ML15058A706

Issuance of Amendment No. 146 Regarding the Cyber Security Plan Implementation Schedule

ML15058A706
Person / Time
Site:	Seabrook
Issue date:	04/22/2015
From:	John Lamb Plant Licensing Branch 1
To:	Dean Curtland NextEra Energy Seabrook
Lamb J, NRR/DORL/LPL1-2, 415-3100
References
TAC MF4447
Download: ML15058A706 (17)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 April 22, 2015 Mr. Dean Curtland, Site Vice President c/o Michael Ossing Seabrook Station NextEra Energy Seabrook, LLC P.O. Box 300 Seabrook, NH 0387 4

SUBJECT:

SEABROOK STATION, UNIT NO. 1 - ISSUANCE OF AMENDMENT REGARDING THE CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE (TAC NO. MF4447)

Dear Mr. Curtland:

The U.S. Nuclear Regulatory Commission (NRC) has issued the enclosed Amendment No. 146 to Facility Operating License No. NPF-86 for the Seabrook Station, Unit No. 1 (Seabrook). This amendment consists of changes to the Facility Operating License (FOL) in response to your application dated July 10, 2014, as supplemented by letter dated July 22, 2014.

The amendment revises the date of Cyber Security Plan (CSP) Implementation Schedule Milestone 8 and the existing license conditions in the FOL. Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP.

Portions of the letter dated July 10, 2014, contained sensitive unclassified non-safeguards information, and those portions are withheld from public disclosure in accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 2.390(d)(1 ).

A copy of our safety evaluation is also enclosed. Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Sic rely,, &e__f /J~

G. Lam( dnia:~er P a t Licensing Branch 1-2 D ision of Operating Reactor Licensing 0 ice of Nuclear Reactor Regulation Docket No. 50-443

Enclosures:

1. Amendment No. 146 to NPF-86

2. Safety Evaluation cc w/encls: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 NEXTERA ENERGY SEABROOK, LLC, ET AL.*

DOCKET NO. 50-443 SEABROOK STATION, UNIT NO. 1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 146 License No. NPF-86

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment filed by NextEra Energy Seabrook, LLC, et al.,

(the licensee) dated July 10, 2014, as supplemented by letter dated July 22, 2014, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission, C. There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment 1s in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• NextEra Energy Seabrook, LLC is authorized to act as agent for the: Hudson Light & Power Department, Massachusetts Municipal Wholesale Electric Company, and Taunton Municipal Light Plant and has exclusive responsibility and control over the physical construction, operation and maintenance of the facility.

2. Accordingly, the license is amended by changes to paragraph 2.C.(2) of Facility Operating License No. NPF-86, and is hereby amended to read as follows:

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 146, and the Environmental Protection Plan contained in Appendix B are incorporated into the Facility License No. NPF-86.

NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3. Additionally, the license is amended by changes to paragraph 2.E of Facility Operating License No. NPF-86, and is hereby amended to read as follows:

E. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans 1, submitted by letter dated September 23, 2004, and supplemented by letters dated October 15, October 22, and October 29, 2004, and May 18, 2006, is entitled: "Florida Power and Light & FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan." The set contains Safeguards Information protected under 10 CFR 73.21. NextEra Energy Seabrook, LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by clarifications approved by License Amendment No. 132 and License Amendment No. 146).

4. This license amendment is effective as of its date of issuance and shall be implemented within 60 days.

FOR THE NUCLEAR REGULATORY COMMISSION Douglas A Broaddus, Chief Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the License Date of Issuance: Apri 1 22, 2015

ATTACHMENT TO LICENSE AMENDMENT NO. 146 FACILITY OPERATING LICENSE NO. NPF-86 DOCKET NO. 50-443 Replace the following pages of Facility Operating License No. NPF-86 with the attached revised pages. The revised pages are identified by amendment number and contain a marginal line indicating the area of change.

Remove 3

6

(4) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use at any time any byproduct, source, and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; (5) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; (6) NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility authorized herein; and (7) DELETED C. This license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; is subject to the additional conditions specified or incorporated below:

(1) Maximum Power Level NextEra Energy Seabrook, LLC, is authorized to operate the facility at reactor core power levels not in excess of 3648 megawatts thermal (100% of rated power).

(2) Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 146*, and the Environmental Protection Plan contained in Appendix B are incorporated into the Facility License No. NPF-86. NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

(3) License Transfer to FPL Energy Seabrook. LLC**

a. On the closing date(s) of the transfer of any ownership interests in Seabrook Station covered by the Order approving the transfer, FPL Energy Seabrook, LLC**, shall obtain from each respective transferring owner all of the accumulated decommissioning trust funds for the facility, and ensure the deposit of such funds and additional funds, if necessary, into a decommissioning trust or trusts for Seabrook Station established by FPL Energy Seabrook, LLC**, such that the amount of such funds deposited meets or exceeds the amount required under 10 CFR 50. 75 with respect to the interest in Seabrook Station FPL Energy Seabrook, LLC**,

acquires on such dates(s).

• Implemented

• • On April 16, 2009, the name "FPL Energy Seabrook, LLC" was changed to "NextEra Energy Seabrook, LLC".

AMENDMENT NO. 146

E. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 1

10 CFR 50.54(p). The combined set of plans , submitted by letter dated September 23, 2004, and supplemented by letters dated October 15, October 22, and October 29, 2004, and May 18, 2006, is entitled: "Florida Power and Light & FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan." The set contains Safeguards Information protected under 10 CFR 73.21. NextEra Energy Seabrook, LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by clarifications approved by License Amendment No. 132 and License Amendment No. 146).

F. Fire Protection NextEra Energy Seabrook, LLC, shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report, the Fire Protection Program Report, and the Fire Protection of Safe Shutdown Capability report for the facility, as supplemented and amended, and as approved in the Safety Evaluation Report, dated March 1983; Supplement 4, dated May 1986; Supplement 5, dated July 1986; Supplement 6, dated October 1986; Supplement 7, dated October 1987; and Supplement 8, dated May 1989 subject to the following provisions: NextEra Energy Seabrook, LLC, may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain shutdown in the event of a fire.

G. Fixed lncore Detector Analysis If the methodology described in Appendix B of ANP-3243P, Revision 1, "Seabrook Station, Unit 1 Fixed lncore Detector System Analysis Supplement to YAEC-1855PA," is utilized in any plant surveillance then NextEra must notify the NRC by letter of the plant's conditions and results of that surveillance.

H. Financial Protection The licensees shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

I. DELETED 1

The Training and Qualification Plan and Safeguards Contingency Plan are Appendices to the Security Plan.

Amendment No. 86, 113 122, 127, 132, 143, 146

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 146 TO FACILITY OPERATING LICENSE NO. NPF-86 SEABROOK STATION, UNIT NO. 1 DOCKET NO. 50-443

1.0 INTRODUCTION

By application dated July 10, 2014, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14198A085), as supplemented by letter dated July 22, 2014, (ADAMS Accession No. ML14205A421) NextEra Energy Seabrook, LLC (NextEra or the licensee) requested a change to the facility operating license (FOL) for Seabrook Station, Unit 1 (Seabrook). The proposed change would revise the date of Cyber Security Plan (CSP)

Implementation Schedule Milestone 8 and the existing license conditions in the FOL. Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP.

Portions of the letter dated July 10, 2014 contain sensitive unclassified non-safeguards information and, those portions are withheld from public disclosure in accordance with the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Section 2.390(d)(1 ).

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRG) staff reviewed and approved the licensee's existing CSP implementation schedule by License Amendment No, 127 to FOL No. NPF-86 for Seabrook, concurrent with the incorporation of the CSP into its current licensing basis. The NRC staff considered the following regulatory requirements and guidance in its review of the license amendment request (LAR), dated July 10, 2014, as supplemented by letter dated July 22, 2014, to modify the existing CSP implementation schedule:

• 10 CFR 73.54 states, in part, that" "Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule."

• The licensee's facility operating license includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

• Amendment No. 127, dated August 23, 2011, which approved the licensee's CSP and implementation schedule, included the following statement: "NextEra Energy Seabrook, LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p)."

• In a publicly available NRC memorandum, dated October 24, 2013 (ADAMS Accession No. ML13295A467), the NRC staff listed criteria that it would consider during its evaluations of licensees' requests to postpone their cyber security program implementation dates (commonly known as Milestone 8).

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change Amendment No. 127 to FOL NPF-86 for Seabrook was issued on August 23, 2011. The NRC staff approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with that amendment. The implementation schedule had been submitted by the licensee based on a template prepared by the Nuclear Energy Institute (NEI), which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML110600218). The licensee's proposed implementation schedule for the CSP identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team (CSAT};

2) Identify Critical Systems (CSs) and Critical Digital Assets (CDAs);

3) Install a data diode device between lower level devices and higher level devices;

4) Implement the security control "Access Control For Portable And Mobile Devices";

5) Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds;

6) Identify, document, and implement cyber security controls in accordance with "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment;

7) Ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented;

8) Fully implement the CSP Currently, Milestone 8 of the licensee's CSP requires it to fully implement the CSP by December 31, 2015. In its LAR dated July 10, 2014, NextEra proposed to change the Milestone 8 completion date to December 31, 2017. The licensee's application addressed the 8 criteria in the NRC staff's guidance memorandum dated October 24, 2013.

The licensee provided the following information pertinent to each of the criteria identified in the NRC guidance memorandum.

(1) Identification of the specific requirement or requirements of the cyber security plan that the licensee needs additional time to implement.

The licensee stated that additional time is required to implement CSP Section 3.1, "Analyzing Digital Computer Systems and Networks Applying Cyber Security Controls," of its CSP. The licensee identified a number of challenges to completing the implementation of the CSP requirement.

(2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee stated that despite a team of six full-time equivalent staff, Next Era is experiencing major challenges with full implementation of Milestone 8. The primary contributing factor to these challenges is the large volume of effort associated with documentation of CDA assessment and analysis. The rate of completion of CDA assessment does not support Milestone 8 completion within the current implementation date. The licensee also stated that changes include: new procedures or revision to existing procedures, revision of training material and delivery of training, CDA assessment tool rework, programming and validation and security controls implementation plan. Seabrook has approximately 1500 CDAs. NextEra underestimated the level of effort necessary to address security controls and assessment is challenging due to uncertainty surrounding security controls interpretation. Security controls modifications are unique and new to the plant and suppliers. Cyber security integrates into day-to-day activities for plant operations, maintenance, engineering and procurement. There is additional burden on maintenance to address security control integrity during work on CDAs.

Work control planners are challenged by the nuances associated with cyber security controls.

Cyber security and controls being implemented on CDAs are new to maintenance, engineering, and operations.

(3) A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee is requesting a change to the Milestone 8 completion date from December 31, 2015, to December 31, 2017, to complete CDA assessment, implement design modifications based on assessment results, update existing procedures, and develop new procedures to complete full implementation of the CSP.

The revised Milestone 8 date will encompass two refueling outages (RFOs}, which will provide adequate time to plan and schedule implementation of design changes identified as the result of CDA assessments.

(4) An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.

The licensee indicated that based on the CSP program implementation activities already completed and activities currently in progress, NextEra is secure and will continue to ensure that digital computer and communications systems and networks are adequately protected against cyber-attacks during implementation of the remainder of the program by the proposed Milestone 8 date of December 31, 2017. It provided details about the completed milestones and noted that the completed activities provide a high degree of protection against cyber-attacks while

NextEra implements the full CSP. The extended Milestone 8 date will allow for completion of the remaining activities and modifications. The revised date encompasses two additional RFOs for implementation of modifications required as a result of CDA assessments. The Milestone 8 extension will provide time to fully integrate the CSP into plant programs, processes, procedures, and training.

(5) A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant.

The licensee stated its methodology for prioritizing Milestone 8 activities is centered on considerations for safety, security, emergency preparedness (EP), and balance of plant (BOP)

(continuity of power) consequences. The methodology is based on defense in depth, installed configuration of the CDA, and susceptibility of commonly identified threat vectors. Prioritization of CDA assessments begins with safety-related CDAs and continues through the lower priority non-safety-related and EP CDAs as follows:

• Safety Related CDAs

• Physical Security CDAs

• Important to safety CDAs (including BOP CDAs that directly impact continuity of power and control system CDAs)

• Non-safety-related and EP CD As (6) A discussion of the licensee's cyber security program performance up to the date of the license amendment request.

The licensee stated implementation of Milestones 1 through 7 activities were completed by December 31, 2012, and provides a high degree of protection against cyber security related attacks until full program implementation. A discussion of various aspects of the program that had been implemented was provided. The licensee stated that self-assessment issues were entered into the corrective action program (CAP) and addressed for program improvement. It closed its discussion by stating that ongoing monitoring and periodic actions provide continuing program performance monitoring.

(7) A discussion of cyber security issues pending in the licensee's CAP.

The licensee stated the NextEra fleet CAP is used to document all cyber issues in order to trend, correct, and improve Seabrook's CSP. The CAP database documents and tracks, from initiation to closure, all cyber security required actions, including issues identified during ongoing program assessment activities. Adverse trends are monitored for program improvement and addressed via the CAP process. The licensee listed cyber security program issues and activities pending in the CAP; however, the details are security-related information.

(8) A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee provided a discussion of completed and pending modifications; however, the details are security-related information.

3.2 NRC Staff Evaluation The NRC staff has evaluated the licensee's application using the regulatory requirements and the guidance above. The NRC staff's evaluation is below.

The licensee stated the CSP requirement requiring additional time to implement is CSP Section 3.1. It also noted that most of the remaining actions require an outage for implementation. The licensee identified a number of challenges to completing the implementation of the CSP requirement.

The licensee stated implementation of Milestones 1 through 7 activities were completed by December 31, 2012, and this provides a high degree of protection against cyber security related attacks until full program implementation. It detailed various aspects of the program that had been implemented. The NRC staff finds that the licensee's site is much more secure after implementation of Milestones 1 through 7, because the activities the licensee completed mitigate the most significant cyber attack vectors for the most significant CDAs The licensee stated that it underestimated the level of effort necessary to address security controls, and assessment is challenging due to uncertainty surrounding security controls interpretation. Security controls modifications are unique and new to the plant and suppliers.

To be effective, cyber security must be integrated into day-to-day activities for plant operations, maintenance, engineering and procurement. There is additional burden on maintenance to address security control integrity during work on CDAs. Work control planners are challenged by the nuances associated with cyber security controls. Cyber security and controls being implemented on CDAs are new to maintenance, engineering, and operations. The NRC staff finds that the licensee's request for additional time to implement Milestone 8 is reasonable given the unanticipated complexity and scope of the work required to come into full compliance with its CSP.

The licensee proposed a Milestone 8 completion date of December 31, 2017. The licensee stated that changing the completion date of Milestone 8 allows for two additional RFOs, which will provide adequate time to plan and schedule implementation of design changes identified during CDA assessments. The licensee stated its methodology for prioritizing Milestone 8 activities is centered on considerations for safety, security, EP, and BOP (continuity of power) consequences. The methodology is based on defense in depth, installed configuration of the CDA, and susceptibility of commonly identified threat vectors. Prioritization of CDA assessments begins with safety-related CDAs and continues through the lower priority non-safety-related and EP CDAs. The NRC staff finds that based on the large number of digital assets described above and the limited resources with the appropriate expertise to perform these activities, the licensee's methodology for prioritizing work on CDAs is appropriate. The NRC staff further finds that the licensee's request to delay final implementation of the CSP until

December 31, 2017, is reasonable given the complexity of the remaining unanticipated work and the need to perform certain work, including design changes, during scheduled RFOs.

3.3 Revision to FOL 2.E. "Physical Security" By letter dated July 10, 2014, the licensee proposed to modify Paragraph 2. E, "Physical Security," of FOL No. NPF-86, which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP.

The current portion of FOL 2.E states the following:

The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by a clarification approved by License Amendment No. 132).

The proposed change to the current portion of FOL 2.E is the following:

The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by clarifications approved by License Amendment No.

132 and License Amendment No. 146).

3.4 Summary Based on its review of the licensee's submission, the NRC staff concludes that the licensee's implementation of Milestones 1 through 7 adds additional protections which provide mitigation for significant cyber attack vectors for the most significant CDAs; that the licensee's explanation of the need for additional time is compelling; and that it is acceptable for Seabrook to complete implementation of Milestone 8, full implementation of the CSP by December 31, 2017. The NRC staff also concludes that, upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff finds the proposed change acceptable.

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees, dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRC-approved CSP implementation schedule, thus, will require prior NRC approval as required by 10 CFR 50.90.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the State of New Hampshire and the Commonwealth of Massachusetts officials were notified of the proposed issuance of the amendment. The State of New Hampshire official had no comments.

Mr. John Giarrusso of the Commonwealth of Massachusetts had two questions listed below:

Commonwealth of Massachusetts Question (1)

(1) Why is Seabrook requesting until December 2017, to complete Milestone 8 when some plants are requesting until December 2016?

NRC Staff Response to the Commonwealth of Massachusetts Question (1)

Plants have requested extensions of 18 to 34 months. NextEra's request of 24 months for Seabrook is consistent with the scope and complexity of remaining work to be completed. Most plants requesting 2016 extensions had milestone due dates in 2014. Most plants, including Seabrook, with due dates in 2015 have requested extensions to 2017.

The licensee provided the following information:

(1) Identification of the specific requirement or requirements of the cyber security plan that the licensee needs additional time to implement.

The licensee stated that the specific CSP requirement requiring additional time to implement is CSP Section 3.1, Analyzing Digital Computer Systems and Networks Applying Cyber Security Controls. The licensee identified a number of challenges to completing the implementation of the CSP requirement.

(2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee stated that despite a team of six full-time equivalent staff, NextEra is experiencing major challenges with full implementation of Milestone 8. The primary contributing factor to these challenges is the large volume of effort associated with documentation of CDA assessment and analysis. The rate of completion of CDA assessment does not support Milestone 8 completion within the current implementation date. The licensee also stated that changes include: new procedures or revision to existing procedures, revision of training material and delivery of training, CDA assessment tool rework, programming and validation and security controls implementation plan. Seabrook has approximately 1500 CDAs. NextEra underestimated the level of effort necessary to address security controls and rework is a major concern. Security controls modifications are unique and new to the plant and suppliers. Cyber security integrates into day-to-day activities for plant operations, maintenance, engineering and procurement. Integration of controls takes longer than anticipated due to work control process and maintenance activities. There is additional burden on maintenance to address security control integrity during work on CDAs. Work control planners are challenged by the nuances

associated with cyber security controls. Training and qualifications of maintenance personnel is a challenge.

(3) A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee is requesting a change to the Milestone 8 completion date from December 31, 2015, to December 31, 2017, to complete CDA assessment, implement design modifications based on assessment results, update existing procedures, and develop new procedures to complete full implementation of the CSP.

The revised Milestone 8 date will encompass two refueling outages (RFOs), which will provide adequate time to plan and schedule implementation of design changes identified as the result of CDA assessments.

Commonwealth of Massachusetts Question (2)

(2) By giving Seabrook an additional year to complete the cyber security work is there any concern of the plant being vulnerable to Cyber-attacks or should Seabrook put additional resources toward the project to get it completed by December 2016?

NRG Staff Response to the Commonwealth of Massachusetts Question {2)

NextEra's extension request of 24 months for Seabrook is consistent with the scope and complexity of remaining work to be completed, and is similar to requested extensions for other plants.

The NRG staff found that Seabrook is much more secure after implementation of Milestones 1 through 7, because the activities NextEra completed mitigate the most significant cyber attack vectors for the most significant Critical Digital Assets.

The NRG staff found that Seabrook's request to delay final implementation of the Cyber Security Plan until December 31, 2017, is reasonable given the complexity of the remaining unanticipated work and the need to perform certain work, including design changes, during scheduled RFOs.

The revised date encompasses 2 additional RFOs for implementation of modifications required as a result of cyber security assessments.

5.0 ENVIRONMENTAL CONSIDERATION

This amendment relates solely to safeguards matters and does not involve any significant construction impacts. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding {79 FR 60519, October 7, 2014). Accordingly, this amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b ), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of this amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: John Rycyna Date: April 22, 2015

ML15058A706 *via email OFFICE LPL 1-2/PM LPL 1-2/LA NSIR/CSD/DD OGG LPL 1-2/BC LPL 1-2/PM NAME JLamb ABaxter* RFelts* JMaltese DBroaddus Jlamb DATE 02/28/2015 04/09/2015 02/26/2015 03/16/2015 04/22/2015 04/22/2015