ML17289A060

Issuance of Amendment No. 294, Revise Cyber Security Plan Implementation Schedule for Milestone 8 and Associated License Condition (CAC No. MF9559; EPID L-2017-LLA-0184)

ML17289A060
Person / Time
Site:	Fort Calhoun
Issue date:	11/22/2017
From:	James Kim Special Projects and Process Branch
To:	Fisher M Omaha Public Power District
Kim J, NRR/DORL/LSPB, 415-4125
References
CAC MF9559, EPID L-2017-LLA-0184
Download: ML17289A060 (13)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 November 22, 2017 Ms. Mary J. Fisher Senior Director for Fort Calhoun Station Decommissioning Omaha Public Power District Fort Calhoun Station 9610 Power Lane, Mail Stop FC-2-4 Blair, NE 68008

SUBJECT:

FORT CALHOUN STATION, UNIT 1 - ISSUANCE OF AMENDMENT TO RENEWED FACILITY OPERATING LICENSE RE: CYBER SECURITY PLAN IMPLEMENTATION SCHEDULE (CAC NO. MF9559; EPID L-2017-LLA-0184)

Dear Ms. Fisher:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 294 to Renewed Facility Operating License No. DPR-40 for the Fort Calhoun Station, Unit 1 (FCS), in response to your application dated March 24, 2017.

The licensee's application requested an extension of the full implementation date of the FCS Cyber Security Plan Implementation Schedule Milestone 8 from December 31, 2017, to December 28, 2018. The amendment grants the requested extension, and also revises the existing operating license Security Plan license condition.

A copy of the related Safety Evaluation is also enclosed. The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice.

Sincerely, James Kim, Project Manager Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-285

Enclosures:

1. Amendment No. 294 to DPR-40

2. Safety Evaluation cc: Listserv

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 OMAHA PUBLIC POWER DISTRICT DOCKET NO. 50-285 FORT CALHOUN STATION, UNIT 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 294 Renewed License No. DPR-40

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for amendment by the Omaha Public Power District (the licensee), dated March 24, 2017, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this license amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

Enclosure 1

2. Accordingly, Renewed Facility Operating License No. DPR-40 is amended by changes as indicated in the attachment to this license amendment, and paragraph 3.8. of Renewed Facility Operating License No. DPR-40 is hereby amended to read as follows:

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 294, are hereby incorporated in the license. Omaha Public Power District shall operate the facility in accordance with the Technical Specifications.

Further, paragraph 3.C. is hereby amended, in part, to read as follows:

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}.

The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284 and Amendment No. 294.

3. This license amendment is effective as of the date of issuance and shall be implemented by December 31, 2017.

FOR THE NUC~EA REGULATORY COMMISSION OJ / 5:/) ,Jj, \ f.,a_

I ( ")

1)AB Douglas A. Broaddus, Chief Special Projects and Process Branch Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the Renewed Facility Operating License No. DPR-40 Date of Issuance: November 22, 201 7

ATTACHMENT TO LICENSE AMENDMENT NO. 294 RENEWED FACILITY OPERATING LICENSE NO. DPR-40 FORT CALHOUN STATION, UNIT 1 DOCKET NO. 50-285 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains marginal lines indicating the areas of change.

Renewed Facility Operating License No. DPR-40 Remove (4) Pursuant to the Act and 10 CFR Parts 30, 40 and 70, to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form for sample analysis or instrument calibration or when associated with radioactive apparatus or components; (5) Pursuant to the Act and 10 CFR Parts 30 and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by operation of the facility.

3. This renewed license shall be deemed to contain and is subject to the conditions specified in the following Commission regulations in 10 CFR Chapter I: Part 20, Section 30.34 of Part 30, Section 40.41 of Part 40, Section 50.54 and 50.59 of Part 50, and Section 70.32 of Part 70; and is, subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; and is subject to the additional conditions specified or incorporated below:

A. Maximum Power Level Omaha Public Power District is authorized to operate the Fort Calhoun Station, Unit 1, at steady state reactor core power levels not in excess of 1500 megawatts thermal (rate power).

B. Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 294 are hereby incorporated in the license. Omaha Public Power District shall operate the facility in accordance with the Technical Specifications.

C. Security and Safeguards Contingency Plans The Omaha Public Power District shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The plans, which contain Safeguards Information protected under 10 CFR 73.21, are entitled: "Fort Calhoun Station Security Plan, Training and Qualification Plan, Safeguards Contingency Plan," submitted by letter dated May 19, 2006.

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284 and Amendment No. 294.

Renewed Operating License No. DPR-40 Amendment No. 294

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 294 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-40 OMAHA PUBLIC POWER DISTRICT FORT CALHOUN STATION, UNIT 1 DOCKET NO. 50-285

1.0 INTRODUCTION

By letter dated March 24, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML17094A810), Omaha Public Power District (OPPD, the licensee) requested a change to Renewed Facility Operating License No. DPR-40 for the Fort Calhoun Station, Unit 1 (FCS).

The U.S. Nuclear Regulatory Commission (NRG, the Commission) staff initially reviewed and approved the licensee's original Cyber Security Plan (CSP) implementation schedule by Amendment No. 266 dated July 27, 2011 (ADAMS Accession No. ML111801094), to Renewed Facility Operating License DPR-40 concurrent with the incorporation of the CSP into the facility's current licensing basis. The NRC staff then reviewed and approved the licensee's current CSP implementation schedule by Amendment No. 284 dated November 19, 2015 (ADAMS Accession No. ML15294A279). This schedule required FCS to fully implement and maintain all provisions of the CSP no later than December 31, 2017.

The proposed change would revise the date of CSP implementation schedule Milestone 8 from December 31, 2017, to December 28, 2018, and the existing license conditions in the renewed facility operating license. The NRC is currently processing a separate request submitted by FCS on June 16, 2017 that would remove the license condition that requires implementation of the CSP (ML17167A057).

Enclosure 2

2.0 REGULATORY EVALUATION

The NRC staff considered the following regulatory requirements and guidance in its review of the March 24, 2017 license amendment request (LAR) to modify the existing CSP implementation schedule:

• Title 10 of the Code of Federal Regulations (10 CFR), Section 73.54, "Protection of digital computer and communication systems and networks," which states, in part:

Each [CSP] submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule.

• The licensee's renewed facility operating license includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

• Review criteria provided by the NRC staff's internal memorandum, "Review Criteria for Title 1O of the Code of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests,"

dated October 24, 2013 (ADAMS Accession No. ML13295A467), to be considered for evaluating licensees' requests to postpone their cyber security program implementation date (commonly known as Milestone 8).

The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, which states, in part, that "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRC-approved CSP implementation schedule, thus, will require prior NRC approval as required by 10 CFR 50.90, "Application for amendment of license, construction permit, or early site permit."

3.0 TECHNICAL EVALUATION

3.1 Licensee's Requested Change The NRC staff issued Amendment No. 266 to Renewed Facility Operating License No. DPR-40 by letter dated July 27, 2011. This amendment approved the CSP and associated implementation schedule, and added a license condition requiring the licensee to fully implement and maintain the Commission-approved CSP. The licensee's implementation schedule was based on a template prepared by the Nuclear Energy Institute (NEI), which was transmitted to the NRC by letter dated February 28, 2011 (ADAMS Accession No. ML110600206). By letter dated March 1, 2011, the NRC staff found the NEI template acceptable for licensees to use to develop their CSP implementation schedules (ADAMS

Accession No. ML110070348). The licensee's proposed implementation schedule for the CSP identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team;

2) Identify Critical Systems (CSs) and Critical Digital Assets (CDAs);

3) Install deterministic one-way devices between lower level devices and higher level devices;

4) Implement the security control "Access Control For Portable And Mobile Devices";

5) Implement observation and identification of obvious cyber-related tampering to existing insider mitigation rounds by incorporating the appropriate elements;

6) Identify, document, and implement technical cyber security controls in accordance with "Mitigation of Vulnerabilities and Application of Cyber Security Controls," for CDAs that could adversely impact the design function of physical security target set equipment;

7) Ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented; and

8) Fully implement the CSP.

Currently, Milestone 8 of the FCS CSP requires the licensee to fully implement the CSP by December 31, 2017. By letter dated March 24, 2017, the licensee proposed to modify the Milestone 8 completion date to December 28, 2018.

The licensee provided the following information pertinent to each of the criteria identified in the NRC guidance memorandum dated October 24, 2013.

1) Identification of the specific requirement or requirements of the cyber security plan that the licensee needs additional time to implement.

The licensee requested that full implementation of the CSP requirements be rescheduled from December 31, 2017, to December 28, 2018. During this additional period, the requirements of Milestones 1 through 7 will be maintained.

2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee stated that on August 25, 2016 (ADAMS Accession No. ML16242A127), it notified the NRC of the plans to permanently cease operations of FCS as of October 24, 2016. On November 13, 2016 (ADAMS Accession No. ML16319A254), the licensee notified the NRC that all fuel had been permanently removed from the FCS reactor vessel and placed into the FCS spent fuel pool. The licensee further stated that the analyses show that by April 7, 2018, at least 1O hours is available from a partial drain-down event where cooling of the spent fuel is not effective until the hottest fuel assembly reaches 900 degrees Celsius.

The licensee stated that activities to complete CDA assessments and implementation of additional cyber security controls by the current Milestone 8 commitment date would be counterproductive to the decommissioning activities and would increase the complexity of the plant equipment with little or no increase in protection of the safety, security, and emergency preparedness functions still supported by the remaining CDAs. FCS current status is a non-generating asset with reduced risk to the public from a Design Basis Accident (DBA) or Design Basis Threat (DBT) perspective. The licensee stated that decommissioning activities are focused on efforts to reduce plant equipment that will further reduce plant risk and potential consequences of a cyber-attack. The licensee has determined that the existing cyber security controls will provide a high degree of protection for the threat/attack vectors and protection against cyber-attacks and radiological sabotage during the short time period of the Milestone 8 extension.

3) A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee stated that the proposed completion date for Milestone 8 is December 28, 2018.

4) An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of Milestones already completed.

The licensee stated that based on the CSP implementation plan activities completed under Milestones 1 through 7, the FCS cyber security defensive posture is secure. The licensee provided that the completed activities provide a high degree of protection against cyber security attacks. The licensee stated that it will continue to ensure that digital computer and communication systems and networks covered by the CSP at FCS are adequately protected against cyber-attacks. Additionally, the licensee stated that the reduction in the number of digital computers and communication systems and networks reduces the number of attack pathways for a cyber-attack during the decommissioning of a power reactor.

5) A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety, security, or emergency preparedness consequences and with reactivity effects in the balance of plant.

The licensee's methodology for prioritizing protection of CSs and CDAs is focused on maintaining the existing cyber security protections provided by the Milestones 1 through 7 commitments and on reducing plant equipment that will further reduce plant risk and consequences of a potential cyber-attack. The licensee stated that the remaining safety-related, important-to-safety, and security CSs and CDAs will continue to be deterministically isolated from external networks; stringent control of portable media and mobile devices connected to CDAs will continue, including use of stand-alone scanning kiosks, and implementation of technical cyber security controls and security officer observation for CDAs that support physical security target set functions.

6) A discussion of the licensee's cyber security program performance up to the date of the license amendment request.

The licensee stated that OPPD uses the Corrective Action Program (CAP) to document all cyber security issues in order to trend, correct, and improve the OPPD cyber security program.

The licensee noted that a December 2016 Nuclear Oversight audit of CSP Milestones 1 through 7 found no significant findings related to the overall cyber security program performance and effectiveness during the audit and concluded that OPPD has an effective program at FCS. The licensee provided that OPPD completed a comprehensive self-assessment for Milestones 1 through 7 in August 2016 to ensure completeness and effectiveness of the implemented actions. Issues identified during the peer-assessment were entered into the CAP and addressed for improvement of the cyber security program. The NRC completed a cyber security inspection at FCS for cyber security Milestones 1 through 7 on May 30, 2014, that resulted in three findings of very low significance. The licensee stated that all of the identified findings have been remediated.

7) A discussion of cyber security issues pending in the licensee's corrective action program.

The licensee stated that there are no cyber security issues that would constitute a threat to proper CDA function or that would call into question cyber security program effectiveness currently pending in the CAP.

8) A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee stated that it has implemented a data diode segregating Level 3 data from Level 2 data, deployed isolated media scanning kiosks, and installed a plant computer Security Incident and Event Monitoring System. The licensee is still working on the segregation of the Plant Security Radio System.

3.2 NRC Staff Evaluation of Requested Change The NRC staff has evaluated the licensee's application using the regulatory requirements and guidance cited in Section 2.0 of this Safety Evaluation. The NRC staff's evaluation concludes that the licensee's site is more secure due to the reduced risk profile presented by FCS's permanent shutdown status, reduction in number of CDAs, and the protection provided by the completion of Milestones 1-7.

On August 25, 20316, the licensee notified the NRC of plans to permanently cease operations of FCS as of October 24, 2016. On November 13, 2016 (ADAMS Accession No. ML16319A254), the licensee notified the NRC that all fuel had been permanently removed from the FCS reactor vessel and placed into the FCS spent fuel pool. The NRC has determined that 10 CFR 73.54 does not apply to reactor licensees that have submitted certifications of permanent cessation of operations and permanent removal of fuel under 10 CFR 50.82(a)(1) or under 10 CFR 52.11 O(a)(1) and whose certifications have been docketed by the NRC.

The licensee notified the NRC that all fuel had been permanently removed from the FCS reactor vessel and placed into the FCS spent fuel pool. The analyses show that by April 7, 2018, at least 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is available from a partial drain-down event where cooling of the spent fuel is not effective until the hottest fuel assembly reaches 900 degrees Celsius. The NRC staff has determined that 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is sufficient time for plant staff to reliably implement required mitigation strategies to prevent spent fuel heat-up damage and at that time can potentially eliminate the CSP license condition entirely.

OPPD has completed the implementation of Milestones 1 through 7 and the completed activities provide a high degree of protection against cyber security attacks. The site is more secure because the activities completed under Milestones 1-7 mitigate the most significant cyber-attack vectors for the most significant CDAs. In addition, the reduction in the number of digital computers and communication systems and networks reduces the number of attack pathways for cyber-attack during the decommissioning of a power reactor.

The NRC staff has determined that extending the due date for Milestone 8 does not affect activities completed for Milestones 1 through 7 as the resulting controls have been incorporated into Station Procedures to ensure their continued application. In addition, the FCS has implemented design modifications to further ensure the effectiveness of its CSP. For example, deterministic one-way devices were installed to segregate lower level devices from higher level devices and prevent digital connectivity between the devices. Isolated media scanning kiosks have been deployed for the control of portable media and mobile devices to prevent the spread of malicious software to CDAs. Other modifications completed and pending include the use of the Plant Computer Security Incident and Event Monitoring System and segregation of the Plant Security Radio System for the protection of security force communications.

The licensee stated that decommissioning activities are focused on efforts to reduce plant equipment that will further reduce plant risk and potential consequences of a cyber-attack. The licensee's prioritization of completion of work for CDAs is focused on maintaining the existing cyber security protection provided by Milestones 1 through 7 commitments and on reducing plant equipment that will further reduce plant risk and consequences of a potential cyber-attack.

The NRC staff concludes that the licensee's methodology for prioritizing work on CDAs is appropriate. The staff further concludes that the licensee's request to delay implementation of the CSP until December 28, 2018, is reasonable given the significantly reduced risk profile presented by FCS in the permanently shutdown configuration, the reduction in number of CDAs, and the protection provided by the cyber security program.

Therefore, the NRC has reasonable assurance that extending the date for implementation of the CSP to December 28, 2018, will provide adequate protection of the public health and safety and the common defense and security.

3.3 Technical Evaluation Conclusion Based on its review of the licensee's submittal, the NRC staff concludes that the licensee's request to extend the date for implementation of its CSP until December 28, 2018, is reasonable for the following reasons: (i) the licensee's implementation of Milestones 1 through 7 provides a high degree of protection against cyber security attacks while OPPD completes its decommissioning activities, as discussed in the staff evaluation above; (ii) the significantly reduced risk profile presented by the licensee in the permanently shutdown and defueled configuration ensures that the licensee is cyber secure; and (iii) the reduced cyber security risk due to the fact that there are fewer CDAs at a decommissioning reactor in comparison to the number of CDAs at an operating reactor.

3.4 Revision to License Condition Paragraph 3.C By letter dated March 24, 2017, the licensee proposed to modify paragraph 3.C of Renewed Facility Operating License No. DPR-40, which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP.

The current license condition in paragraph 3.C of Renewed Facility Operating License No. DPR-40 for FCS, states, in part:

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284.

The revised portion of the license condition in paragraph 3.C of Renewed Facility Operating License No. DPR-40 for FCS, would state, in part:

OPPD shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The OPPD CSP was approved by License Amendment No. 266 and modified by License Amendment No. 284 and Amendment No. 294.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, on October 23, 2017, the Nebraska State official was notified of the proposed issuance of the amendment. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

This amendment relates solely to safeguards matters and does not involve any significant construction impacts. This amendment is an administrative change to extend the date by which the licensee must have its CSP fully implemented. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on June 6, 2017 (82 FR 26134). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: S. Coker, NSIR/DPCP/CSB Date: November 22, 2017

ML17289A060 *SE memo dated **via email OFFICE NRR/DORULSPB/PM N RR/DORL/LSPB/LAiT NRR/DORL/LSPB/LA** NSIR/DPCP/CSB/BC*

NAME JKim I Betts JBurkhardt JBeardsley DATE 10/19/17 10/18/17 10/19/17 10/20/17 OFFICE OGC- NLO NRR/DORL/LSPB/BC NRR/DORL/LSPB/PM NAME NNoelliste DBroaddus (GMiller for) JKim DATE 11/21/17 11/22/17 11/22/17