ML15245A482

From kanterella
Jump to navigation Jump to search

Surry Power Station, and North Anna Power Station - Issuance of Amendments to Revise the Cyber Security Milestone 8 Completion Date in the Renewed Facility Operating Licenses
ML15245A482
Person / Time
Site: Millstone, Kewaunee, Surry, North Anna  Dominion icon.png
Issue date: 10/07/2015
From: V Sreenivas
Plant Licensing Branch II
To: Heacock D
Virginia Electric & Power Co (VEPCO)
Sreenivas V
References
TAC MF5708, TAC MF5709, TAC MF5710, TAC MF5711, TAC MF5712, TAC MF5713, TAC MF5714
Download: ML15245A482 (40)
v • d • e


Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 Mr. David A. Heacock President and Chief Nuclear Officer Virginia Electric and Power Company Innsbrook Technical Center 5000 Dominion Boulevard Glen Allen, VA 23060-671 _1 October 7, 2015

SUBJECT:

KEWAUNEE POWER STATION, MILLSTONE POWER STATION, UNIT NOS. 2 AND 3, SURRY POWER STATION; UNIT NOS. 1AND2, AND NORTH ANNA POWER STATION, UNIT NOS. 1AND2-ISSUANCE OF AMENDMENTS TO REVISE THE CYBER SECURITY MILESTONE 8 COMPLETION DATE IN THE RENEWED FACILITY OPERATING LICENSES (TAC NOS. MF5708,-MF5709, MF5710, MF5711, MF5712, MF5713, AND MF5714)

Dear Mr. Heacock:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment Nos. 216, 323, 265, 276, 258, 286 and 286 to Renewed Facility Operating License Nos. DPR-43, DPR-65, NPF-49, NPF-4, NPF-7, DPR-32, DPR-37 for the Kewaunee Power Station, Millstone Power Station, Unit Nos. 2 and 3, North Anna Power Station (NAPS), Unit Nos. 1 and 2, and, Surry Power Station, Unit Nos. 1 and 2, respectively. The amendments change the Technical Specifications (TSs) in response to your application dated November 17, 2014, as supplemented by letter dated August 13, 2015.

These amendments revise the completion date for Milestone 8, full implementation, of the Cyber Security Plan from December 31, 2015 to December 31, 2017.

D. A copy of the Safety Evaluation is also enclosed. A Notice of Issuance will be included in the Commission's biweekly Federal Register ~otice.

Docket Nos. 50~305, 50-336 and 50-423 50-338 and 50-339, 50-280 and 50-281

Enclosures:

1. Amendment No. 216 to DPR-43
2. Amendment No. 323 to DPR-65
3. Amendment No. 265 to NPF-49
4. Amendment.No. 276 to NPF-4
5. Amendment No. 258 to NPF-7
6. Amendment No. 286 to DPR-32
7. Amendment No. 286 to DPR-37
8. Safety Evaluation cc w/encls: Distribution via Listserv Sincerely, Dr. V. Sreenivas, Project Manager Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DOMINION ENERGY KEWAUNEE. INC. (DEK)

DOCKET NO. 50-305 KEWAUNEE POWER STATION AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 216 Renewed License No. DPR-43

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Dominion Energy Kewaunee, Inc. (DEK)

(the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this

'amendment can be conducted without endangering the health and safety of the public; and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to paragraph 2.C.(2) of Renewed Facility Operating License No. DPR-43, as indicated in the attachment to this license amendment, and is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 216, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

Accordingly, Renewed Facility Operating License No. DPR-43 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 210, as supplemented by a change approved by License Amendment No. 216.

4.

This license amendment is effective as of its date of iSsuance and shall be implemented within 30 days of issuance.

Attachment:

Changes to License No. DPR-43 and the Technical Specifications Date of Issuance: Qctober 7, 2o1 s FOR THE NUCLEAR REGULA TORY COMMISSION Jt/J£

'~

Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

UNITED STATES.

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DOMINION NUCLEAR CONNECTICUT, INC.

DOCKET NO. 50-336 MILLSTONE POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 323 Renewed License No. DPR-65

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Dominion Nuclear Connecticut, Inc. (DNC)

(the licensee) dated November 17, 2014, as supplemented by letter dated. -

August ~ 3, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 1 O CFR Chapter I;

  • B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be con.ducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to_ the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2~C.(2) of Renewed Facility Operating License No. DPR-65 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 323 are hereby incorporated into the renewed license.

The licensee shall operate the facility in accordance with the Technical Specifications.

3.

Accordingly, Renewed Facility Operating license No. DPR-65 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 309, as supplemented by a change approved by license Amendment No. 323.

4.

This license amendment is effective as of the date of issuance, and shall be implemented within 30 days of issuance.

Attachment:

Changes to the license and Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant licensing Branch 11-1 Division of Operating Reactor licensing Office of Nuclear Reactor Regulation Date of Issuance: e>ctober 7, 2O1 5

\\j

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 DOMINION NUCLEAR CONNECTICUT, INC.

DOCKET NO. 50-423 MILLSTONE POWER STATION, UNIT NO. 3 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 265 Renewed License No. NPF-49

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Dominion Nuclear Connecticut, Inc. (DNC)

(the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and

. security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to the Technical Specificatioris as 1

indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-49 is hereby amended to.read as follows:

I (2)

Technical Specifications The Technical Specifications contained in Appendix A, revised through Amendment No. 265 and the Environmental Protection Plan contained in

. Appendix B, both of which are attached hereto are hereby incorporated into the license. DNC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

3.

Accordingly, Renewed Facility Operating License No. NPF-49 is also amended by changing the last sentence of paragraph 2.E, to read as follows:

. The CSP was approved by License Amendment No. 251, as supplemented by a change approved by License Amendment No. 265.

4.

This license amendment is effective as of the date of issuance, and shall be implemented within 30 days of issuance.

Attachment:

Changes to the License and Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: October 7, 2015

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-338 NORTH ANNA POWER STATION, UNIT NO. 1 AMENDMENT TO RENEWED.FACILITY OPERATING LICENSE Amendment No. 276 Renewed License No. NPF-4

1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment to North Anna Power Station, Unit 1 (the facility)

Renewed Facility Operating License No. NPF-4 filed by the Virginia Electric and Power Company, (the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

~*

Accordingly, the license is hereby amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-4 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 2'76 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.
  • Accordingly, Renewed Facility Operating License No. NPF-4 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 264, as supplemented by a change approved by License Amendment No. 276.

4.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

Attachment:

Changes to Renewed Facility

  • Operating License No. NPF-4 and the Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION

-~

Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: oc tober 7, 2o1 5

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-339 NORTH ANNA POWER STATION, UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 258 Renewed License No. NPF-7

1.

The U.S. Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment to North Anna Power Station, Unit 2 (the facility)

Renewed Facility Operating License No. NPF-7 filed by the Virginia Electric and Power Company, (the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is hereby amended by changes to the Technical Specifications as indicated in the attachment to this license amendment, and paragraph 2.C.(2) of Renewed Facility Operating License No. NPF-7 is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 258 are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

Accordingly, Renewed Facility Operating License No. NPF-7 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 245, as supplemented by a change approved by License Amendment No. 258.

4.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

Attachment:

Changes to Renewed Facility Operating License No. NPF-7 and the Technical Specifications FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance: October 7, 201 5

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-280 SURRY POWER STATION, UNIT NO. 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 286 Renewed License No. DPR-32

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Virginia Electric and Power Company et al.,

(the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 1 O CFR Chapter I;

8.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.

The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to paragraph 2.C (2) of Renewed Facility Operating License No. DPR-32, as indicated in the attachment to this license amendment, and is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 286, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

Accordingly, Renewed Facility Operating License No. DPR-32 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 276, as supplemented by a change approved by License Amendment No. 286.

4.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

Attachment:

Changes to License No. DPR-32 and the Technical Specifications Date of Issuance: October 7, 2o1 5 FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 2055S-0001 VIRGINIA ELECTRIC AND POWER COMPANY DOCKET NO. 50-281 SURRY POWER STATION. UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 286 Renewed License No. DPR-37

1.

The Nuclear Regulatory Commission (the Commission) has found that:

A.

The application for amendment by Virginia Electric and Power Company et al.,

(the licensee) dated November 17, 2014, as supplemented by letter dated August 13, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B.

The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.

There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations;

  • D.
  • The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.

The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

2.

Accordingly, the license is amended by changes to paragraph 2.C (2) of Renewed Facility Operating License No. DPR-37, as indicated in the attachment to this license amendment, and is hereby amended to read as follows:

(2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 286, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

3.

Accordingly, Renewed Facility Operating License No. DPR-37 is also amended by changing the last sentence of paragraph 2.C.(4) Physical Protection, to read as follows:

The CSP was approved by License Amendment No. 276, as supplemented by a change approved by License Amendment No. 286.

4.

This license amendment is effective as of its date of issuance and shall be implemented within 30 days of issuance.

Attachment:

Changes to License No. DPR-37 and the Technical Specifications Date of Issuance: October 7, 2o1 5 FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch 11-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

ATTACHMENT TO LICENSE AMENDMENT NO. 216 RENEWED FACILITY OPERATING LICENSE NO. DPR-43 DOCKET NO. 50-305 Replace the following pages of the Licenses and the Appendix "A" Technical Specifications (TSs) with the enclosed pages as indicated. The revised pages are identified by amendment number and contain vertical lines indicating the areas of change.

Remove License Pages License Pages License No. DPR-43, page 3 License No. DPR-43, page 3 (4)

Pursuant.to the Act and 1 o CFR Parts 30, 40, and 70, to receive, possess and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form for sample analysis or instrument calibration or associated with radioactive apparatus or components; (5)

Pursuant to the Act and 1 O CFR Parts 30 and 70, to possess', but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility.

C.

This renewed operating license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 1 O CFR Chapter 1:

(1) Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Sections 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and (2) is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and (3) is subject to the additional conditions specified or incorporated below:

(1)

Deleted (2)

Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 216, are hereby incorporated in the renewed license. The licensee shall operate the facility in accordance with the Technical Specifications.

(3)

Deleted (4)

Physical Protection The licensee shall fully implement and maintain in effect all provisjons of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combine.d set of plans, which contains Safeguards Information protected under 1 O CFR 73.21 is entitled:

"Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security Plan (Revision O)" submitted by letter dated October 18, 2004, and supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 210, as supplemented by a change approved by License Amendment No. 216.

(5)

Deleted Renewed Operating License DPR-43 Amendment No~ 216

ATTACHMENT TO LICENSE AMENDMENT NO. 323 RENEWED FACILITY OPERATING LICENSE NO. DPR-65 DOCKET NO. 50-336 AND TO LICENSE AMENDMENT NO. 265 RENEWED FACILITY OPERATING LICENSE NO. NPF-49 DOCKET NO. 50-423 Replace the following pages of the Renewed Facility Operating Licenses and the Appendix "A" Technical Specifications (TSs) with the enclosed pages as indicated. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Remove Pages Licenses License No. DPR-65, page 4 License No. NPF-49, page 7 Insert Pages Licenses License No.. DPR-65, page 4 License No. NPF-49, page 7

(3)

Fire Protection The licensee shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report and as approved in the SER dated September 19, 1978, and

  • supplements dated October 2.1. 1980, November 11, 1981, October 31, 1985, April 15, 1986, January 15, 1987, April 29, 1988, July 17, 1990, and November 3, 1995, subject to the following provision:

The licensee may make changes to the approved Fire Protection Program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

(4)

  • Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}. The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision O" The set contains Safeguards Information protected under 10 CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 309, as supplemented by a change approved by License Amendment No. 3 2 3.

. (5)

Relocated Technical Specifications The licensee shall relocate certain technical specification requirements to licensee-controlled documents as described below. The location of these requirements shall be retained by the licensee.

a.

This license condition approves the relocation of certain technical specification requirements to licensee-controlled documents (Technical Requirements Manual), as described in the licensee's applicatlon dated May 20, 1997, as supplemented on September 23, 1997. The approval is documented in the staff's safety evaluation dated November 19, 1997.

This license condition. is effective as of its date of issuance by Amendment No. 210 and shall be implemented 90 days from the date of issuance.

Implementation shall include the relocation of technical specification*

requirements to the appropriate licensee-controlled document as identified

.in the licensee's application dated May.20, 1997, as supplemented qn *..

  • September 23, 1997.
  • Renewed License No. DPR-65 Re*riseeJ ey bettor date..d Ma:,* 2Q, 2907 Amendment No. 3G9 323 E.

The licensee shall fully Implement and maintain In effect all provisions of the Commission-approved physical security, training, and qualification, and

  • safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 {51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by lette*r dated May 15, 2006, Is entitled; "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision O" The set contains Safeguards Information protected under 1 O CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 251, as supplemented by a change approved by License Amendment No.~*

F.

Deleted.

G.

  • The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims, H.

Fire Protection (Section 9.5. 1, SER SSER 2. SSER 4. SSER 5)

DNC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report for the facmty and as approved in the SER (NUREG-1031) issued July 1985 and Supplements Nos. 2, 4, and 5 1

issued September 1985, November 1985, and January 1986, respectively, subject_ to the following provision:

The licensee may make changes to the approved fire protection program without

,prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

  • I.

This renewed operating license is effective as of its date of issuance and shall expire at midnight on November 25, 2045.

Attachments:

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

J.E. Dyer, Director Office of Nuclear Reactor Regulation

1. Appendix A - Technical Specifications
2. *Appendix B - Environmental Protection Plan

. Date of Issuance:* Nov~rnber, 28, 2005 Renewed License No.. NPF-49 *.

Amendment No. 243,251265

/

ATTACHMENT TO LICENSE AMENDMENT NO. 276 RENEWED FACILITY OPERATING LICENSE NO. NPF-4 DOCKET NO. 50-338 AND TO LICENSE AMENDMENT NO. 258.

RENEWED FACILITY OPERATING LICENSE NO. NPF-7 DOCKET NO. 50-339 Replace the following pages of the Renewed Facility Operating Licenses and the Appendix "A" Technical Specifications (TSs) with the enclosed pages as indicated. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Remove Pages Licenses License No. NPF-4, page 6 License No. NPF-7, page 6 Insert Pages Licenses License No. NPF-4, page 6 License No. NPF-7, page 6

( 4) The licensee Is authorized to receive fromthe Surry Power Station, Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched *to not more than 4.1 percent by weight U-235, subject to the following conditions:

. a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.

b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station reactors no less than 730 days prior to shipment.
c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for storage at the North Anna Power Station,*.Unit Nos. 1and2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B; as revised through Amendment No. 197, is hereby incorporated in the renewed license.

The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described In the Updated Final Safety Analysis Report for

  • the facility and as approved in the SER dated February 1979 subject to the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only If those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event

.of a fire.

E. Physical Protection

. The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and lnd'ependent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan*{CSP), including changes made pursuant to the

. authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP wa~ approved by LicenseAmendmentNo. 264, as supplemented by a change approved by License

  • Amendment No. 2 7 6 ;

NOR'IH ANNA - UNIT I Renewed License No. NPF4 Amendment No..2:1:.f>_

(4) The licensee is authorized to receive from the Surry Nuclear Power Station,

  • Unit Nos. 1 and 2, possess, and store irradiated Surry Power Station fuel assemblies containing special nuclear material, enriched to not more than 4.1 percent by weight U-235, subject to the following conditions:
a. Surry Power Station fuel assemblies may not be placed in North Anna Power Station, Unit Nos. 1 and 2, reactors.
b. Irradiated fuel shipped to North Anna Power Station shall have been removed from the Surry Power Station-reactors no less than 730 days prior to shipment.
c. No more than 500 Surry Power Station irradiated fuel assemblies shall be received for $torage at the North Anna Power Station, Unit Nos. 1 and 2, spent fuel pool.

(5) Environmental Protection Plan The Environmental Protection Plan contained in Appendix B, as revised through Amendment No. 178, is hereby incorporated in the renewed license..

  • The licensee shall operate the facility in accordance with the Environmental Protection Plan.

D. Fire Protection VEPCO shall implement and maintain in effect all provisions of the approved fire protection program as described in the licensee's Updated Final Safety Analysis Report for the facility and as approved in the SER dated February 1979 subject to the following provision:

  • The licensee may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

E. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted *through May 15, 2006.

  • The. licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power.

Stations Cyber Security Plan (CSP), including changes made pursupnt to the

    • License Amendment No. 245, as supplemented by a change approved by License
  • Amendment No.258 NORTH ANNA-UNIT2 Renewed License No. NPF*7 Amendment No. 2 58

ATTACHMENT TO LICENSE AMENDMENT NO. 286 RENEWED FACILITY OPERATING LICENSE NO. DPR-32.

DOCKET NO. 50-280 AND TO LICENSE AMENDMENT NO. 286 RENEWED FACILITY OPERATING LICENSE NO. DPR-37 DOCKET NO. 50-281 Replace the following pages of the Licenses and the Appendix "A" Technical Specifications (TSs) with the enclosed pages as indicated. The revised pages are identified by amendment number and contain vertical lines indicating the areas of change.

Remove License Pages License No. DPR-32, page 4 License No. DPR-37, page 4 License Pages License No. DPR-32, page 4 License No. DPR-37, page 4 July 23, 1992), and the Safety Evaluation issued December 16, 1998, for Technical Specification Amendment No. 217 subject to the following provision:

The licensee may make changes to the approved fire protection program 0 without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualificati~m. and

. safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (Si FR 27817 and 27822) and the authority of 10 CFR 50.90 and iO CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is.entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security

  • Program" with revisions.submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 276, as supplemented by a change approved by license Amendment No. 2...8.L*

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment No. 203 O. Deleted by Amendment 227 P. Updated Final Safety Analysis Report (1) The Updated Final Safety Analysis Report supplement submitted pursuant to 1 O CFR 54.21 (d), as revised on July 25, October 1, November 4, and December 2, 2002, describes certain future inspection activities to be completed before the period of extended operation. The licensee shall complete these activities no later than May 25, 2012, and shall notify the NRC in writing when implementation of the.se activities is complete and can be verified by NRC inspection.:

Surry - Unit 1 Renewed license No. DPR-32 Amen'dment No. _z..a 6

I.

Fire Protection The licensee shall implement and maintain in effect the provisions of the approved fire protection program as described in the Updated Final Safety Analysis Report and as approved in the SER dated September i9, 1979 (and Supplements dated May 29, 1980, October 9, 1980, December 18, 1980, February 13, 1981, December4, 1981, April 27, 1982, November 18, 1982, January 17, 1984, February 25, 1988, and July 23, 1992), and the Safety Evaluation issued December 16, '1998, for Technical Specification Amendment No. 217 subject to

. the following provision:

The licensee may make changes to the approved fire protection program without prior approval of the Commission only If those changes would not adversely affect the ability to achieve and maintain safe shutdown in 1he event.

of a fire.

J. Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 1 O CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan *. and Independent Spent Fuel Storage tnstallatiori Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90and10 CFR 50.54(p). The CSP was approved by License Amendment No. 276, as supplemented by a change approved by License Amendment No. 2 a 6.

K. Deleted by Amendment 227 L. Deleted by Amendment 227 M. Deleted by Amendment 227 N. Deleted by Amendment 203

0. Deleted by Amendment 227

. Surry

  • Unit 2 Renewed License No. DPR*37 Amendment No.~

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 216 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-43 AMENDMENT NO. 323 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-65 AMENDMENT NO. 265 TO RENEWED FACILITY OPERATING LICENSE NO, NPF-49 AMENDMENT NO. 276 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-4 AMENDMENT NO. 258 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-7 AMENDMENT NO. 286 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-32 AMENDMENT NO. 286 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-37 KEWAUNEE POWER STATION, MILLSTONE POWER STATION, UNIT NOS. 2 AND 3 NORTH ANNA POWER STATION, UNIT NOS. 1AND2 SURRY POWER STATION, UNIT NOS. 1 AND 2 DOCKET NOS. 50-305, 50-336 AND 50-423, 50-338 AND 50-339, 50-280 AND 50-281

1.0 INTRODUCTION

By application dated November 17, 2014 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML14329A313), as supplemented by letter dated August 13, 2015, ADAMS Accession No. ML15230A055}, Dominion Energy Kewaunee, Inc. (DEK),

Dominion Nuclear Connecticut, Inc. (DNC), and Virginia Electric and Power Company (Dominion), (the licensee) requested a change to the facility operating licenses (FOL) for Kewaunee Power Station, Millstone Power Station Unit 2 and Unit 3, Surry Power Station Unit 1 and Unit 2 and North Anna Power Station Unit 1 and Unit 2. The proposed change would revise the date of Cyber Security Plan (CSP) Implementation Schedule Milestone 8 and the existing license conditions in the facility operating licenses. Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP.

Portions of the licensee's November 17, 2014 and August 13, 2015, letters contain sensitive unclassified non:-safeguards information and, accordingly, those portions are withheld from public disclosure in accordance with the provisions of Title 1 O of the Code of Federal Regulations (1 O CFR) Section 2.390(d)(1 ). The accession numbers cited in the above paragraph refer to the publicly-available redacted versions.

The supplemental letter dated August 13, 2015, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the NRC staff's original proposed no significant hazards consideration determination as published in the 'Federal Register on May 15, 2015 (80 FR 25718). No comments were received.

2.0 REGULATORY EVALUATION

The NRC staff reviewed and approved (ADAMS Accession Nos. ML112031083 and ML11192A249) the licensee's existing CSP and implementation schedule in License Amendment Nos. 210 for Kewaunee Power Station, License Amendment Nos. 309 and 251 for Millstone Power Station Units 2 and 3, 'License Amendment Nos. 264 and 245 for North Anna Power Station Units 1 and 2, License Amendment No. 276 for Surry Power Station Units 1 and 2, concurrent with the incorporation of the CSP into the facilities' current licensing bases.

The NRC staff considered the following regulatory requirements and guidance in its review of the current license amendment request to modify the existing CSP implementation schedule:

The Code of Federal Regulations 1 O CFR 73.54 states: "Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule.';

The licensee's facility operating licenses include a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

The amendments above which approved the licensee's CSP and implementation schedule, included the following statement: "The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 1 o CFR 50.90 and 1 O CFR 50.54(p)."

In a publicly-available NRC memorandum dated October 24, 2013 (ADAMS Accession No. ML13295A467), the NRC staff listed criteria to consider during evaluations of licensees' requests to postpone their cyber security program implementation date (commonly known as Milestone 8).

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 1 O CFR 73.54, that "[iJmplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRG-approved CSP implementation schedule, thus, will require prior NRC approval as required by 10 CFR 50.90.

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change By Amendments Nos. 210 for Kewaunee Power Station, Amendment Nos. 309 and 251 for Millstone Power Station Units 2 and 3, Amendment Nos. 264 and 245 for North Anna Power Station Units 1 and 2, Amendment No. 276 for Surry Power Station Units 1 and 2, the NRC staff approved the licensee's CSP implementation schedule, as discussed in the safety evaluations issued with the amendments. The implementation schedule had been submitted by the licensee based on a template prepared by NEI [Nuclear Energy Institute], which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML110600218). The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team (CSAT);
2) Identify Critical Systems (CSs) and Critical Digital Assets (CDAs);
3)
  • Install a deterministic one-way device between lower level devices and a firewall between higher level devices;
4) Implement the security control "Access Control For Portable And Mobile Devices";
5) Implement observation and identification of obvious cyber-related tampering to existing insider mitigation rounds;
6) Identify, document, and implement cyber security controls in accordance with "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment;
7) Ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented;
8) Fully implement the CSP for all safety, security and emergency preparedness functions.

Currently, Milestone 8 of the licensee's CSP requires the licensee to fully implement the CSP by December 31, 201 S. In its November 17, 2014 application, the licensee requested to change the Milestone 8 completion date to December 31, 2017 with the exception of North Anna Power Station Unit 1 and Surry Power Station Unit 1 which will be completed by June 30, 2018.

However, as supplemented by letter dated August 13, 2015, the licensee requested that the new full implementation date is proposed to be the same for the entire fleet and revised the CSP implementation schedule to reflect Milestone-8 completion date to December 31, 2017, for North Anna and Surry Units.

The licensee addressed each of the criteria identified in the guidance memorandum cited in Section 2.0 above.

(1)

Identification of the specific requirement or requirements of the CSP that the licensee needs additional time to implement.

The licensee stated that the specific CSP requirement requiring additional time to implement is CSP Section 3.1, "Analyzing Digital Computer Systems and Networks Applying Cyber Security Controls." The licensee provided a list of activities required to implement the CSP requirements. CSP Section 4, "Establishing, Implementing and Maintaining the Cyber Security Program" programmatic elements in support of Milestone 8 have not yet been fully developed and implemented. Portions of Section 4 have been implemented as required to support Milestones 1 through 7, the prioritization of tasks has been focused on the implementation of CSP Section 3, which forms the basis for addressing Section 4 requirements.

(2)

Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee stated the cyber*security project team includes nine full time staff, with significant additional support from Operations, Maintenance, Engineering, Security, and Emergency Preparedness (EP) personnel at each site. There are currently more than 3, 100 CDAs at the sites. There are significant challenges with respect to the proper implementation of Milestone 8. The licensee stated that CDA assessment work is resource-intensive.

The licensee provided the following details regarding CDA scope and security control application issues.

At least one new procedure is being developed to support process changes and several existing procedures are also expected to require revision.

Changes to the assessment framework within the sites' CDA assessment tool must be implemented to reflect the process changes and will require the necessary testing and validation.

Change management and training are required for Cyber Security Assessment Team (CSAT) members and other personnel supporting these processes.

  • . The sites' Security Controls Implementation Strategy (SCIS), which provides guidance on the implementation of security controls, will require modification.

The sites have more than 3, 100 CDAs, which is a larger number than was originally anticipated at the beginning of the project.

Significant time and the direct involvement of experienced plant personnel are necessary to properly evaluate all security controls for this large number of CDAs using the criteria specified in Section 3.'1.6 of the CSP.

The operating sites are in the process of acquiring more resources to perform and manage the amount of work necessary for CDA assessments and control application. Acquiring competent and skilled resources has been a difficult

, and lengthy process.

New digital upgrades to plant systems at operating sites have increased the assessment workload and have impacted the assessment completion date.

The licensee stated that Remediation of Security Control gap items need to be carefully considered because:

A final analysis to accurately identify all gap items (or confirm that all gap items have been addressed) cannot be completed until the uncertainties identified above with CDA scope and security control interpretation have been dispositioned. Interim changes to equipment and processes have been implemented or are in process, but until the final analysis is completed, it is uncertain if the sites would be able to declare Milestone 8 complete.

Modifications to plant systems for security purposes have traditionally not been performed. Application of security controls to industrial control systems is a process that is still being developed industry-wide.

Vendor familiarity with cyber regulatory requirements varies greatly. Several digital upgrades at the sites have introduced challenges based on this lack of understanding resulting in added expense and delays.

Each modification must be carefully analyzed to ensure no impact to plant operations and nuclear safety.

The licensee stated that there are change management challenges, such as:

Cyber security for plant CDAs and the security controls being implemented on the plant CDAs are new to Maintenance, System Engineering and Operations.

CDA modifications must be implemented cautiously to ensure safe, reliable operation of plant equipment. Before modifications are implemented, significant verification analysis and testing must be performed to minimize or eliminate impacts to plant equipment.

Plant modifications to address cyber security controls have created new change management challenges. As cyber security controls are implemented, new tasks are added to normal maintenance activities. The full impact of cyber security controls on the maintenance processes are difficult to predict when plant modifications are initially scoped and developed.

The site training needs and schedules are normally established a year in advance and have to be presented to, and approved by, the sites' Training Review Boards. Cyber security training adds a new burden on training resources that was not fully understood when the new cyber-related processes and procedures were first being developed.

(3)

A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee proposed a Milestone 8 completion date of December 31, 2017. This provides time to complete CDA assessments, implement design modifications based on assessment results, update existing procedures, and develop new programs and procedures and provide training to complete full implementation of the cyber security program. The licensee also stated that changing the completion date of Milestone 8 will encompass additional refueling outages and provides adequate time to complete CDA assessment, implement design modifications based on assessment results, update existing procedures, and develop new procedures to complete full implementation of the

(4)

An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness ofthe licensee's overall cyber security program in the context of milestones already completed.

The licensee indicated based on the cyber security implementation activities already completed, and completion of activities already in progress, its sites are secure and will continue to ensure that digital computer and communication systems and networks are adequately protected against cyber attacks during implementation of the remainder of the program by the requested Milestone 8 dates. The licensee provided details about the implementation of each milestone.

(5)

A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant.

The licensee stated its methodology for prioritizing Milestone 8 activities is centered on considerations for safety, security, EP, and balance of plant (BOP) (continuity of power) consequences. The methodology is based on assessments that evaluate consequence and susceptibility Priority will be assigned to work activities necessary to remediate those CDAs that can have a direct impact on security and safety functions including those with reactivity effects in the balance of plant.

(6)

A discussion of the licensee's cyber security program performance up to the date of the*

license amendment request.

The licensee stated Interim Milestones 1 through 7 activities were completed by December 31, 2012, and provide a high degree of protection against cyber security related attacks until implementation of the full program. The licensee provided discussions about implementing various milestones and then stated NRC Cyber Security Inspections.of Interim Milestones 1 to 7 have been conducted at the operating sites.

The findings were of very low safety significance and upon review by the Security Issues Forum were granted enforcement discretion (ADAMS Accession No. ML13345A355) due to "G,ood-Faith" interpretation and attempt to implement. In advance of each inspection a focused Self-Assessment was also performed. The assessments concluded that the overall implementation was effective but identified several areas for improvement. Issues identified in the inspection and self-assessments are being addressed and will be tracked to completion in the Corrective Action Program (CAP).

There is general consistency between self-assessment results and inspection findings indicating the sites understand program implementation requirements. The licensee also stated Processes have been implemented within the engineering design change process to ensure that any changes to equipment are screened and evaluated for cyber security to ensure the existing level of protection is maintained. This ensures that cyber security is considered for all new equipment an~ that controls in place for existing equipment are maintained.

(7)

A discussion of cyber security issues pending in the licensee's corrective action program.

The licensee stated the sites use the site CAP and the central reporting system (CRS) to document cyber issues in order to trend, correct and improve the Cyber Security Program. The CAP and CRS databases document and track cyber security required actions including issues identified during on-going program assessment activities.

  • Adverse trends are monitored for program improvement and addressed via the CAP and CRS processes. The licensee provided a list of examples of CAP and CRS cyber security items.

(8)

A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee provided a discussion of a completed modification and pending modifications.

3.2

NRC Staff Evaluation

The licensee submitted its application on November 17, 2014, after the NRC staff developed guidance to evaluate requests to postpone Milestone 8 implementation dates on October 24, 2013 (ADAMS Accession No. ML13295A467). The licensee's application addressed each of the criteria identified in the guidance memorandum. The NRC staff evaluated the licensee's application using the regulatory reqwirements and the guidance cited in Section 2.0 above.

The licensee stated that the CSP requirement regarding additional time to implement is found in CSP Section 3.1, 'l\\nalyzing Digital Computer Systems and Networks Applying Cyber Security Controls." The licensee provided a list of additional activities required to implement the CSP requirement.

The NRC staff has had extensive interaction with the nuclear industry since licensees first developed their CSP implementation schedules. Based on this interaction, the NRC staff recognizes that CDA assessment work is much more complex and resource intensive than originally anticipated and that the licensee has a large number of additional tasks not originally considered when developing its CSP implementation schedule.

Accordingly, the NRC staff finds that the licensee's request for additional time to implement Milestone 8 is reasonable given the unanticipated complexity and scope of the work required to come into full compliance with its CSP.

The NRG staff finds thatdelaying final implementation of the cyber security program will provide opportunities to get more work done efficiently and safely during the outages.

Interim Milestones 1 thru 7 activities completed by December 31, 2012, provide a high degree of

, protection against cyber security related attacks until implementation of the full program. The NRG staff concludes thc:it Milestone 1 through 7 provide significant protection against cyber attacks. The CAP is used to document all cyber issues in order to trend, correct, and improve the CSP. The CAP database documents and tracks, from initiation to closure, all cyber security required actions, including issues identified during ongoing program assessment activities.

Adverse trends are monitored for program improvement and addressed via the CAP and CRS process.

The NRG staff finds that based on the large number of digital assets described above and the limited resources with the appropriate expertise to perform these activities, the licensee's methodology for prioritizing work on CDAs is appropriatf:). The NRG staff further finds that the licensee's request to delay final implementation of the CSP until December 31, 2017 is reasonable, given the complexity of the remaining unanticipated work and the need to perform certain work, including design changes, during scheduled fuel outages.

3.3 Revision to License Condition The license condition in Paragraph [2.C.(4)] of renewed FOL No. DPR-43 for Kewaunee Power Station is modified as follows:

Modified license condition for Kewaunee Power Station.

(4)

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Nuclear Management Company Kewaunee Nuclear Power Plant Physical Security Plan (Revision O)" submitted by letter dated October 18, 2004, and supplemented by letter dated October 21, 2004, July 26, 2005, and May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 210, as supplemented by a change approved by License Amendment No. 216.

The license conditions in Paragraph [2.C.(4)] of renewed FOL No. DPR-65 for Millstone Power Station Unit 2 and in Paragraph [2.E.] of renewed FOL No. NPF-49 for Millstone Power.Station Unit 3 are modified as follows:

Modified license condition for Millstone Power Station Unit 2

. (4)

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the~

Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50~54(p).

The combined set of plans, submitted by letter dated October 15, 2004, as supplf3mented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision O" The set contains Safeguards Information protected under 1 O CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 1 O CFR 50.90 and 1 O CFR 50.54(p). The CSP was approved by License Amendment No. 309, as supplemented by a change approved by License Amendment No.323.

Modified license condition for Millstone Power Station Unit 3 E.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training, and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, submitted by letter dated October 15, 2004, as supplemented by letter dated May 15, 2006, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training and Qualification\\Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program, Revision O" The set contains Safeguards Information protected under 1 O CFR 73.21.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 1 O CFR 50.54(p). The CSP wal? approved by License Amendment No. 251, as supplemented by a change approved by License Amendment No. 265.

The license conditions in Paragraph [2.E] of renewed FOL No. NPF-4 for North Anna Power Station Unit 1 and in Paragraph [2.E] of renewed FOL No. NPF-47 for North Anna Power Station Unit 2are modified as follows:*

Modified license condition for North Anna Power Station Unit 1.

E.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817 anti 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 1 O CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP}, including changes made pursuant to the authority of 1 O CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 264, as supplemented by a change approved by License Amendment-No. 276.

Modified license condition for North Anna Power Station Unit 2.

E.

Physical Protection

  • The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817 and 27822} and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Ppwer Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingendy Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 1 O CFR 50.90 and 10 CFR 50.54(p). The CSP was approved by License Amendment No. 245, as supplemented by a change approved by License Amendment No. 258.

The license conditions in Paragraph [3.J] of renewed FOL No. DPR-32 for Surry Power Station Unit 1 and in Paragraph [3.J] of renewed FOL No. DPR-37 for Surry Power Station Unit 2 are modified as follows:

~

Modified license condition for Surry Power Station Unit 1.

J.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 1 O CFR 50.54(p). The CSP was approved by License Amendment No. 276, as supplemented by a change approved by License Amendment No. 286.

Modified license condition for Surry Power Station Unit 2.

J.

Physical Protection The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, guard training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contains Safeguards Information protected under 1 O CFR 73.21, is entitled: "Millstone, North Anna and Surry Power Stations' Security Plan, Training, and Qualification Plan, Safeguards Contingency Plan, and Independent Spent Fuel Storage Installation Security Program" with revisions submitted through May 15, 2006.

, The licensee shall fully implement and maintain in effect all provisions of the Commission-approved Kewaunee, Millstone, North Anna, and Surry Power Stations Cyber Security Plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The CSP was approved, by License Amendment No. 276, as supplemented by a change approved by License Amendment No. 286.

3.4 Summary of Technical Evaluation Based on its review of the licensee's submission, the NRC staff concludes tha.t implementation of Milestones 1 through 7 provides significant protection against cyber attacks; that the licensee's explanation of the need for additional time to December 31, 2017 is compelling, and that it is acceptable for Dominion to complete implementation of Milestone 8, full implementation of the CSP by December 31, 2017 for all of its units. The NRC staff also concludes that, upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 1 O CFR 73.54 will be met. Therefore, the NRC staff finds the proposed change, modified to extend Milestone 8 completion past December 31, 2017, to. be acceptable.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Connecticut, Wisconsin and Virginia State officials were notified of the proposed issuance of the amendments. The State officials had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

These amendments change requirements with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has.

determined that the amendments involve no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The Commission has previously issued a proposed finding that the amendments involye no significant hazards consideration, and there has been no public comment on such finding as published in the Federal Register on May 15 2015 (80 FR 25718). Accord.ingly, the amendments meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendments.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with*the Commission's regulations, and (3) the issuance of the amendments will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: John Rycyna, NSIR Date: October 7, 2015

ML15245A482 OFFICE NRR/LPL2-1/PM NRR/LPL2-1 /LA NRR/LPL 1-1/PM NAME VSreenivas SFigueroa RGuzman DATE 09/01/15 09/03/15 09/28/15 OFFICE NMSS/DUWP/RDB/BC NSIR/CSD/DD*

OGC-NLO w/comments NAME BWatson RFelts Llondon DATE 09/29/15 07/29/15 09/25/15

Retrieved from "https://kanterella.com/w/index.php?title=ML15245A482&oldid=5184025"