CNL-16-131, License Amendment Request (WBN-TS-16-04) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

License Amendment Request (WBN-TS-16-04) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

ML16320A161
Person / Time
Site:	Watts Bar
Issue date:	11/14/2016
From:	James Shea Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
Shared Package
ML16320A160	List: CNL-16-131, License Amendment Request (WBN-TS-16-04) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8
References
CNL-16-131, WBN-TS-16-04
Download: ML16320A161 (9)

Text

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosures 1 and 4 Tennessee Valley Authority, 1101 Market Street, Chattanooga, Tennessee 37402 CNL-16-131 November 14, 2016 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Unit 2 Facility Operating License No. NPF-96 NRC Docket No. 50-391

Subject:

License Amendment Request (WBN-TS-16-04) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

Reference:

NUREG-0847, Supplement 28, Safety Evaluation Report Related to the Operation of Watts Bar Nuclear Plant, Unit 2, Docket Number 50-391, dated August 2015 (ML15229A195)

In accordance with the provisions of Title 10 of the Code of Federal Regulations (CFR) 50.90, "Application for Amendment of License, Construction Permit, or Early Site Permit," Tennessee Valley Authority (TVA) is submitting a request for amendment to Facility Operating License No. NPF-96 for the Watts Bar Nuclear Plant (WBN) Unit 2. The proposed license amendment revises the WBN Unit 2 Cyber Security Plan (CSP) Implementation Schedule for Milestone 8 as approved by the Reference document, and updates the Facility Operating License. This submittal is consistent with previous TVA submittals requesting prior Nuclear Regulatory Commission (NRC) approval for changes to a CSP milestone implementation schedule. to this letter provides a description and technical evaluation of the proposed changes. Enclosure 2 provides the regulatory evaluation and environmental consideration of the proposed changes. Enclosure 3 to this letter contains a proposed markup of the WBN Unit 2 Facility Operating License No. NPF-96. Enclosure 4 provides the revised WBN Unit 2 CSP implementation schedule for Milestone 8.

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 This letter is decontrolled when separated from Enclosures 1 and 4 U. S. Nuclear Regulatory Commission Page 2 CNL-16-131 November 14, 2016 The proposed change has been evaluated in accordance with 10 CFR 50.91 (a)(1) using criteria in 10 CFR 50.92(c). TVA has determined that the change involves no significant hazards consideration and that the change qualifies for a categorical exclusion from environmental review pursuant to the provisions of 10 CFR 51 .22(c)(12) . In accordance with 10 CFR 50.91 (b)(1 ), TVA is sending a copy of this letter and Enclosures 2 and 3 to the Tennessee Department of Environment and Conservation .

Enclosures 1 and 4 contain security related information and , as such , TVA requests that they be withheld from public disclosure pursuant to 10 CFR 2.390(d)(1 ).

TVA requests the NRC approve this amendment by February 28 , 2017 , with implementation within 30 days of issuance.

There are no new regulatory commitments associated with this submittal. Please address any questions regarding this request to Edward D. Schrull at (423) 751-3850.

I declare under penalty of perjury that the foregoing is true and correct. Executed on this 14th day of November 2016.

RespiJ ~

J~S~a Vice President, Nuclear Licensing Enclosures :

1. Technical Evaluation of Proposed Change

2. Regulatory Evaluation and Environmental Consideration

3. Proposed Facility Operating License Changes (Mark-up)

4. Revised Watts Bar Nuclear Plant Unit 2 Cyber Security Plan Implementation Schedule (Milestone 8)

Enclosures cc (Enclosures):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Watts Bar Nuclear Plant State Health Officer - Tennessee Department of Environment and Conservation (w/o Enclosures 1 and 3)

Enclosure 2 TENNESSEE VALLEY AUTHORITY WATTS BAR NUCLEAR PLANT UNIT 2 Regulatory Evaluation and Environmental Consideration

Subject:

License Amendment Request (WBN-TS-16-04) to Change the Completion Date of Cyber Security Plan Implementation Milestone 8

1. REGULATORY EVALUATION 1.1 Applicable Regulatory Requirements/Criteria 1.2 Precedent 1.3 Significant Hazards Consideration 1.4 Conclusions

2. ENVIRONMENTAL CONSIDERATION CNL-16-131 E2- 1

Enclosure 2

1.0 REGULATORY EVALUATION

1.1 Applicable Regulatory Requirements/Criteria 10 CFR 73.54 requires licensees to maintain and implement a cyber security plan.

License Condition 2.C(7) for Watts Bar Nuclear Plant (WBN), Unit 2 Facility Operating License No. NPF-96 requires WBN Unit 2 to fully implement and maintain in effect all provisions of the Commission approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

1.2 Precedent Based on a review performed by the Nuclear Energy Institute (NEI) Cyber Security Task Force, 64 of the 103 industry nuclear units have an NRC approved Milestone 8 completion date of December 31, 2017. This proposed change to the WBN Unit 2 completion date is consistent with previously approved industry peers.

In addition, the WBN Unit 1 CSP Milestone 8 completion date extension to December 31, 2017 was approved by the NRC per letter dated June 23, 2016 (ML16146A745). This proposed change would align the WBN unit specific completion dates to allow for a coordinated implementation of programmatic controls for the site.

1.3 Significant Hazards Consideration Tennessee Valley Authority (TVA) proposes to modify the Watts Bar Nuclear Plant (WBN) Unit 2 Cyber Security Plan (CSP) implementation date for Milestone 8.

These changes are being proposed to allow for adequate time to assess, methodically plan, schedule, and implement the required changes based on resolution of industry generic issues and lessons learned from planned Milestone 8 industry workshops.

TVA has concluded that the change to the WBN Unit 2 CSP implementation date for Milestone 8 does not involve a significant hazards consideration. TVAs conclusion is based on its evaluation in accordance with 10 CFR 50.91(a)(1) of the three standards set forth in 10 CFR 50.92, "Issuance of Amendment," as discussed below:

1. Does the proposed amendment involve a significant increase in the probability or consequence of an accident previously evaluated?

Response: No.

The proposed change revises the CSP Milestone 8 Implementation Schedule. This change does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change is an extension to the completion date of implementation Milestone 8, that in itself does not require any plant modifications which affect the performance capability of the structures, systems, and components relied upon to mitigate the consequences of postulated accidents and have no CNL-16-131 E2- 2

Enclosure 2 impact on the probability or consequences of an accident previously evaluated.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed amendment create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change revises the CSP Implementation Schedule. This proposed change to extend the completion date of implementation Milestone 8 does not alter accident analysis assumptions, add any initiators, or affect the function of plant systems or the manner in which systems are operated, maintained, modified, tested, or inspected. The proposed change does not require any plant modifications which affect the performance capability of the structures, systems and components relied upon to mitigate the consequences of postulated accidents. This change also does not create the possibility of a new or different kind of accident from any accident previously evaluated.

Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed amendment involve a significant reduction in a margin of safety?

Response: No.

Plant safety margins are established through limiting conditions for operation, limiting safety system settings, and safety limits specified in the technical specifications. The proposed change extends the CSP Implementation Schedule. Because there is no change to these established safety margins as result of this change, the proposed change does not involve a significant reduction in a margin of safety.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, TVA concludes that the proposed extension presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and accordingly, a finding of no significant hazards consideration is justified.

CNL-16-131 E2- 3

Enclosure 2 1.4 Conclusions 10 CFR 73.54 requires that each licensee shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks up to and including the design basis threat established by 10 CFR 73.1(a)(1)(v).

The proposed change amends the CSP Implementation Schedule and does not change any feature of the CSP that meets the requirements of 10 CFR 73.54 as previously approved by the NRC.

The proposed change has been evaluated in accordance with 10 CFR 50.91(a)(1) using criteria in 10 CFR 50.92(c), and it has been determined that the changes involve no significant hazards consideration.

In conclusion, based on the considerations discussed above: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

2.0 ENVIRONMENTAL CONSIDERATION

The proposed amendment changes the CSP Implementation Schedule for Milestone 8. The proposed amendment meets the eligibility criterion for a categorical exclusion set forth in 10 CFR 51.22(c)(12). Therefore, pursuant to 10 CFR 51.22(b),

no environmental impact statement or environmental assessment needs to be prepared in connection with the issuance of the amendment.

CNL-16-131 E2- 4

Enclosure 3 Watts Bar Nuclear Plant, Unit 2 Proposed Facility Operating License Changes (Mark-up)

CNL-16-131 E3- 1

C. The license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act, and to the rules, regulations, and orders of the Commission now or hereafter in effect, and is subject to the additional conditions specified or incorporated below.

(1) Maximum Power Level TVA is authorized to operate the facility at reactor core power levels not in excess of 3411 megawatts thermal.

(2) Technical Specifications and Environmental Protection Plan The Technical Specifications contained in Appendix A, as revised through Amendment No. 2, and the Environmental Protection Plan contained in Appendix B, both of which are attached hereto, are hereby incorporated into this license. TVA shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan.

(3) TVA shall implement permanent modifications to prevent overtopping of the embankments of the Fort Loudon Dam due to the Probable Maximum Flood by February 1, 2017.

(4) PAD4TCD may be used to establish core operating limits for Cycles 1 and 2 only. PAD4TCD may not be used to establish core operating limits for subsequent reload cycles.

(5) By December 31, 2017, the licensee shall report to the NRC that the actions to resolve the issues identified in Bulletin 2012-01, "Design Vulnerability in Electrical Power System," have been implemented.

(6) The licensee shall maintain in effect the provisions of the physical security plan, security personnel training and qualification plan, and safeguards contingency plan, and all amendments made pursuant to the authority of 10 CFR 50.90 and 50.54(p).

(7) TVA shall fully implement and maintain in effect all provisions of the Commission approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The TVA approved CSP was discussed in NUREG-0847,Supplement 28,. as amended by changes approved by License Amendment No. X.

(8) TVA shall implement and maintain in effect all provisions of the approved fire protection program as described in the Fire Protection Report for the facility, as described in NUREG-0847, Supplement 29, subject to the following provision:

Unit 2 Amendment No. 2 3 Facility Operating License No. NPF-96 CNL-16-131 E3-2

SECURITY-RELATED INFORMATION - WITHHOLD UNDER 10 CFR 2.390 Enclosure 4 Revised Watts Bar Nuclear Plant Unit 2 Cyber Security Plan Implementation Schedule (Milestone 8)

CNL-16-131 E4- 1