ML12339A109

Issuance of Amendments Regarding Revision to Cyber Security Plan Milestone 6

ML12339A109
Person / Time
Site:	Saint Lucie
Issue date:	12/17/2012
From:	Orf T Plant Licensing Branch II
To:	Nazar M Florida Power & Light Co
Orf, T J
References
TAC ME9128, TAC ME9129
Download: ML12339A109 (18)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555*0001 December 17,2012 Mr. Mano Nazar Executive Vice President and Chief Nuclear Officer Florida Power and Light Company P.O. Box 14000 Juno Beach, Florida 33408-0420

SUBJECT:

ST. LUCIE PLANT, UNITS 1 AND 2 - ISSUANCE OF AMENDMENTS REGARDING REVISION TO CYBER SECURITY PLAN MILESTONE 6 (TAC NOS. ME9128 AND ME9129)

Dear Mr. Nazar:

The Commission has issued the enclosed Amendment Nos. 214 and 164 to Renewed Facility Operating License Nos. DPR-67 and NPF-16 for the St. Lucie Plant, Units 1 and 2, respectively.

These amendments consist of changes to the licenses in response to your application dated June 21,2012.

The amendments revise the licenses to refer to a revised milestone scope in the Cyber Security Plan implementation schedule. Florida Power and Light Company (the licensee) is clarifying the scope of implementation milestone 6 in the Cyber Security Plan implementation schedule provided in the licensee's letter dated April 8, 2011, to apply to only technical cyber security controls.

A copy of the Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sincerely,

~-O+

Tracy J. Ort, Project Manager Plant Licensing Branch 11-2 Division of Operator Reactor Licensing Office of Nuclear Reactor Regulation Docket Nos. 50-335 and 50-389

Enclosures:

1. Amendment No. 214 to DPR-67

2. Amendment No. 164 to NPF-16

3. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FLORIDA POWER & LIGHT COMPANY DOCKET NO. 50-335 ST. LUCIE PLANT UNIT NO.1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 214 Renewed License No. DPR-67

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Florida Power & Light Company (the licensee), June 21,2012, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in 10 CFR, Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR, Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

- 2

2.

Accordingly, Renewed Facility Operating License No. DPR-67 is amended as indicated in the attachment to this license amendment, and paragraph 3.B is amended to read as follows:

B.

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 214,are hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented by December 31, 2012.

FOR THE NUCLEAR REGULATORY COMMISSION

~~

e F.

uichocho, Chief ant Licensing Branch 11-2 ivision of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Operating License Date of Issuance: December 17, 2012

ATTACHMENT TO LICENSE AMENDMENT NO. 214 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-67 DOCKET NO. 50-335 Replace Pages 3, 4, and 5 of Renewed Operating License DPR-67 with the attached Pages 3, 4, and 5. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

- 3 applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

A.

Maximum Power Level FPL is authorized to operate the facility at steady state reactor core power levels not in excess of 3020 megawatts (thermal).

B.

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 214are hereby incorporated in the renewed license.

FPL shall operate the facility in accordance with the Technical Specifications.

Appendix B, the Environmental Protection Plan (Non-Radiological), contains environmental conditions of the renewed license. If significant detrimental effects or evidence of irreversible damage are detected by the monitoring programs required by Appendix B of this license, FPL will provide the Commission with an analysis of the problem and plan of action to be taken subject to Commission approval to eliminate or significantly reduce the detrimental effects or damage.

C.

Updated Final Safety Analysis Report The Updated Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21 (d), as revised on March 28, 2003, describes certain future activities to be completed before the period of extended operation. FPL shall complete these activities no later than March 1,2016, and shall notify the NRC in writing when implementation of these activities is complete and can be verified by NRC inspection.

The Updated Final Safety Analysis Report supplement as revised on March 28, 2003, described above, shall be included in the next scheduled update to the Updated Final Safety Analysis Report required by 10 CFR 50.71 (e) (4), following issuance of this renewed license. Until that update is complete, FPL may make changes to the programs described in such supplement without prior Commission approval, provided that FPL evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

D.

Sustained Core Uncoverv Actions Procedural guidance shall be in place to instruct operators to implement actions that are designed to mitigate a small-break loss-of-coolant accident prior to a calculated time of sustained core uncovery.

Renewed License No. DPR-67 Amendment No. 214

- 4 E.

Fire Protection FPL shall implement and maintain in effect all provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report for the facility (The fire protection program and features were originally described in FPL submittals L-83-514 dated October 7, 1983, L-83-227 dated April 12, 1983, L-83-261 dated April 25, 1983, L-83-453 dated August 24, 1983, L-83-488 dated September 16,1983, L-83-588 dated December 14,1983, L-84-346 dated November 28, 1984, L-84-390 dated December 31, 1984, and L-85-71 dated February 21, 1985) and as approved by NRC letter dated July. 17, 1984, and supplemented by NRC letters dated February 21,1985, March 5,1987, and October 4, 1988, subject to the following provision:

FPL may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

F.

Physical Protection The licensee shall fully Implement and maintain in effect all provisions of the Commission-approved physical security. training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Florida Power and Light &

FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan - Revision 3," submitted by letter dated May 18. 2006. St. Lucie shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP). including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The St. Lucie CSP was approved by License Amendment No. 211 as supplemented by a Clarification approved by License Amendment No. 214.

G.

Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a)

Fire fighting response strategy with the following elements:

1.

Pre-defined coordinated fire response strategy and guidance

2.

Assessment of mutual aid fire fighting assets

3.

Designated staging areas for equipment and materials

4.

Command and control

5.

Training of response personnel (b)

Operations to mitigate fuel damage considering the following:

1.

Protection and use of personnel assets

2.

Communications

3.

Minimizing fire spread

4.

Procedures for implementing integrated fire response strategy

5.

Identification of readily-available pre-staged equipment Renewed License No. DPR-67 Amendment No.~, ::u.=t, 214

-5

6.

Training on integrated fire response strategy

7.

Spent fuel pool mitigation measures (c)

Actions to minimize release to include consideration of:

1.

Water spray scrubbing

2.

Dose to onsite responders H.

Control Room Habitabilitv Upon implementation of Amendment No. 205, adopting TSTF-448, Revision 3, the determination of control room envelope (CRE) unfiltered air inleakage as required by SR 4.7.7.1.e, in accordance with TS 6.8.4.m, the assessment of CRE habitability as required by Specification 6.8A.m.c. (ii), and the measurement of CRE pressure as required by Specification 6.8.4.m.d, shall be considered met.

Following implementation:

(a)

The first performance of SR 4.7.7.1.e, in accordance with Specification 6.8.4.m.c(i), shall be within the specified Frequency of 6 years, plus the 18-month allowance of SR 4.0.2, as measured from September 2003, the date of the most recent successful tracer gas test, as stated in FPL letters to NRC dated December 9,2003, and October 29, 2004, in response to Generic Letter 2003-01.

(b)

The first performance of the periodic assessment of CRE habitability, Specification 6.8.4.m.c(ii), shall be within 3 years, plus the 9-month allowance of SR 4.0.2, as measured from September 2003, the date of the most recent successful tracer gas test, as stated in FPL letters to NRC dated December 9, 2003, and October 29, 2004, in response to Generic Letter 2003-01, or within the next 9 months if the time period since the most recent successful tracer gas test is greater than 3 years.

(c)

The first performance of the periodic measurement of CRE pressure, Specification 6.8.4.c.d, shall be within 36 months in a staggered test basis, plus the 138 days allowed by SR 4.0.2, as measured from June 30, 2006, which is the date of the most recent successful pressure measurement test, or within 138 days if not performed previously.

/.

RODEX2 Safety Analyses RODEX2 has been specifically approved for use for St. Lucie Unit 1 licensing basis analyses. Upon NRC's approval of a generiC supplement to the RODEX2 code and associated methods that accounts for thermal conductivity degradation (TCD), FPL will within six months:

(a)

Demonstrate that St. Lucie Unit 1 safety analyses remain conservatively bounded in licensing basis analyses when compared to the NRC approved generic supplement to the RODEX2 methodology, or (b)

Provide a schedule for the re-analysis using the NRC-approved generic supplement to the RODEX2 methodology for any of the affected licensing basis analyses.

Renewed License No. DPR-67 Amendment No. 213, 2141

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FLORIDA POWER & LIGHT COMPANY ORLANDO UTILITIES COMMISSION OF THE CITY OF ORLANDO, FLORIDA AND FLORIDA MUNICIPAL POWER AGENCY DOCKET NO. 50-389 ST. LUCIE PLANT UNIT NO.2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 164 Renewed License No. NPF-16

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A The application for amendment by Florida Power & Light Company, et al. (the licensee), dated June 21.2012, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in 10 CFR, Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR, Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

- 2

2.

Accordingly, Renewed Facility Operating License No. NPF-16 is amended as indicated in the attachment to this license amendment, and paragraph 3.B is amended to read as follows:

B.

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 164,are hereby incorporated in the license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

This license amendment is effective as of its date of issuance and shall be implemented by December 31,2012.

FOR THE NUCLEAR REGULATORY COMMISSION

Attachment:

Changes to the Operating License Date of Issuance: December 17, 2012

ATTACHMENT TO LICENSE AMENDMENT NO. 164 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-16 DOCKET NO. 50-389 Replace Pages 3 and 5 of Renewed Operating License NPF-16 with the attached Pages 3 and 5. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

- 3 neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required.

D.

Pursuant to the Act and 10 CFR Parts 30, 40, and 70, FPL to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and E.

Pursuant to the Act and 10 CFR Parts 30, 40, and 70, FPL to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

3.

This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission's regulations: 10 CFR Part 20, Section 30.34 of 10 FR Part 30, Section 40.41 of 10 CFR Part 40, Section 50.54 and 50.59 of 10 CFR Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified below:

A.

Maximum Power Level FPL is authorized to operate the facility at steady state reactor core power levels not in excess of 3020 megawatts (thermal).

B.

Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 164 are hereby incorporated in the renewed license.

FPL shall operate the facility in accordance with the Technical Specifications.

Renewed License No. NPF-16 Amendment No. 164

- 5 F.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Florida Power and Light &

FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan - Revision 3," submitted by letter dated May 18, 2006. St. Lucie shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). St. Lucie CSP was approved by License Amendment No. 160 as supplemented by a clarification approved by License Amendment No. 164.

G.

Before engaging in additional construction or operational activities which may result in a significant adverse environmental impact that was not evaluated or that is significantly greater than that evaluated in the Final Environmental Statement dated April 1982, FPL shall provide written notification to the Office of Nuclear Reactor Regulation.

H.

DELETED I.

FPL shall notify the Commission, as soon as possible but not later than one hour, of any accident at this facility which could result in an unplanned release of quantities of fission products in excess of allowable limits for normal operation established by the Commission.

J.

FPL shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

K.

The use of ZIRLOTM clad fuel at St. Lucie Unit 2 will be subject to the following restrictions:

FPL will limit the fuel duty for St. Lucie Unit 2 to a baseline modified Fuel Duty Index (mFDI) of 600 with a provision for adequate margin to account for variations in core design (e.g., cycle length, plant operating conditions, etc).

This limit will be applicable until data is available demonstrating the performance of ZIRLOTM cladding at Combustion Engineering 16x16 plants.

FPL will restrict the mFDI of each ZIRLOTM clad fuel pin to 110 percent of the baseline mFDI of 600.

For a fraction of the fuel pins in a limited number of assemblies (8), FPL will restrict the fuel duty of ZIRLOTM clad fuel pins to 120 percent of the baseline mFDlof600.

Renewed License No. NPF-16 Amendment No. 4-§Q, 4-eQ, 164 I

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 214 AND 164 TO RENEWED FACILITY OPERATING LICENSES NOS. DPR-67 AND NPF-16 FLORIDA POWER AND LIGHT COMPANY, ET Al.

ST. LUCIE PLANT, UNITS NOS. 1 AND 2 DOCKET NOS. 50-335 AND 50-389

1.0 INTRODUCTION

By application dated June 21,2012, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML12178A384), Florida Power and light Company (FPL, the licensee) requested changes to the renewed facility operating licenses for St. Lucie, Units 1 and 2. The proposed changes would revise the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone #6 and the existing license conditions in the renewed facility operating licenses. Milestone #6 of the CSP implementation schedule concerns the identification, documentation, and implementation of cyber security controls (technical, operational, and management) for critical digital assets (CDAs) related to target set equipment. FPL is requesting to modify the scope of Milestone #6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, would be implemented concurrent with the full implementation of the Cyber Security Program (Milestone #8). Thus, all CSP activities would be fully implemented by the completion date identified in Milestone #8 of the licensee's CSP implementation schedule.

Portions of the letter dated June 21, 2012, contain sensitive unclassified non-safeguards information and, accordingly, those portions are withheld from public disclosure.

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRC) staff reviewed and approved the licensee's existing CSP implementation schedule by license Amendment Nos. 211 and 160, dated August 31, 2011 (ADAMS Accession No. ML11196A079), concurrent with the incorporation of the CSP into the facility current licensing basis. The NRC staff considered the following regulatory requirements and guidance in its review of the current license amendment request to modify the existing CSP implementation schedule:

Enclosure

- 2

• Title 10 of the Code of Federal Regulations (10 CFR), Part 73, Section 73.54 states:

"Each [CSP] submittal must include a proposed implementation schedule.

Implementation of the licensee's cyber security program must be consistent with the approved schedule."

• The licensee's renewed facility operating licenses include license conditions that require the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

• Amendment Nos. 211 and 160, dated August 31,2011, which approved the licensee's CSP and implementation schedule, included the following statement: The implementation of the cyber security plan (CSP), including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee on April 8, 2011, and approved by the NRC staff with this license amendment. All subsequent changes to the NRC-approved CSP implementation schedule will require prior NRC approval pursuant to 10 CFR 50.90."

In a letter to the NEI dated March 1, 2011 (ADAMS Accession No. ML110070348), the NRC staff acknowledged that the cyber security implementation schedule template was "written generically and licensees that use the template to develop their proposed implementation schedules may need to make changes to ensure the submitted schedule accurately accounts for site-specific activities."

3.0 TECHNICAL EVALUATION

Amendment Nos. 211 and 160 to Renewed Facility Operating License Nos. DPR-67 and NPF-16 for St. Lucie, Units 1 and 2, respectively, were issued on August 31, 2011. The NRC staff also approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with the amendments. The implementation schedule had been submitted by the licensee based on a template prepared by NEI (ADAMS Accession No. ML110600218),

which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules. The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team;

2) Identify Critical Systems and CDAs;

3) Install a deterministic one-way device between lower level devices and higher level devices;

4) Implement the security control "Access Control For Portable And Mobile Devices";

5) Implement observation and identification of obvious cyber-related tampering to existing insider mitigation rounds by incorporating the appropriate elements;

6) Identify, document, and implement cyber security controls as per "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment;

7) Commence ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented; and

8) Fully implement the CSP.

- 3 3.1 Licensee's Proposed Change Currently, Milestone #6 of St. Lucie's CSP requires FPL to identify, document, and implement cyber security controls for CDAs that could adversely impact the design function of physical security target set equipment by December 31, 2012. These cyber security controls consist of technical, operational and management security controls. In its June 21,2012, application, FPL proposed to modify Milestone #6 to change the scope of the cyber security controls due to be implemented on December 31,2012, to include only the NEI 08-09, Revision 6, Appendix D, technical security controls. FPL proposes to amend its CSP to provide that operational and management security controls, identified in Milestone #6, will be fully implemented by a later date, which is the completion date identified in Milestone #8 of the CSP implementation schedule. The licensee stated that implementing the technical cyber security controls for target set CDAs provides a high degree of protection against cyber-related attacks that could lead to radiological sabotage. The licensee further stated that many of its existing programs are primarily procedure-based programs and must be implemented in coordination with the comprehensive cyber security program. The licensee also stated that the existing programs currently in place at St. Lucie (e.g., physical protection, maintenance, configuration management, and operating experience) provide sufficient operational and management cyber security protection during the interim period until the cyber security program is fully implemented.

3.2 NRC Staff Evaluation The intent of the cyber security implementation schedule was for licensees to demonstrate ongoing implementation of their cyber security program prior to full implementation, which is set for the date specified in Milestone #8. In addition to Milestone #6 and its associated activities, licensees will be completing six other milestones (Milestones No. 1 through No.5 and Milestone #7) by December 31,2012. Activities include establishing a Cyber Security Assessment Team, identifying critical systems and CDAs, installing deterministic one-way devices between defensive levels, implementing access control for portable and mobile devices, implementing methods to observe and identify obvious cyber related tampering, and conducting ongoing monitoring and assessment activities for target set CDAs. In the aggregate, the interim milestones demonstrate ongoing implementation of the cyber security program at St. Lucie.

The NRC staff has reviewed the licensee's evaluation of the proposed change in its submittal dated June 21,2012, and finds that by completing Milestones No.1 through No.5, Milestone #6 with implementation of technical controls to target set CDAs, and Milestone #7, St. Lucie will have an acceptable level of cyber security protection until full program implementation is achieved. Technical cyber security controls include access controls, audit and accountability, CDA and communications protection, identification and authentication, and system hardening.

These controls are executed by computer systems, as opposed to people, and consist of hardware and software controls that provide automated protection to a system or application.

Implementation of technical cyber security controls promotes standardization, trust, interoperability, connectivity, automation, and increased efficiency. For these reasons, the NRC staff concludes that the licensee's approach is acceptable.

The NRC staff also recognizes that full implementation of operational and management cyber security controls in accordance with requirements of the St. Lucie CSP will be achieved with full

- 4 implementation of the St. Lucie Cyber Security Program by the date set in Milestone #8. That is, all required elements for the operational and management cyber security controls in accordance with the St. Lucie CSP will be implemented in their entirety at the time of full implementation of the CSP.

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that U[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule," As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRC-approved CSP implementation schedule, thus, will require prior NRC approval pursuant to 10 CFR 50.90.

3.3 Revision to License Condition 3.F of DPR-67 and NPF-16 By letter dated June 21,2012, the licensee proposed to modify Paragraph 3.F of Renewed Facility Operating License Nos. DPR-67 and NPF-16 for St. Lucie, Units 1 and 2, respectively, which provides license conditions to require the licensee to fully implement and maintain, in effect all provisions of the NRC-approved CSP.

The license condition in Paragraph 3.F of Renewed Operating License No. DPR-67 for St. Lucie, Unit 1, is modified as follows:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Florida Power and Light

& FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan - Revision 3," submitted by letter dated May 18, 2006. St. Lucie shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The St. Lucie CSP was approved by License Amendment No. 211 as supplemented by a clarification approved by License Amendment No. 214.

The license condition in Paragraph 3.F of Renewed Operating License No. NPF-16 for St. Lucie, Unit 2, is modified as follows:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to

- 5 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Florida Power and Light

&FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan - Revision 3," submitted by letter dated May 18, 2006. St. Lucie shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The St. Lucie CSP was approved by License Amendment No. 160 as supplemented by a clarification approved by License Amendment No. 164.

3.4 Summary Based on its review of the licensee's submissions, the NRC staff concludes that the proposed changes to Milestone #6 of the licensee's CSP implementation schedule are acceptable. The NRC staff also concludes that, upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff finds the proposed changes acceptable.

4.0 STATE CONSULTATION

Based upon a letter dated May 2, 2003, from Michael N. Stephens of the Florida Department of Health, Bureau of Radiation Control, to Brenda L. Mozafari, Senior Project Manager, NRC, the State of Florida does not desire notification of issuance of license amendments.

5.0 ENVIRONMENTAL CONSIDERATION

These amendments relate solely to safeguards matters and do not involve any significant construction impacts. Accordingly, these amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of these amendments.

6.0 CONCLUSION

The NRC staff has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: Monika Coflin Date: December 17,2012

ML12339A109 OFFICE LPL2-21PM I LPL2-2/LA NSIRIDSP/CSIRB*

OGC NLO LPL2-2/BC (Al LPL2-21PM NAME TOrt I BClavton CErianger BMizuno JQuichocho TOrt DATE 1215/12 I

8/22112 8/22/12 12/6/12 12/12/12 12117112

• bymemo