CNL-16-018, License Amendment Request (SQN-TS-16-03) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

License Amendment Request (SQN-TS-16-03) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

ML16138A247
Person / Time
Site:	Sequoyah
Issue date:	05/16/2016
From:	James Shea Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML16138A246	List: CNL-16-018, License Amendment Request (SQN-TS-16-03) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8
References
CNL-16-018, SQN-TS-16-03, TAC ME4955, TAC ME4956
Download: ML16138A247 (10)

Text

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosures 1 and 4 Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-16-018 May 16, 2016 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Sequoyah Nuclear Plant Units 1 and 2 Renewed Facility Operating License Nos. DPR-77 and DPR-79 NRC Docket Nos. 50-327 and 50-328

Subject:

License Amendment Request (SQN-TS-16-03) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

Reference:

Letter from NRC to TVA, SEQUOYAH NUCLEAR PLANT, UNITS 1 AND 2 -

ISSUANCE OF AMENDMENTS REGARDING THE CYBER SECURITY PLAN (TS-09-06) (TAC NOS. ME4955 AND ME4956), dated July 29, 2011 (ML1195A117)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (CFR) 50.90, "Application for amendment of license, construction permit, or early site permit,"

Tennessee Valley Authority (TVA) is submitting a request for amendment to Facility Operating License Nos. DPR-77 and DPR 79 for the Sequoyah Nuclear Plant (SQN),

Units 1 and 2. This submittal satisfies the requirement to request prior Nuclear Regulatory Commission (NRC) approval for changes to the SQN, Units 1 and 2, Cyber Security Plan (CSP) milestone implementation schedule as prescribed in the reference letter.

The proposed license amendment revises the SQN CSP Implementation Schedule for Milestone 8 and updates the Facility Operating Licenses. to this letter provides a description and technical evaluation of the proposed changes. Enclosure 2 provides the regulatory evaluation and environmental consideration. to this letter contains a markup of SQN, Units 1 and 2, Renewed Facility Operating License Nos. DPR-77 and DPR-79. Enclosure 4 provides the revised SQN, Units 1 and 2, CSP implementation schedule for Milestone 8.

SECURITY-RELATED INFORMATION-WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosures 1 and 4 U. S. Nuclear Regulatory Commission CNL-16-018 Page 2 May 16, 2016 The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c). TVA has determined that the change involves no significant hazards consideration and that the change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51.22(c)(12). In accordance with 10 CFR 50.91 (b)(1 ), TVA is sending a copy of this letter and Enclosures 2 and 3 to the Tennessee Department of Environment and Conservation.

Enclosures 1 and 4 contain security related information and, as such, TVA requests that they be withheld from public disclosure pursuant to 10 CFR 2.390(d)(1).

TVA requests the NRC approve this amendment by August 31, 2016, with implementation within 30 days of issuance.

There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Edward D. Schrull at (423) 751-3850.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 15th day of May 2016.

Respectfully,

~~!iv-J. W. Shea Vice President, Nuclear Licensing

Enclosures:

1. Technical Evaluation of Proposed Change

2. Regulatory Evaluation and Environmental Consideration

2. Proposed Facility Operating License Changes (Mark-up)

3. Revised Sequoyah Nuclear Plant Cyber Security Plan Implementation Schedule (Milestone 8)

Enclosures cc (Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Sequoyah Nuclear Plant Director, Division of Radiological Health - Tennessee State Department of Environment and Conservation (w/o Enclosures 1 and 3)

Enclosure 2 TENNESSEE VALLEY AUTHORITY SEQUOYAH NUCLEAR PLANT UNITS 1 AND 2 Regulatory Evaluation and Environmental Consideration

Subject:

License Amendment Request (SQN-TS-16-03) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

1. REGULATORY EVALUATION 1.1 Applicable Regulatory Requirements/Criteria 1.2 Precedent 1.3 Significant Hazards Consideration 1.4 Conclusions

2. ENVIRONMENTAL CONSIDERATION CNL-16-018 E2- 1

Enclosure 2

1.0 REGULATORY EVALUATION

1.1 Applicable Regulatory Requirements/Criteria 10 CFR 73.54 requires licensees to maintain and implement a cyber security plan.

The Sequoyah Nuclear Plant (SQN), Units 1 and 2 Facility Operating License Nos. DPR-77 and DPR-79 include license condition 2.E.(2), that requires SQN, Units 1 and 2 to fully implement and maintain in effect all provisions of the Commission approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

1.2 Precedent Based on a review performed by the Nuclear Energy Institute (NEI) Cyber Security Task Force, 64 of the 103 industry nuclear units have an NRC approved Milestone 8 completion date of December 31, 2017. This proposed change to the TVA implementation is consistent with previously approved industry peers.

1.3 Significant Hazards Consideration Tennessee Valley Authority (TVA) proposes to modify the SQN Cyber Security Plan (CSP) implementation date for Milestone 8. These changes are being proposed to allow for adequate time to assess, methodically plan, schedule, and implement the required changes based on resolution of industry generic issues and lessons learned from planned Milestone 8 industry workshops.

TVA has concluded that the change to the SQN CSP implementation date for Milestone 8 does not involve a significant hazards consideration. TVAs conclusion is based on its evaluation in accordance with 10 CFR 50.91(a)(1) of the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No.

The proposed change revises the CSP Milestone 8 implementation date.

This change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change is an extension to the completion date of implementation Milestone 8, that in itself does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and have no impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

CNL-16-018 E2- 2

Enclosure 2

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change revises the CSP Implementation Schedule. This proposed change to extend the completion date of implementation Milestone 8 does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems and components relied upon to mitigate the consequences of postulated accidents. This change also does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. The proposed change extends the CSP Implementation Schedule. Because there is no change to these established safety margins as result of this change, the proposed change does not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed extension presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and accordingly, a finding of no significant hazards consideration is justified.

1.4 Conclusions 10 CFR 73.54 requires that each licensee shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v).

The proposed change amends the CSP Implementation Schedule and does not change any feature of the CSP that meets the requirements of 10 CFR 73.54 as previously approved by the NRC.

CNL-16-018 E2- 3

Enclosure 2 The proposed change has been evaluated in accordance with 10 CFR 50.91(a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration.

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

2.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment changes the CSP Implementation Schedule for Milestone 8. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12). Therefore, pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of the amendment.

CNL-16-018 E2- 4

Enclosure 3 Sequoyah Nuclear Plant, Units 1 and 2 Proposed Facility Operating License Changes (Mark-up)

CNL-16-018 E3- 1

- 14a -

(d) For SRs that existed prior to this amendment that have modified acceptance criteria, the first performance subject to the modified acceptance criteria is due at the end of the first Surveillance interval that began on the date the Surveillance was last performed prior to the implementation of this amendment.

D. Exemptions from certain requirements of Appendices G and J to 10 CFR Part 50 are described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 1. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. The exemptions are, therefore, hereby granted. The granting of these exemptions are authorized with the issuance of the License for Fuel Loading and Low Power Testing, dated February 29, 1980. The facility will operate, to the extent authorized herein, Act, and the regulations of the Commission.

E. Physical Protection (1) The licensee shall fully implement and maintain in effect all provisions of the Commission- approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Sequoyah Nuclear Plant Security Plan, Training And Qualification Plan, And Safeguards Contingency Plan" submitted by letter dated May 8, 2006.

(2) The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee CSP was approved by License Amendment No. 329, as amended by changes approved by License Amendment Nos. 333 and XXX.

Amendment 334 XXX Renewed License No. DPR 77 September 30, 2015 August XX, 2016 CNL-16-018 E3-2

D. Exemptions from certain requirements of Appendices G and J to 10 CFR Part 50 are described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplements No. 1 and No. 5. These exemptions are authorized by law and will not endanger life or property or the common defense and security and are otherwise in the public interest. Therefore, these exemptions are hereby granted. The facility will operate, to the extent authorized herein, in conformity with the application, as amended, the provisions of the Act, and the regulations of the Commission.

A temporary exemption from General Design Criterion 57 found in Appendix A to 10 CFR part 50 is described in the Office of Nuclear Reactor Regulation's Safety Evaluation Report, Supplement No. 5, Section 6.2.4. This exemption is authorized by law and will not endanger life or property or the common defense and security and is otherwise in the public interest. The exemption, therefore, is hereby granted and shall remain in effect through the first refueling outage as discussed in Section 6.2.4 of Supplement 5 to the Safety Evaluation Report. The granting of the exemption is authorized with the issuance of the renewed Facility Operating License. The facility will operate, to the extent authorized herein, in conformity with the application as amended, the provisions of the Act, and the regulations of the Commission.

E. Physical Protection (1) The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans, which contain Safeguards Information protected under 10 CFR 73.21, is entitled: "Sequoyah Nuclear Plant Security Plan, Training And Qualification Plan, And Safeguards Contingency Plan" submitted by letter dated May 8, 2006.

(2) The licensee shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The licensee CSP was approved by License Amendment No. 322, as amended by changes approved by License Amendment Nos. 326 and XXX.

F. Reactor Safety Methodology Applications Programs (Section 24.0)

TVA will provide a report prepared by the Kaman Sciences Corporation (KSC) on a full scale nuclear safety and availability analysis within six months from the date of the KSC report.

Renewed License No. DPR 79 September 28, 2015 August XX, 2016 CNL-16-018 E3-3

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Enclosure 4 Revised Sequoyah Nuclear Plant Cyber Security Plan Implementation Schedule (Milestone 8)

CNL-16-018 E4- 1