ML15233A379

Issuance of Amendments Regarding Cyber Security Milestone 8 Completion Date in the Renewed Facility Operating Licenses

ML15233A379
Person / Time
Site:	Turkey Point
Issue date:	09/28/2015
From:	Audrey Klett Plant Licensing Branch II
To:	Nazar M Nextera Energy
Klett A
References
TAC MF4983, TAC MF4984
Download: ML15233A379 (20)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Mr. Mano Nazar President and Chief Nuclear Officer Nuclear Division NextEra Energy P.O. Box 14000 Juno Beach, FL 33408-0420 September 28, 2015

SUBJECT:

TURKEY POINT NUCLEAR GENERATING UNIT NOS. 3 AND 4-ISSUANCE OF AMENDMENTS REGARDING CYBER SECURITY MILESTONE 8 COMPLETION DATE IN THE RENEWED FACILITY OPERATING LICENSES (TAC NOS. MF4983 AND MF4984)

Dear Mr. Nazar:

The U.S. Nuclear Regulatory Commission (NRG or the Commission} has issued the enclosed Amendment No. 266 to Renewed Facility Operating License (RFOL) No. DPR-31 and Amendment No. 261 to RFOL No. DPR-41 for the Turkey Point Nuclear Generating Unit Nos. 3 and 4, respectively. The amendments revise a license condition in the RFOLs in response to the application from Florida Power & Light Company dated October 7, 2014.

The amendments revise the scheduled completion date for Milestone 8 of the Cyber Security Plan implementation schedule from December 31, 2015, to December 31, 2017.

The NRC staff's safety evaluation of the amendments is enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Docket Nos. 50-250 and 50-251

Enclosures:

1. Amendment No. 266 to DPR-31

2. Amendment No. 261 to DPR-41

3. Safety Evaluation cc w/enclosures: Distribution via Listserv Sincerely, Audrey L. Klett, Project Manager Plant Licensing Branch 11-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FLORIDA POWER & LIGHT COMPANY DOCKET NO. 50-250 TURKEY POINT NUCLEAR GENERATING UNIT NO. 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 266 Renewed License No. DPR-31

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Florida Power & Light Company (the licensee) dated October 7, 2014, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and paragraph 3.B of Renewed Facility Operating License No.

DPR-31, and is hereby amended to read as follows:

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 266 are hereby incorporated into this renewed license. The Environmental Protection Plan contained in Appendix B is hereby incorporated into this renewed license.. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3.

Renewed Facility Operating License No. DPR-31 is also amended by changing the last sentence of License Condition 3.. E to read as follows:

The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 245 as supplemented by changes approved by Amendment Nos. 256 and 266.

4.

This license amendment is effective as of its date of issuance and shall be implemented within 60 days of issuance.

Attachment:

Changes to the Renewed Facility Operating License FOR THE NUCLEAR REGULATORY COMMISSION Shana R. He)ton, Chief Plant Licensing Branch 11-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: September 28, 2015 t

ATTACHMENT TO LICENSE AMENDMENT NO. 266 RENEWED FACILITY OPERATING LICENSE NO. DPR-31 DOCKET NO. 50-250 Replace pages 3 and 6 of Renewed Facility Operating License DPR-31 with the revised pages 3 and 6. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

3 E.

Pursuant to the Act and 10 CFR Parts 40 and 70 to receive, possess, and use at any time 100 milligrams each of any source or special nuclear material without restriction to chemical or physical form, f<;>r sample analysis or instrument calibration or associated with radioactively contaminated apparatus; F.

Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of Turkey Point Units Nos. 3 and 4.

3.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 10 CFR Part 20, Section 30.34 of 10 CFR Part 30, Section 40.41 of 10 CFR Part 40, Sections 50.54 and 50.59 of 10 CF.R Part 50, and Section 70.32 of 10 CFR Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and is subject to the additional conditions specified below:

Unit 3 A.

Maximum Power Level The applicant is authorized to operate the facility at reactor core power levels not in excess of 2644 megawatts (thermal).

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 266 are hereby incorporated into this renewed license. The Environmental Protection Plan contained in Appendix B is hereby incorporated into this renewed license.. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

C.

Final Safety Analysis Report The licensee's Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21(d), as revised on November 1, 2001, describes certain future inspection activities to be completed before the period of extended operation.

The licensee shall complete these activities no later than July 19, ?012.

The Final Safety Analysis Report supplement as revised on November 1, 2001, described above, shall be included in the next scheduled update to the Final Safety Analysis Report required by 10 CFR 50.71(e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

Renewed License No. DPR-31 Amendment No. 266

6 Transition License Conditions

1.

Before achieving full compliance with 10 CFR 50.48(c), as specified by 2.

and 3. below, risk-informed changes to the licensee's fire protection program may not be made without prior NRC review and approval unless the change has been demonstrated to have no more than a minimal risk impact, as described in 2. above.

2.

The licensee shall implement the modifications to its facility, as described in Enclosure 1, Attachment S, Table S-2, "Plant Modifications Committed," of FPL letter L-2014-303, dated 11/05/2014, to complete the transition to full compliance with 10 CFR 50.48(c) by the end of the second refueling outage (for each unit) following issuance of the license amendment. The licensee shall maintain appropriate compensatory measures in place until completion of these modifications.

3.

The licensee shall implement the items listed in Enclosure 1, Attachment S, Table S-3, "Implementation Items," of FPL letter L-2014-303, dated 11/05/2014, with the exception of items 12, 18 and 19, no later than 12 months after issuance of the license amendment. Items 12, 18 and 19 are associated with modifications in Table S-2 and will be completed in accordance with Transition License Condition 2 above. Item 22 will be completed within 6 months of the NRC approval of the Flowserve RCP Seal T apical Report.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification,.and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Florida Power and Light Turkey Point Nuclear Plant Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program - Revision 15" submitted by letter dated August 3, 2012.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 245 as supplemented by changes approved by Amendment Nos. 256 and 266.

Renewed License No. DPR-31 Amendment No. 266 I.

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FLORIDA POWER & LIGHT COMPANY DOCKET NO. 50-251 TURKEY POINT NUCLEAR GENERATING UNIT NO. 4 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 261

• Renewed License No. DPR-41

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Florida Power & Light Company (the licensee) dated October 7, 2014, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and

• E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, and paragraph 3.B of Renewed Facility Operating License No.

DPR-41, and is hereby amended to read as follows:

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 261 are hereby incorporated into this renewed license. The Environmental Protection Plan contained in Appendix B is hereby incorporated into this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

(

3.

Renewed Facility Operating License No. DPR-41 is also amended by changing the last sentence of License Condition 3.E to read as follows:

The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 241 as supplemented by changes approved by Amendment Nos. 252 and 261.

4.

This license amendment is effective as of its date of issuance and s.hall be implemented within 60 days of issuance.

Attachment:

Changes to the Renewed Facility Operating License Date of Issuance: ~eptember 28, 201 5 FOR THE NUCLEAR REGULATORY COMMISSION Shana R. Helton, Chief Plant Licensing Branch 11-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation -

ATTACHMENT TO LICENSE AMENDMENT NO. 261 RENEWED FACILITY OPERATING LICENSE NO. DPR-41 DOCKET NO. 50-251 Replace pages 3 and 6 of Renewed Facility Operating License DPR-41 with the revised pages 3 and 6. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

3 E.

Pursuant to the Act and 10 CFR Parts 40 and 70 to receive, possess, and use at any time 100 milligrams each of any source or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactively contaminated apparatus; F.

Pursuant to the Act and 1 O CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of Turkey Point Units Nos. 3 and 4.

3.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations: 1 O CFR Part 20, Section 30.34 of 1 O CFR Part 30, Section 40.41 of 1 O CFR Part 40, Sections 50.54 and 50.59 of 1 O CFR Part 50, and Section 70.32 of 1 O CFR Part 70; and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect, and is subject to the additional conditions specified below:

Unit 4 A.

Maximum Power Level The applicant is authorized to operate the facility at reactor core power levels not in excess of 2644 megawatts (thermal).

B.

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 261 are hereby incorporated into this renewed license. The Environmental Protection Plan contained in Appendix B is hereby incorporated

. into this renewed license. The licensee shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

C.

Final Safety Analysis Report The licensee's Final Safety Analysis Report supplement submitted pursuant to 10 CFR 54.21(d), as revised on November 1, 2001, describes certain future inspection activities to be completed before the period of extended operation.

The licensee shall complete these activities no later than April 10, 2013.

The Final Safety Analysis* Report supplement as revised on November 1, 2001, described above, shall be included in the next scheduled update to the Final Safety Analysis Report required by 1 O CFR 50.71 (e)(4), following the issuance of this renewed license. Until that update is complete, the licensee may make changes to the programs described in such supplement without prior Commission approval, provided that the licensee evaluates each such change.

pursuant to the criteria set forth in 10 CFR 50.59 and otherwise complies with the requirements in that section.

Renewed License No. DPR-41 Amendment No. 261

6 Transition License Conditions

1.

Before achieving full compliance with 10 CFR 50.48(c), as specified by 2.

and 3. below, risk-informed changes to the licensee's fire protection program may not be made without prior NRC review and approval unless the change has been demonstrated to have no more than a minimal risk impact, as described in 2. above.

2.

The licensee shall implement the modifications to its facility, as described in Enclosure 1, Attachment S, Table S-2, "Plant Modifications Committed," of FPL letter L-2014-303, dated 11/05/2014, to complete the transition to full compliance with 1 O CFR 50.48( c) by the end of the second refueling outage (for each unit) following issuance of the license amendment. The licensee shall maintain appropriate compensatory measures in place until completion of these modifications.

3.

The licensee shall implement the items listed in Enclosure 1, Attachment S, Table S-3, "Implementation Items," of FPL letter L-2014-303, dated 11/05/2014, with the exception of items 12, 18 and 19, no later than 12 months after issuance of the license amendment. Items 12, 18 and 19 are associated with modifications in Table S-2 and willibe completed in accordance with Transition License Condition 2 above. Item 22 will be completed within 6 months of the NRC approval of the Flowserve RCP Seal Topical Report.

. E.

The license*e shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined. set of plans, which contains Safeguards Information protected under, 10 CFR 73.21, is entitled: "Florida Power and Light Turkey Point Nuclear Plant Physical Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program - Revision 15" submitted by letter dated August 3, 2012.

The licensee ~hall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 1 O CFR 50.90 and 1 O CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 241 as supplemented by changes approved by Amendment Nos. 252 and 261.

Renewed License No. DPR-41 Amendment No. 261

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION FOR AMENDMENT NO. 266 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-31 AND AMENDMENT NO. 261 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-41 FLORIDA POWER & LIGHT COMPANY TURKEY POINT NUCLEAR GENERATING UNIT NOS. 3 AND 4 DOCKET NOS. 50-250 AND 50-251

1.0 INTRODUCTION

By application dated October 7, 2014, 1 Florida Power & Light Company (FPL or the licensee) requested changes to Renewed Facility Operating License (RFOL) Nos. DPR-31 and DPR-41 for Turkey Point Nuclear Generating Unit Nos. 3 and 4 (Turkey Point 3 and 4), respectively.

The licensee proposed to revise License Condition 3.E in the RFOLs and the scheduled completion date for Milestone 8 of the Cyber Security Plan (CSP) implementation schedule.

Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP.

. The U.S. Nuclear Regulatory Commission (NRC or the Commission) staff's proposed no significant hazards consideration for this amendment was published in the Federal Register (FR) on January 6, 2015 (80 FR 535).

Portions of the application dated October 7, 2014, contain sensitive unclassified non-safeguards information, and the NRC withheld those portions from public disclosure in accordance with Title 10 of the Code of Federal Regulations (10 CFR), Section 2.390(d)(1 ).

2.0 REGULATORY EVALUATION

2.1 Turkey Point 3 and 4 CSP Amendment Nos. 245 and 241 to RFOL Nos. DPR-31 and DPR-41, respectively, were approved by the NRC staff and issued on July 29, 2011.2 The amendments incorporated the CSP into the Turkey Point 3 and 4 licensing bases. The safety evaluation for Amendment Nos. 245 and 241 describe the NRC staff's approval of the licensee's CSP implementation schedule. The licensee submitted its implementation schedule based on a template3 prepared 1 Agencywide Documents Access and Management Systems (ADAMS) Accession No. ML14308A054.

2 ADAMS Accession No. ML11195A147.

3 ADAMS Accession No. ML110600218.

bythe Nuclear Energy Institute (NEI), which, by letter from Mr. Richard P. Correia to Mr. Christopher E. Earls, dated March 1, 2011, 4 the NRC staff found acceptable for licensees to use to develop CSP implementation schedules. The licensee's implementation schedule for its CSP contained completion dates and bases for the following eight milestones identified in the licensee's application:

1) Establish the Cyber Security Assessment Team;

2) Identify Critical Systems and Critical Digital Assets (CDAs);

3) Implement cyber security defense-in-depth architecture;

4) Implement portable devise/mobile computing device control program;

5) Implement observation program for cyber-related tampering;

6) Identify, document, and implement cyber security controls for CDAs that could adversely impact the design function of physical security target set equipment;

7) Implement ongoing monitoring and assessment activities for physical security target set CDAs; and

8) Full program implementation.

2.2 Description of Proposed Changes Milestone 8 of the licensee's CSP currently requires the licensee to fully implement the CSP by December 31, 2015. In its application dated October 7, 2014, the licensee requested to change the Milestone 8 completion date to December 31, 2017. This change would also result in revising License Condition 3.E in RFOL Nos. DPR-31 and DPR-41, which provides the license conditions that require the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP.

License Con.dition 3.E of RFOL No. DPR-31 states, in part:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 245 as supplemented by a change approved by Amendment No. 256.

The licensee proposed to revise License Condition 3.E of RFOL No. DPR-31 to state:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 245 as supplemented by changes approved by Amendment Nos. 256 and

[266]..

4 ADAMS Accession No. ML110070348.

License Condition 3. E of RFOL No. DPR-41 states, in part:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 241 as supplemented by a change approved by Amendment No. 252.

The licensee proposed to revise License Condition 3.E of RFOL No. DPR-41 to state:

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Turkey Point Nuclear Generating Station CSP was approved by License Amendment No. 241 as supplemented by changes approved by Amendment Nos. 252 and

[261 ].

2.3 Regulatory Review The NRC staff considered the following plant-specific licensing basis information, regulatory, requirements, and guidance during its review of the licensee's application.

Amendment Nos. 245 and 241 appfoved the licensee's existing CSP implementation schedule and incorporated the CSP into the Turkey Point 3 and 4 licensing bases.

License Condition 3.E in RFOL Nos. DPR-31 and DPR-41 requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

Section 73.54 of 1 O CFR states, in part, "Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule."

In an NRC memorandum from Mr. Russell Felts to Mr. Barry Westreich, dated October 24, 2013, 5 the NRC staff listed criteria it considers during evaluations of licensees' requests to postpone CSP implementation schedule Milestone 8 dates.

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, which states, "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011,6 the implementation of the plan, including the key intermediate milestone dates and the full implementation date, shall be in 5 ADAMS Accession No. ML13295A467.

6 ADAMS Accession No. ML110980538.

accordance with the implementation schedule subrritted by the licensee and approved by the NRC. All subsequent changes to the NRG-approved CSP implementation schedule will thus require prior NRC approval, as required by 10 CFR 50.90.

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change The NRC staff evaluated the licensee's application dated October 7, 2014, against the regulatory requirements and the guidance cited in Section 2.0 of this safety evaluation. In its application, the licensee addressed each of the eight criteria described in the NRC memorandum dated October 24, 2013, to justify its proposed changes, as follows.

( 1) Identification of the specific requirement or requirements of the CSP that the licensee needs additional time to implement.

In its application dated October 7, 2014, the licensee stated that additional time is required to implement CSP, Section 3.1, "Analyzing Digital Computer Systems and Networks and Applying Cyber Security Controls." The licensee identified the challenges to completing implementation of the CSP requirement.

(2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

In its application dated October 7, 2014, the licensee identified challenges to meeting Milestone 8. The licensee stated that CDA assessment work is resource intensive.

Turkey Point has approximately 2,500 CDAs. The licensee stated that assessment of the CDAs is challenging because of uncertainty surrounding security controls interpretation. The licensee also stated rework is a major concern because budgets are approved in advance on a defined scope of work. The licensee also stated that it will have to increase capacity (i.e., combination of time and resources) to cope with the magnitude of work identified. The licensee stated that remediation activities need to be carefully considered given that security controls modifications are unique and new to the plant and suppliers, and plant modifications must be carefully implemented to ensure they do not impact plant safety and operation. The licensee also stated that it needs to address resources for revising site training and schedules for new programs, processes, and procedures.

The licensee also identified change management challenges associated with integrating cyber security into day-to-day plant operations, maintenance, engineering, and procurement activities, and work control processes. The licensee stated that there is additional burden on maintenance to address security control integrity during maintenance work on CDAs. The cyber security for plant CDAs is new, and the security controls being implemented on the plant CDAs are new to the maintenance, system engineering, and operations departments. The licensee also stated that the work control planners are challenged by the nuances associated with cyber security controls, that training and qualification of maintenance technicians is a challenge, *and that modifications that added security controls have added new change management issues.

(3) A proposed completion date for Milestone 8 consistent with the remaining scope of work.

to be conducted and the resources available.

In its application dated October 7, 2014, the licensee proposed a Milestone 8 completion date of December 31, 2017, to 'complete CDA assessments, implement design modifications based on assessment results, update existing procedures, and develop new program procedures to complete full implementation of the CSP. The licensee also stated that changing the completion date of Milestone 8 will encompass two additional refueling outages per unit and provide adequate time to plan and s.chedule the implementation of the modifications identified as the result of CDA assessments.

(4) An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.

In its application dated October 7, 2014, the licensee stated that, based on the cyber security implementation activities already completed and activities already in progress, Turkey Point is secure. The licensee also stated that it will continue to ensure that digital computer and communication systems and networks are adequately protected against cyber-attacks during implementation of the remainder of the program by the proposed Milestone 8 date of December 31, 2017. The licensee provided details about its completed implementation of Milestones 1 through 7.

(5) A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant.

In its application dated October 7, 2014, the licensee stated that its methodology for prioritizing Milestone 8 activities is centered on considerations for safety, security, emergency preparedness, and balance-of-plant (continuity of power) consequences.

The licensee stated that the methodology is based on defense-in-depth, installed configuration of the CDA, and susceptibility to commonly identified threat vectors. The licensee stated that prioritization for CDA assessment begins with safety related CDAs and continues through the lower priority non-safety related and emergency preparedness CDAs as follows: safety related CDAs; physical security CDAs; important-to-safety CDAs, including balance-of-plant CDAs that directly impact continuity of power and control system CDAs; and non-safety related and emergency preparedness CDAs.

(6) A discussion of the licensee's cyber security program performance up to the date of the license amendment request.

In its application dated October 7, 2014, the licensee stated that completed and ongoing activities provide a high degree of protection against cyber security related attacks, during implementation of the full program. The licensee stated that it completed a comprehensive self-assessment for all seven milestones to ensure completeness and effectiveness. The licensee stated that it entered self-assessment issues into its corrective action program (CAP) and addressed them for program improvement., The licensee also stated that ongoing monitoring and periodic actions provide continuing program performance monitoring.

(7) A discussion of cyber security issues pending in the licensee's CAP.

In its application dated October 7, 2014, the licensee stated that it uses the Turkey Point CAP to document cyber issues in order to trend, correct, and improve the CSP. The licensee stated that the CAP database documents and tracks - from initiation to closure -

cyber security required actions, including issues identified during ongoing program assessment and NRC inspection activities. The licensee stated that adverse trends are monitored for program improvement and addressed via the CAP process. The licensee provided examples of issues and activities in the CAP.

(8) A discussion of modifications completed to support the cyber security program and a discussion of pending cybersecurity modifications.

In its application dated October 7, 2014, the licensee listed completed modifications and stated there are no pending modifications.

3.2

NRC Staff Evaluation

The NRC staff has had extensive interaction with the nuclear industry since licensees first developed their CSP implementation schedules. Based on this interaction, the NRC staff

• recognizes that CDA assessment work is much more complex and resource intensive than originally anticipated. The licensee has a large number of CDAs and underestimated the level of effort to address security controls for each of the CDAs When developing its CSP implementation schedule. The NRC staff finds that the licensee's request for additional time to implement Milestone 8 is reasonable, given the unanticipated complexity and scope of the work required to come into full compliance with its CSP.

The licensee has made reasonable progress toward full implementation of the CSP, and the licensee is effectively managing the impact of the requested additional implementation time on the effectiveness of the overall cyber security program. The NRC staff has reviewed the licensee's methodology for prioritizing completion of work for CDAs associated with significant safety consequences and with reactivity effects in the balance of plant and finds that the

. methodology is appropriate. The NRC staff concludes that the licensee is using the tools at its disposal, such as the CAP, to implement, verify, and improve the cyber security program. The NRC staff finds the prpposed completion date to be adequate for planning and completing the additional work needed to implementthe CSP.

Based on its review of the licensee's application, the NRC staff concludes that the licensee's completed implementation of Milestones 1 through 7 provides significant protection against cyber-attacks; the licensee's explanation of the need for additional time is compelling, and it is acceptable for FPL to complete implementation of Milestone 8, full implementation of the CSP, by December 31, 2017. The NRC staff also concludes that upon full implementation of the licensee's CSP, the requirements of the licensee's cyber security program and 10 CFR 73.54 will be met. Therefore, the NRC staff finds that the proposed changes to the Milestone 8 completion date and License Condition 3.E are acceptable.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the NRC staff notified the appropriate State of Florida official (Ms. Cynthia Becker, M.P.H., Chief of the Bureau of Radiation Control, Florida Department of Health) on August 14, 2015, 7 of the proposed issuance of the amendments. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendments relate solely to safeguards matters and do not involve any significant construction impacts. This amendment to a 10 CFR Part 50 license is an administrative change to extend the date by which the licensee must have its CSP fully implemented. Accordingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

Based on the aforementioned considerations, the NRC staff has concluded that (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the

. amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: John Rycyna, NSIR Date: September 28, 2015 7 The NRC staff notified the State official by telephone and by e~mail. The e-mail is in ADAMS under Accession No. ML15226A670.

The NRC staff's safety evaluation of the amendments is enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register notice.

Docket Nos. 50-250 and 50-251

Enclosures:

1. Amendment No. 266 to DPR-31

2. Amendment No. 261 to DPR-41

3. Safety Evaluation Sincerely,

/RA/

Audrey L. Klett, Project Manager Plant Licensing Branch 11-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation cc w/enclosures: Distribution via Listserv DISTRIBUTION:

PUBLIC LPL2-2 R/F RidsNrrLABClayton Rids N rrP MT u rkeypoint RidsNrrDorllpl2-2 RidsNrrDorlDpr RidsACRS_MailCTR RidsRgn2MailCenter RFelts, NSIR JRycyna, NSIR ADAMS A ccess1on N o.: ML15233A379 OFFICE NRR/DORL/LPL2-2/PM NRR/DORL/LPL2-2/LA NAME A Klett BClayton (LRonewicz for)

DATE 09/09/15 09/03/15 OFFICE OGC (NLO)

NRR/DORL/LPL2-2/BC NAME JMaltese SHelton DATE 09/23/15 09/27/15 OFFICIAL RECORD COPY

• b >yema1 NSIR/CSD/DD*

RFelts 07/27/15 NRR/DORL/LPL2-2/PM AKlett 09/28/15