ML15328A059

Issuance of Amendment No. 214, Request to Revise Operating License Condition Related to Cyber Security Plan Milestone 8 Full Implementation Date

ML15328A059
Person / Time
Site:	Callaway
Issue date:	01/28/2016
From:	Klos L Plant Licensing Branch IV
To:	Diya F Union Electric Co
Klos L
References
CAC MF6180
Download: ML15328A059 (14)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 January 28, 2016 Mr. Fadi Diya Senior Vice President and Chief Nuclear Officer Union Electric Company P.O. Box 620 Fulton, MO 65251

SUBJECT:

CALLAWAY PLANT, UNIT 1 - ISSUANCE OF AMENDMENT RE: CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE (CAC NO. MF6180)

Dear Mr. Diya:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment No. 214 to Renewed Facility Operating License No. NPF-30 for the Callaway Plant, Unit 1. The amendment consists of changes to the operating license in response to your application dated April 29, 2015.

The amendment approves the revised schedule for full implementation of the cyber security plan (CSP) and revises Paragraph 2.E of Renewed Facility Operating License No. NPF-30 for the Callaway Plant, Unit 1, to incorporate the revised CSP implementation schedule.

A copy of our related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Since;e:, lit/i_

L. k*Ki:. Project Manager Plant L~nsing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-483

Enclosures:

1. Amendment No. 214 to NPF-30

2. Safety Evaluation cc: Distribution via Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 UNION ELECTRIC COMPANY CALLAWAY PLANT, UNIT 1 DOCKET NO. 50-483 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 214 License No. NPF-30

1. The Nuclear Regulatory Commission (the Commission) has found that:

A The application for amendment by Union Electric Company (UE, the licensee),

dated April 29, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act) and the Commission's regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, the license is amended by a change to Paragraph 2.E of Renewed Facility Operating License No. NPF-30 as indicated in the attachment to this license amendment, and Paragraph 2.E is hereby amended to read as follows:

E. UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}. The combined set of plans, which contain Safeguards Information protected under 10 CFR 10 CFR 73.21, are entitled:

"Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006.

UE shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP}, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Callaway Plant Unit 1 CSP was approved by License Amendment No. 203, as supplemented by changes approved per License Amendment No. 214.

3. This license amendment is effective as of the date of its issuance and shall be implemented within 90 days from the date of issuance. The implementation of the CSP, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee on April 29, 2015, and approved by the NRC with this license amendment. All subsequent changes to the NRG-approved CSP implementation schedule as approved by the NRC staff with this license amendment will require prior NRC approval pursuant to 10 CFR 50.90.

FOR THE NUCLEAR REGULATORY COMMISSION Robert J. Pascarelli, Chief Plant Licensing Branch IV-1 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. NPF-30 Date of Issuance: January 28, 201 6

ATTACHMENT TO LICENSE AMENDMENT NO. 214 RENEWED FACILITY OPERATING LICENSE NO. NPF-30 DOCKET NO. 50-483 Replace the following page of the Renewed Facility Operating License No. NPF-30 with the attached revised page. The revised page is identified by amendment number and contains marginal lines indicating the areas of change.

Facility Operating License REMOVE INSERT

1. In order to ensure that the threads for RPV closure stud hole No. 18 can perform their intended function throughout the period of extended operation, UE shall remove stuck stud No. 18. If repair of stud hole No. 18 is required following removal of the stud, the repair plan shall include inspection of the stud hole prior to and after the completion of the repair.

2. In order to ensure that RPV stud holes with damaged threads can continue to perform their intended function throughout the period of extended operation, UE shall perform a laser inspection for the threads of repaired RPV stud hole location Nos. 2, 4, 5, 7, 9, and 53. If inspection of these RPV stud holes reveals that there is additional degradation in any of these stud holes, the condition will be entered in the Corrective Action Program for evaluation and corrective action, and UE shall also inspect the remaining repaired RPV stud hole locations (Nos. 13, 25, 39 and 54).

D. An Exemption from certain requirements of Appendix J to 10 CFR Part 50, are described in the October 9, 1984 staff letter. This exemption is authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. Therefore, this exemption is hereby granted pursuant to 10 CFR 50.12. With the granting of this exemption the facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission.

E. UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 10 CFR 73.21, are entitled: "Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006.

UE shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Callaway Plant Unit 1 CSP was approved by License Amendment No. 203, as supplemented by changes approved per License Amendment No. 214.

F. Deleted per Amendment No. 169.

G. UE shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

Renewed License No. NPF-30 Amendment No. 214

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 214 TO RENEWED FACILITY OPERATING LICENSE NO. NPF-30 UNION ELECTRIC COMPANY CALLAWAY PLANT. UNIT 1 DOCKET NO. 50-483

1.0 INTRODUCTION

By application dated April 29, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15120A482), Union Electric Company, dba Ameren Missouri (UE, the licensee) requested changes to Renewed Facility Operating License No. NPF-30 for the Callaway Plant, Unit 1 (Callaway).

The proposed change would revise the date of Cyber Security Plan (CSP) Implementation Schedule Milestone 8 and Paragraph 2.E in the renewed facility operating license. Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP. Portions of the letter dated April 29, 2015, contain sensitive unclassified non-safeguards information (security-related) and, accordingly, those portions are withheld from public disclosure pursuant to Section 2.390 of Title of the Code of Federal Regulations (10 CFR).

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRC) staff reviewed and approved the licensee's existing CSP implementation schedule by letter dated August 17, 2011, Amendment No. 203 (ADAMS Accession No. ML112140087), concurrent with the incorporation of the CSP into the facility's licensing basis. The NRC staff considered the following regulatory requirements and guidance in its review of the current license amendment request to modify the existing CSP implementation schedule:

• Title 10 of the Code of Federal Regulations (10 CFR), Section 73.54, "Protection of digital computer and communication systems and networks," which states, in part: "Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule."

Enclosure 2

• The licensee's renewed facility operating license includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

• Review criteria provided by the NRC staff's internal memorandum, "Review Criteria for Title 10 of the Code of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests," dated October 24, 2013 (ADAMS Accession No. ML13295A467), to be considered for evaluating licensees' requests to postpone their cyber security program's full implementation dates (commonly known as Milestone 8).

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that states, "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRG-approved CSP implementation schedule, thus, will require prior NRC approval as required by 10 CFR 50.90.

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change The NRC staff issued Amendment No. 203 to Renewed Facility Operating License No. NFP-30 for Callaway by letter dated August 17, 2011. This amendment approved the CSP and associated implementation schedule, and added a license condition requiring the licensee to fully implement and maintain the Commission-approved CSP. The implementation schedule was based on a template prepared by the Nuclear Energy Institute (NEI), which was transmitted to the NRC by letter dated February 28, 2011 (ADAMS Accession No. ML110600206). By letter dated March 1, 2011, the NRC staff found the NEI template acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML110070348). The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team (CSAT);

2) Identify Critical Systems (CSs) and Critical Digital Assets (CDAs);

3) Install deterministic one-way devices between lower level devices and higher level devices;

4) Implement the security control "Access Control for Portable and Mobile Devices";

5) Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements;

6) Identify, document, and implement technical cyber security controls in accordance with Mitigation of Vulnerabilities and Application of Cyber Security Controls for CDAs that could adversely impact the design function of physical security target set equipment;

7) Ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented; and

8) Fully implement the CSP.

Currently, Milestone 8 of the Callaway CSP requires the licensee to fully implement the CSP by May 31, 2016. In its application dated April 29, 2015, the licensee proposed to change the Milestone 8 completion date to December 31, 2017.

The licensee provided the following information pertinent to each of the criteria identified in the NRC guidance memorandum dated October 24, 2013.

1. Identification of the specific requirement or requirements of the cyber security plan that the licensee needs additional time to implement.

The licensee stated that the activities described in CSP Section 3.1, "Analyzing Digital Computer Systems and Networks and Applying Cyber Security Controls," requires additional time to implement. In this section, the licensee stated that it needed additional time to implement the following specific items: CDA assessment work; remediation activities; change management; and training on new programs, processes and procedures. The licensee also stated in this section that one additional refueling outage was needed for implementation of modifications required as a result of the CDA assessments.

2. Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee stated it is experiencing major challenges with full implementation of Milestone 8 and provided details about each of the challenges identified in 1) above. The licensee also stated that the number of CDAs involved in completing Milestone 8 is significant and the related actions necessary, including documentation of the CDA assessment and analysis work, does not support the current completion date. The licensee further stated that any changes involving CDAs are plant-specific and must be integrated with plant operations, engineering groups and plant suppliers while also ensuring that there are no impacts to operation and safety.

Additionally, the current completion date does not allow sufficient time for modifications, change management planning activities and training.

3. A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee stated that the revised completion date allows the necessary time to complete assessments, implement the necessary actions and design modifications, update and create new procedures while providing the training that will support full and complete implementation of the CSP. The revised completion date also will include a refuel outage to support the activities above.

4. An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.

The licensee stated that the activities already completed with respect to Milestones 1 through 7 provide adequate protection against cyber attacks currently, and will continue to do so during the period of the proposed Milestone 8 full implementation date. The licensee also provided details about the implementation of Milestones 1 through 7.

5. A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant.

The licensee stated that prioritizing completion of the work is based on considerations of Emergency Preparedness, Balance of Plant consequences, safety, and security based on a defense-in-depth methodology while considering susceptibilities to common threats. The licensee also stated that this methodology considers the requirements for a refueling outage based mitigation actions.

6. A discussion of the licensee's cyber security program performance up to the date of the license amendment request.

The licensee stated that completed activities provide a high degree of protection against cyber security-related attacks currently and will continue to do so during implementation of the full program. The licensee also provided discussions about implementing various milestones and then stated engineering design modification process requires cyber security reviews for all digital modifications. The licensee further stated that the use of comprehensive self-assessments and current, and future quality assurance surveillances document an effective program.

7. A discussion of cyber security issues pending in the licensee's corrective action program (CAP).

The licensee stated that the CAP program acts as part of the CSP to document, track, and allow initiation of actions and issues for later closure. The licensee also stated that the CAP is used to trend and allow improvement of the CSP and provided examples of issues and activities in the CAP.

8. A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee provided a discussion of completed modifications and modifications based on CDA assessments in progress.

3.2 NRC Staff Evaluation The NRC staff has evaluated the licensee's application using the regulatory requirements and guidance above. The NRC staff's evaluation is below. The NRC staff has reviewed Section 3.1 of the CSP, "Analyzing Digital Computer systems and Networks and Applying Cyber Security Controls," and concludes that the challenges to implement the CSP are reasonable as discussed below.

As described in Section 3.1 above, the licensee stated that completion of Milestones 1-7 of the CSP provide a high degree of protection against cyber attacks. The NRC staff concludes that completion of Milestones 1 through 7 provides significant protection against cyber attacks because the activities the licensee has completed mitigate the most significant cyber attack vectors for the most significant CDAs. Therefore, the NRC has reasonable assurance that full implementation of the CSP by December 31, 2017, will provide adequate protection of the public health and safety and the common defense and security.

The licensee indicated that the scope of actions and resources required to fully implement its CSP were not anticipated when the implementation schedule was originally determined. The NRC staff recognizes that CDA assessment work is much more complex and resource-intensive than originally anticipated and that the licensee has a large number of additional tasks not originally considered when developing its CSP implementation schedule, in part due to the NRC expanding the scope of the cyber security requirements to include balance of plant. As a result, the licensee has a large number of tasks not originally considered when developing its CSP implementation schedule. Therefore, the NRC staff concludes that there are implementation issues with the licensee's large numbers of CDAs, which includes a need to address security controls for each and that the CDA assessment work is resource-intensive, and time consuming. The NRC staff also concludes that the licensee's explanation of the need for additional time is reasonable, and the licensee will not be able to fully implement its CSP by May 31, 2016. Therefore, the NRC staff concludes that the licensee's request for additional time to implement Milestone 8 is reasonable given the unanticipated complexity, volume, and scope of the remaining work required to fully implement its CSP.

The NRC staff has also reviewed the licensee's methodology for prioritizing work completion.

As described in Section 3.1 above, the licensee explained that prioritizing completion of work is based on a number of factors including, for example, considerations of Emergency Preparedness, BOP consequences, safety and security, and that the revised completion date will support work during an outage. The NRC staff concludes that the licensee's progress toward full implementation is reasonable and that the impact of the requested additional implementation time on the effectiveness of the overall cyber security program is being effectively managed. The NRC staff concludes that the licensee is using tools at its disposal to implement, verify, improve, and evolve the cyber security program such as the CAP program and that, given the large number of digital assets and limited resources, the licensee's

methodology for prioritizing work on CDAs is appropriate. The NRC staff also concludes that delaying final implementation of the cyber security program will provide an opportunity to plan and perform more work safely during the outage.

3.3 Technical Evaluation Conclusion Based on its review of the licensee's submission, the NRC staff concludes that the licensee's request to delay full implementation of its CSP until December 31, 3017, is reasonable for the following reasons: (i) the licensee's implementation of Milestones 1 through 7 provides significant protection against cyber attacks; (ii) the scope of work required to come into full compliance with the CSP implementation schedule was much more complicated than anticipated and not reasonably foreseeable when the CSP implementation schedule was originally developed and (iii) the licensee has reasonably prioritized and scheduled the work required to come into full compliance with its CSP implementation schedule.

3.4 Revision to License Condition 2.E By letter dated April 29, 2015, the licensee proposed to modify Paragraph 2.E of Renewed Facility Operating License No. NPF-30 for Callaway, which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

Current Paragraph 2.E of Renewed Facility Operating License No. NPF-30 states:

UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 10 CFR 73.21, are entitled: "Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006.

UE shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Callaway Plant Unit 1 CSP was approved by Amendment No. 203.

Revised Paragraph 2.E of Renewed Facility Operating License No. NPF-30 would state:

UE shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards

Information protected under 10 CFR 10 CFR 73.21, are entitled: "Callaway Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision O" submitted by letter dated October 20, 2004, as supplemented by the letter May 11, 2006.

UE shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Callaway Plant Unit 1 CSP was approved by Amendment No. 203, as supplemented by changes approved per License Amendment No. 214.

Based on the information in Section 3.0 of this safety evaluation and the modified license condition described above, the NRC staff concludes this condition is acceptable.

4.0 REGULATORY COMMITMENTS By letter dated April 29, 2015, the licensee made the following commitment:

Fully implement the Cyber Security Plan for all Safety, Security, and Emergency Preparedness functions.

Due date/Event: December 31, 2017 The above commitment is consistent with the revised Milestone 8 implementation date proposed by the licensee and evaluated by the NRC staff.

5.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Missouri State official, Mr. R. Stout, was notified on November 6, 2015, of the proposed issuance of the amendment. The State official had no comments.

6.0 ENVIRONMENTAL CONSIDERATION

This is an amendment to a 10 CFR Part 50 license that relates solely to safeguards matters and does not involve any significant construction impacts. This amendment is an administrative change to extend the date by which the licensee must have its CSP fully implemented.

Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

7.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: J. Klos, J. Rycyna Date: January 28, 2016

ML15328A059 *SE email dated **via email OFFICE NRR/DORL/LPL4-1/PM NRR/DORL/LPL4-1 /LA NSIR/CSD/DD*

NAME JKlos JBurkhardt RFelts DATE 1/10/16 1/8/16 11/4/15 OFFICE OGC (NLO)** NRR/DORL/LPL4-1/BC NRR/DORL/LPL4-1 /PM NAME JBielski RPascarelli JKlos DATE 1/21/16 1/27/16 1/28/16