No. 141.
G. The licensees shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.
H. The Updated Safety Analysis Report (USAR) supplement, as revised, submitted pursuant to 10 CFR 54.21 (d), shall be included in the next scheduled update to the USAR required by 10 CFR 50.71 (e)(4), as appropriate, following the issuance of this renewed operating license. Until that update is complete, WCNOC may make changes to the programs and activities described in the supplement without prior Commission approval, provided that WCNOC evaluates such changes pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.
Renewed License No. NPF-42 Amendment No. 179, 197,202
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 202 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-42 WOLF CREEK NUCLEAR OPERATING CORPORATION WOLF CREEK GENERATING STATION DOCKET NO. 50-482
1.0 INTRODUCTION
By application dated June 13, 2012 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12172A291), Wolf Creek Nuclear Operating Corporation (WCNOC, the licensee), requested changes to the Renewed Facility Operating License for Wolf Creek Generating Station (WCGS). The proposed change would revise the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone #6 and the existing license condition in the facility operating licenses. Milestone #6 of the CSP implementation schedule concerns the identification, documentation, and implementation of cyber security controls (technical, operational, and management) for critical digital assets (CDAs) related to target set equipment.
WCNOC is requesting to modify the scope of Milestone #6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, would be implemented concurrent with the full implementation of the Cyber Security Program (Milestone #8). Thus, all CSP activities would be fully implemented by the completion date, identified in Milestone #8 of the licensee's CSP implementation schedule.
2.0 REGULATORY EVALUATION
The U.S. Nuclear Regulatory Commission (NRC) staff reviewed and approved the licensee's eXisting CSP implementation schedule by License Amendment No. 197 dated July 27,2011 (ADAMS Accession No. ML111990339), concurrent with the incorporation of the CSP into the facility current licensing basis. The NRC staff considered the following regulatory requirements and guidance in its review of the current license amendment request to modify the existing CSP implementation schedule:
- Title 10 of the Code of Federal Regulations (10 CFR) 73.54, which states: "Each
[CSP] submittal must include a proposed implementation schedule.
Implementation of the licensee's cyber security program must be consistent with the approved schedule."
Enclosure 2
- 2
- The licensee's Renewed Facility Operating License includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.
- Amendment No. 197, dated July 27,2011, which approved the licensee's CSP and implementation schedule, included the following statement: "The implementation of the cyber security plan (CSP), including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee on April 1, 2011, and approved by the NRC staff with this license amendment. All subsequent changes to the NRC-approved CSP implementation schedule will require prior NRC approval pursuant to 10 CFR 50.90."
- In a letter to the NEI dated March 1,2011 (ADAMS Accession No. ML110070348),
the NRC staff acknowledged that the cyber security implementation schedule template was "written generically and licensees that use the template to develop their proposed implementation schedules may need to make changes to ensure the submitted schedule accurately accounts for site-specific activities."
3.0 TECHNICAL EVALUATION
3.1 Background As discussed in Section 2.0, the NRC staff approved Amendment No. 197 to the Renewed Facility Operating License No. NPF-42 for WCGS on July 27,2011. The NRC staff also approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with the amendments. The implementation schedule had been submitted by the licensee based on a template prepared by NEI, which the NRC staff found acceptable for licensees to use in developing their CSP implementation schedules (ADAMS Accession No. ML110600218). The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones:
- 1) Establish the Cyber Security Assessment Team;
- 2) Identify Critical Systems and CDAs;
- 3) Install a deterministic one-way device between lower level devices and higher level devices;
- 4) Implement the security control "Access Control For Portable And Mobile Devices";
- 5) Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements;
-3
- 6) Identify, document, and implement cyber security controls as per "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment;
- 7) Commence ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented;
- 8) Fully implement the CSP.
3.2 Licensee's Proposed Changes Currently, Milestone #6 of the WCGS's CSP requires WCNOC to identify, document, and implement cyber security controls for CDAs that could adversely impact the design function of physical security target set equipment by December 31, 2012. These cyber security controls consist of technical, operational and management security controls. In its application dated June 13, 2012, WCNOC proposed to modify Milestone #6 to change the scope of the cyber security controls due to be implemented on December 31, 2012, to include only the NEI 08-09, Revision 6, Appendix D technical security controls. WCNOC proposes to amend its CSP to provide that operational and management security controls, identified in Milestone #6, will be fully implemented at a later date, which is the completion date identified in Milestone #8 of the CSP implementation schedule. The licensee stated that implementing the technical cyber security controls for target set CDAs provides a high degree of protection against cyber-related attacks that could lead to radiological sabotage. The licensee further stated that many of its existing programs are primarily procedure-based and must be implemented in coordination with the comprehensive Cyber Security Program. The licensee also stated that the existing programs (e.g., physical protection, maintenance, configuration management, and operating experience) currently in place at WCGS, provide sufficient operational and management of cyber security protection during the interim period until the Cyber Security Program is fully implemented.
3.3 Detailed Description of Changes Current paragraph 2.E of Renewed Facility Operating License NPF-42 states that The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The set of combined plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Wolf Creek Security Plan, Training and Qualification Plan, and Safeguard Contingency Plan,"
and was submitted on May 17, 2006.
The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made
-4 pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 197.
Revised paragraph 2.E of Renewed Facility Operating License NPF-47 would state that The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The set of combined plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Wolf Creek Security Plan, Training and Qualification Plan, and Safeguard Contingency Plan,"
and was submitted on May 17, 2006.
The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee's CSP was approved by License Amendment No. 197, as supplemented by a change approved by License Amendment No. 202.
3.4 NRC Staff Evaluation The intent of the cyber security implementation schedule was for licensees to demonstrate ongoing implementation of their cyber security program prior to full implementation, which is set for the date specified in Milestone #8. In addition to Milestone #6 and its associated activities, licensees will be completing six other milestones (Milestones #1 through #5, and Milestone #7) by December 31, 2012. Activities include establishing a Cyber Security Assessment Team, identifying critical systems and CDAs, installing deterministic one-way devices between defensive levels, implementing access control for portable and mobile devices, implementing methods to observe and identify obvious cyber-related tampering, and conducting ongoing monitoring and assessment activities for target set CDAs. In their aggregate, the interim milestones demonstrate ongoing implementation of the cyber security program at WCGS.
The NRC staff has reviewed the licensee's evaluation of the proposed changes in its submittal dated June 13, 2012, and concludes that by completing Milestones #1 through 5, Milestone #6 with implementation of technical controls to target set CDAs, and Milestone #7, WCGS will have an acceptable level of cyber security protection until full program implementation is achieved.
Technical cyber security controls include access controls, audit and accountability, CDA and communications protection, identification and authentication, and system hardening. These controls are executed by computer systems. as opposed to people, and consist of hardware and software controls that provide automated protection to a system or application. Implementation of technical cyber security controls promotes standardization, trust, interoperability, connectivity, automation, and increased efficiency. For these reasons, the NRC staff concludes that the licensee's approach is acceptable.
- 5 The NRC staff also recognizes that full implementation of operational and management cyber security controls in accordance with requirements of the WCGS CSP will be achieved with full implementation of the Cyber Security Program by the date set in Milestone #8. That is, all required elements for the operational and management cyber security controls in accordance with the WCGS CSP will be implemented in their entirety at the time of full CSP implementation.
The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and full implementation date, shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. Thus, all subsequent changes to the NRC-approved CSP implementation schedule will require prior NRC approval pursuant in 10 CFR 50.90.
3.5 Summary Based on its review of the licensee's submissions, the NRC staff concludes that the proposed changes to Milestone #6 of the licensee's CSP implementation schedule are acceptable. The NRC staff also concludes that, upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff concludes that the proposed changes are acceptable.
4.0 REGULATORY COMMITMENT In its letter dated June 13, 2012, WCNOC made the following regulatory commitment:
Identify, document, and implement NEI 08-09, Revision 6, Appendix D technical cyber security controls in accordance with the Cyber Security Plan Section 3.1.6 "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for target set CDAs that could adversely impact the design fUnction of physical security target set equipment The NRC staff concludes that reasonable controls for the implementaJi.Qn and for subsequent evaluation of proposed changes pertaining to the above regulatory commitment is best provided by the licensee's administrative processes, including its commitment management program.
The above regulatory commitment does not warrant the creation of regulatory requirements (items requiring prior NRC approval of subsequent changes).
5.0 STATE CONSULTATION
In accordance with the Commission's regulations, the Kansas State official was notified of the proposed issuance of the amendment. The State official had no comments.
-6
6.0 ENVIRONMENTAL CONSIDERATION
This amendment relates solely to safeguards matters and does not involve any significant construction impacts. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on October 2,2012 (77 FR 60156).
Accordingly, this amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of this amendment.
7.0 CONCLUSION
The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.
Principal Contributor: Monika Coflin, NSIR Date: December 12, 2012
December 12, 2012 Mr. Matthew W. Sunseri President and Chief Executive Officer Wolf Creek Nuclear Operating Corporation Post Office Box 411 Burlington, KS 66839
SUBJECT:
WOLF CREEK GENERATING STATION - ISSUANCE OF AMENDMENT RE:
REVISED CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE MILESTONE 6 (TAC NO. ME8898)
Dear Mr. Sunseri:
The Nuclear Regulatory Commission has issued the enclosed Amendment No. 202 to Renewed Facility Operating License No. NPF-42, for the Wolf Creek Generating Station. The amendment consists of changes to the renewed facility operating license in response to your application dated June 13, 2012.
The amendment revises the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone #6 and paragraph 2.E of the renewed facility operating license. The amendment modifies the scope of Milestone #6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, would be implemented concurrent with the full implementation of the cyber security program (Milestone #8). Thus, all CSP activities would be fully implemented by the completion date, currently identified in Milestone #8 of the licensee's CSP implementation schedule.
A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.
Sincerely, IRA by Joseph M. Sebrosky forI Carl F. Lyon, Project Manager Plant Licensing Branch IV Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-482
Enclosures:
- 1. Amendment No. 202 to NPF-42
- 2. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:
PUBLIC RidsNrrPMWolfCreek Resource TWengert, NRRlDORL LPL4 rlf RidsNsirDsp Resource CErlanger, NSIRIDSP/CSIRB RidsAcrsAcnw_MailCTR Resource RidsOgcRp Resource MCoflin, NSIRIDSP/CSIRB RidsNrrDorlDpr Resource RidsRgn4MailCenter Resource PPederson, NSIRIDSP/CSIRB RidsNrrDorlLpl4Resource BSingal, NRRlDORL RidsNrrLAJBurkhardt Resource JPoole, NRRlDORL Accession Number: ML12279A250 *SE memo dated PL4/PM NRR/LPL4/LA NSIRIDSP/CSIRB/BC OGC NLO NRRlLPL4/BC FLyon JBurkhardt CErlanger
- LSubin MMarkley (JSebro 11110/12 9/4/12 11/19/12 12/5/12 12/12/12 OFFICIAL RECORD COPY