ML16077A270
| ML16077A270 | |
| Person / Time | |
|---|---|
| Site: | Waterford  |
| Issue date: | 05/10/2016 |
| From: | April Pulvirenti Plant Licensing Branch IV |
| To: | Entergy Operations |
| Pulvirenti A | |
| References | |
| CAC MF6451 | |
| Download: ML16077A270 (13) | |
Text
UNITED ST ATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 May 10, 2016 Site Vice President Entergy Operations, Inc.
Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093
SUBJECT:
WATERFORD STEAM ELECTRIC STATION, UNIT 3-ISSUANCE OF AMENDMENT RE: CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE (CAC NO. MF6451)
Dear Sir or Madam:
The U.S. Nuclear Regulatory Commission (NRC) has issued the enclosed Amendment No. 247 to Facility Operating License No. NPF-38 for the Waterford Steam Electric Station, Unit 3 (WF3). This amendment consists of changes to the facility operating license in response to your application dated June 29, 2015.
The amendment approves the revised schedule for full implementation of the cyber security plan (CSP) from June 30, 2016 to December 15, 2017 and revises Paragraph 2.E of Facility Operating License No. NPF-38 for WF3, to incorporate the revised CSP implementation schedule.
A copy of the related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.
Docket No. 50-382
Enclosures:
- 1. Amendment No. 247 to NPF-38
- 2. Safety Evaluation cc: Distribution via Listserv Sincerely, April L. Pulvirenti, Project Manager Plant Licensing IV-2 and Decommissioning Transition Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation
UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 ENTERGY OPERATIONS, INC.
DOCKET NO. 50-382 WATERFORD STEAM ELECTRIC STATION, UNIT 3 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 247 License No. NPF-38
- 1.
The Nuclear Regulatory Commission (the Commission) has found that:
A.
The application for amendment by Entergy Operations, Inc. (EOI, the licensee),
dated June 29, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 1 O CFR Chapter I; B.
The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C.
There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D.
The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E.
The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.
- 2.
Accordingly, the license is amended as indicated in the attachment to this license amendment, and Paragraph 2.E of Facility Operating License No. NPF-38 is hereby amended to read, in part, as follows:
EOI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).
The EOI CSP was approved by License Amendment No. 234 and supplemented by a change approved by Amendment Nos. 239, 241, and 247.
- 3.
This license amendment is effective as of its date of issuance and shall be implemented within 30 days from the date of issuance. The full implementation of the CSP shall be in accordance with the implementation schedule submitted by the licensee on June 29, 2015, and approved by the NRC staff with this license amendment. All subsequent changes to the NRG-approved CSP implementation schedule will require NRC approval pursuant to 1 O CFR 50.90.
Attachment:
Changes to the Facility Operating License No. NPF-38 FOR THE NUCLEAR REGULA TORY COMMISSION Meena K. Khanna, Chief Plant Licensing IV-2 and Decommissioning Transition Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Date of Issuance:
May 1 o, 201 6
ATTACHMENT TO LICENSE AMENDMENT NO. 247 TO FACILITY OPERATING LICENSE NO. NPF-38 DOCKET NO. 50-382 Replace the following page of the Facility Operating License No. NPF-38 with the attached revised page. The revised page is identified by amendment number and contains a marginal line indicating the area of change.
Facility Operating License REMOVE INSERT E.
EOI shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plan, which contains Safeguards Information protected under 10 CFR 73.21, is entitled: "Physical Security, Safeguards Contingency and Training & Qualification Plan," and was submitted on October 4, 2004.
EOI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The EOI CSP was approved by License Amendment No. 234 and supplemented by a change approved by Amendment Nos. 239, 241, and 247.
F.
Except as otherwise provided in the Technical Specifications or the Environmental Protection Plan, EOI shall report any violations of the requirements contained in Section 2.C of this license in the following manner.
Initial notification shall be made within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to the NRC Operations Center via the Emergency Notification System with written follow-up within 30 days in accordance with the procedures described in 10 CFR 50.73(b), (c) and (e).
G.
Entergy Louisiana, LLC shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.
H.
This license is effective as the date of issuance and shall expire at midnight on December 18, 2024.
Enclosures:
- 1. (DELETED)
- 2. Attachment 2 FOR THE NUCLEAR REGULATORY COMMISSION original signed by H.R. Denton Harold R. Denton, Director Office of Nuclear Reactor Regulation
- 3. Appendix A (Technical Specifications) (NUREG-1117)
- 4. Appendix B (Environmental Protection Plan)
- 5. Appendix C (Antitrust Conditions)
Date of Issuance: March 16, 1985 AMENDMENT NO. ~
~
247
UNITED ST ATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 247 TO FACILITY OPERATING LICENSE NO. NPF-38 ENTERGY OPERATIONS, INC.
WATERFORD STEAM ELECTRIC STATION, UNIT 3 DOCKET NO. 50-382
1.0 INTRODUCTION
By application dated June 29, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML15182A152), Entergy Operations, Inc. (Entergy or EOI, the licensee), requested a change to the facility operating license (FOL) for Waterford Steam Electric Station, Unit 3 (WF3). The proposed change would revise the date of the Cyber Security Plan (CSP) Implementation Schedule Milestone 8 and the existing license condition in the FOL. Milestone 8 of the CSP implementation schedule concerns the full implementation of the CSP.
The U.S. Nuclear Regulatory Commission (NRC) staff initially reviewed and approved the licensee's Cyber Security Plan (CSP) implementation schedule for WF3 by Amendment No. 234 dated July 20, 2011 (ADAMS Accession No. ML111800021). Subsequently, the NRC staff reviewed and approved Amendment No. 241 dated December 10, 2014 (ADAMS Accession No. ML14321A713), which extended the CSP implementation schedule.
Amendment No. 241 required WF3 to fully implement and maintain all provisions of the CSP no later than June 30, 2016.
The proposed change would revise the completion date of the CSP Implementation Schedule Milestone 8 and Paragraph 2.E in the FOL from June 30, 2016 to December 15, 2017.
Milestone 8 of the CSP implementation schedule and Paragraph 2.E concern the full implementation of the CSP. The NRC issued a proposed finding that the amendment involves no significant hazards consideration in the Federal Register on September 1, 2015 (80 FR 52805).
2.0 REGULATORY EVALUATION
The NRC staff considered the following regulatory requirements and guidance in its review of the license amendment request (LAR) to modify the existing CSP implementation schedule:
Title 10 of the Code of Federal Regulations (10 CFR) Section 73.54, "Protection of digital computer and communication systems and networks," which states, in part:
Each [CSP] submittal must include a proposed implementation schedule.
Implementation of the licensee's cyber security program must be consistent with the approved schedule.
The licensee's FOL includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.
Review criteria provided by the NRC Memorandum, "Review Criteria for Title 10 of the Code of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests," dated October 24, 2013 (ADAMS Accession No. ML13295A467), to be considered for evaluating licensees' requests to postpone their cyber security program implementation date (commonly known as Milestone 8).
The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 1 O CFR 73.54, that states, "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRC-approved CSP implementation schedule, thus, will require prior NRC approval as required by 10 CFR 50.90, "Application for amendment of license, contruction permit, or early site permit."
3.0 TECHNICAL EVALUATION
3.1 Licensee's Requested Change Amendment No. 241 to FOL NPF-38 for WF3 was issued by letter dated December 10, 2014.
The NRC staff approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with the amendment. The implementation schedule was based on a template prepared by the Nuclear Energy Institute (NEI), which was transmitted to the NRC by letter dated February 28, 2011 (ADAMS Accession No. ML110600206). By letter dated March 1, 2011, the NRC staff found the NEI template acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML110070348). The licensee's proposed implementation schedule for the Cyber Security Program identified completion dates and bases for the following eight milestones:
- 1) Establish the Cyber Security Assessment Team (CSAT);
- 3) Install deterministic one-way devices between lower level devices and higher level devices;
- 4) Implement the security control "Access Control For Portable And Mobile Devices";
- 5) Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements;
- 6) Identify, document, and implement technical cyber security controls in accordance with Mitigation of Vulnerabilities and Application of Cyber Security Controls for CDAs that could adversely impact the design function of physical security target set equipment;
- 7) Ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented;
- 8) Fully implement the CSP.
Currently, Milestone 8 of the WF3 CSP requires the licensee to fully implement the CSP by June 30, 2016. By letter dated June 29, 2015, Entergy proposed to change the Milestone 8 completion date to December 15, 2017.
The licensee provided the following information pertinent to each of the criteria identified in the NRC Memorandum dated October 24, 2013, as summarized below.
- 1.
Identification of the specific requirement or requirements of the cyber security plan that the licensee needs additional time to implement.
The licensee stated that the following requirements of the CSP require additional time to implement: Section 3, "Analyzing Digital Computer Systems and Networks," and Section 4, "Establishing, Implementing and Maintaining the Cyber Security Program." The licensee further noted that these sections describe the process for application and maintenance of cyber security controls and the process of addressing security controls.
- 2.
Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.
In its letter dated June 29, 2015, the licensee stated, in part, that it had hosted a pilot Milestone 8 inspection at the Indian Point site in March 2014. During the pilot, insight was gained into the NRC perspective on how to apply the cyber security controls listed in NEI 08-09, Revision 6 ["Cyber Security Plan for Nuclear Power Reactors" (ADAMS Accession No. ML101180437)]. During the pilot inspection, the NRC team reviewed several examples of critical digital assets (CDAs) with Entergy and indicated the level of detail and depth expected for the technical analyses against cyber security controls referenced in NEI 08-09. Based on this review, Entergy stated that the detail and depth of the technical analysis exceeds Entergy's prior understanding and necessitates a greater effort to achieve than initially anticipated.
The licensee also stated that during 2015, each operating Entergy licensee has an inspection of compliance with interim Milestones 1 through 7. The preparation for and support of these inspections has required a significant commitment of time from Entergy's most knowledgeable subject matter experts on nuclear cyber security, exceeding the estimate previously developed and therefore, drawing those resources away from Milestone 8 implementation activities.
- 3.
A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.
The licensee proposed a Milestone 8 completion date of December 15, 2017. As discussed in the licensee's response to criterion (2) above, the proposed completion date for Milesone 8 primarily based on Entergy's assessment of the pilot inspection.
Entergy states that the remaining work, including the detail and depth of the technical analysis, exceeds the licensee's prior understanding and necessitates a greater effort to achieve than initially anticipated.
- 4.
An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.
The licensee indicated that the impact of the requested additional implementation time on the effectiveness of the overall cyber security program is very low. The milestones already completed have resulted in a high degree of protection of safety-related, important-to-safety, and security CDAs against common threat vectors. The licensee also stated, in part, that
"[a]dditionally, extensive physical and administrative measures are already in place for CDAs because they are plant components pursuant to the Physical Security Plan and Technical Specification Requirements." The licensee then provided details about implementation of Milestones 1 through 8.
- 5.
A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant.
The licensee stated, in part, that because CDAs are plant components, prioritization follows the normal work management process that places the highest priority on apparent conditions adverse to quality in system, structure, and component design function, on related factors such as safety risk and nuclear defense-in-depth, as well as threats to continuity of electric power generation in the balance of plant. High focus continues to be maintained on prompt attention to any emergent issue with these CDAs that would potentially challenge the established cyber protective barriers. Additionally, it should be noted that these CDAs encompass those associated with physical security target sets.
- 6.
A discussion of the licensee's cyber security program performance up to the date of the license amendment request.
The licensee stated there has been no identified compromise safety, security, and emergency preparedness (SSEP) functions by cyber means at any Entergy plant. It also noted a formal Quality Assurance audit in the last quarter of 2013, which included a review of the cyber security program implementation with no significant findings related to cyber security program performance and effectiveness.
- 7.
A discussion of cyber security issues pending in the licensee's corrective action program (CAP).
The licensee stated, in part, that there are presently no significant (constituting a threat to a CDA via cyber means or calling into question program effectiveness) nuclear cyber security issues pending in the [WF3] CAP. However, several non-significant issues identified during the quality assurance audit described above have been entered into CAP.
- 8.
A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.
The licensee discussed completed modifications and pending modifications.
3.2
NRC Staff Evaluation
The NRC staff has evaluated the licensee's application using the regulatory requirements and guidance above. The NRC staff finds that the actions the licensee noted as being required to implement from the CSP, Section 3, "Analyzing Digital Computer Systems and Networks," and Section 4, "Establishing, Implementing and Maintaining the Cyber Security Program," are reasonable, as discussed below.
The licensee indicated that completion of the activities associated with the CSP, as described in Milestones 1 through 7, were completed prior to December 31, 2012, and provide a high degree of protection to ensure that the most significant digital computer and communication systems and networks associated with SSEP functions are protected against cyber attacks. The NRC staff concludes that the licensee's site is more secure after the implementation of Milestones 1 through 7 because the activities that the licensee has completed mitigate the most significant cyber attack vectors for the most significant CDAs. Therefore, the NRC has reasonable assurance that full implementation of the CSP by December 15, 2017, will provide adequate protection of the public health and safety and the common defense and security.
The licensee has stated that the scope of actions and resources required to fully implement its CSP were not anticipated when their implementation schedule was originally determined. The NRC staff has had extensive interaction with the nuclear industry since licensees first developed their CSP implementation schedules. Based on this interaction, the NRC staff recognizes that CDA assessment work to include application of controls is more complex and resource intensive than the licensee originally anticipated. As a result, the licensee has a large number of additional tasks not originally considered when developing its CSP implementation schedule.
The NRC staff finds that the licensee's request for additional time to implement Milestone 8 is reasonable given the complexity and scope of the work required to come into full compliance with its CSP.
The licensee proposed a Milestone 8 completion date of December 15, 2017. The licensee stated its methodology for prioritizing Milestone 8 activities follows the normal work management process that places the highest priority on apparent conditions adverse to quality in system, structure, and component design function, and related to factors, such as, safety risk and nuclear defense-in-depth, as well as threats to continuity of electric power generation in the Balance-of-Plant. The NRC staff finds the licensee's methodology for prioritizing work on the CDAs, and schedule for pending modifications is appropriate. The NRC staff further finds that the licensees request to delay final implementation of the CSP until December 15, 2017, is reasonable given the complexity of the remaining work.
3.3 Technical Evaluation Conclusion
The NRC staff concludes that the licensee's request to delay full implementation of its CSP until December 15, 2017, is reasonable for the following reasons: (i) the licensee's implementation of Milestones 1 through 7 provides mitigation for significant cyber attack vectors for the most significant CDAs as discussed in the staff evaluation above; (ii) the scope of the work required to come into full compliance with the CSP implementation schedule was more complicated than the licensee anticipated when the CSP implementation schedule was originally developed; and (iii) the licensee has reasonably prioritized and scheduled the work required to come into full compliance with its CSP implementation schedule. Therefore, the NRC staff finds the proposed change acceptable.
3.4 Revision to License Condition 2.E By letter dated June 29, 2015, the licensee proposed to modify Paragraph 2.E of FOL No. NPF-38, which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP.
The revised license condition in Paragraph 2. E of FOL No. NPF-38 for WF3 would state:
EOI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The EOI CSP was approved by License Amendment No. 234 and supplemented by a change approved by Amendment Nos. 239, 241, and 247.
It should be noted that the revised page of the license differs from that indicated by the proposed marked-up version submitted along with the original LAR by letter dated June 29, 2015. This difference is due to a change in the license pages preceding Paragraph 2.E as a result of Amendment No. 246, "Changes to Technical Specification 3.1.3.4 Regarding Control Element Assembly Drop Times" (ADAMS Accession No. ML15289A143), dated November 13, 2015. Amendment No. 246 was submitted by letter dated July 2, 2015, and issued on November 13, 2015, during the review period of the current amendment.
Based on the information in Section 3.0 of this safety evaluation and the modified license condition described above, the NRC staff concludes that these changes are acceptable.
4.0 REGULATORY COMMITMENTS By letter dated June 29, 2015, the licensee made the following regulatory commitment:
Full implementation of the Waterford 3 Cyber Security Plan for all safety, security, and emergency preparedness functions will be achieved.
Scheduled Completion Date: December 15, 2017 The above stated commitment is consistent with the revised Milestone 8 implementation date proposed by the licensee and evaluated by the NRC staff.
5.0 STATE CONSULTATION
In accordance with the Commission's regulations, the Louisiana State official was notified of the proposed issuance of the amendment. The Louisiana State official had no comments.
6.0 ENVIRONMENTAL CONSIDERATION
This is an amendment to a 10 CFR Part 50 license that relates solely to safeguards matters and does not involve any significant construction impacts. This amendment is an administrative change to extend the date by which the licensee must have its CSP fully implemented.
Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.
7.0 CONCLUSION
The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.
Principal Contributor: J. Rycyna, NSIR/CSD Date:
May 1 O, 2016
Site Vice President Entergy Operations, Inc.
May 10, 2016 Waterford Steam Electric Station, Unit 3 17265 River Road Killona, LA 70057-3093
SUBJECT:
WATERFORD STEAM ELECTRIC STATION, UNIT 3 - ISSUANCE OF AMENDMENT RE: CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE (CAC NO. MF6451)
Dear Sir or Madam:
The U.S. Nuclear Regulatory Commission (NRC) has issued the enclosed Amendment No. 247 to Facility Operating License No. NPF-38 for the Waterford Steam Electric Station, Unit 3 (WF3). This amendment consists of changes to the facility operating license in response to your application dated June 29, 2015.
The amendment approves the revised schedule for full implementation of the cyber security plan (CSP) from June 30, 2016 to December 15, 2017 and revises Paragraph 2.E of Facility Operating License No. NPF-38 for WF3, to incorporate the revised CSP implementation schedule.
A copy of the related safety evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.
Docket No. 50-382
Enclosures:
- 1. Amendment No. 247 to NPF-38
- 2. Safety Evaluation cc: Distribution via Listserv DISTRIBUTION:
PUBLIC LPL4-2 Reading RidsNrrDorllpl4-2 Resource RidsNrrLAPBlechman Resource Sincerely, IRA/
April L. Pulvirenti, Project Manager Plant Licensing IV-2 and Decommissioning Transition Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation RidsACRS_MailCTR Resource RidsNrrPMWaterford Resource RidsRgn4MailCenter Resource RidsNrrDorlDpr Resource RFelts, NSIR JRycyna, NSIR ADAMS A ccess1on N o.: ML16077A270
- b
., d t d 1y e-ma1 ae OFFICE N RR/DORL/LPL4-2/PM NRR/DORL/LPL4-2/LA NSIR/CSD/DD*
NAME APulvirenti PBlechman RFelts (JBeardsley for)
DATE 3/21/2016 3/21/2016 1/28/2016 OFFICE OGC*
NRR/DORL/LPL4-2/BC NRR/DORL/LPL4-2/PM NAME LLondon MKhanna APulvirenti DATE 3/31/2016 5/10/2016 5/10/2016 OFFICIAL AGENCY RECORD