ML19179A204

Cyber Cover Letter Issuance of License Amendment for Removal of Cyber Security Plan Requirements

ML19179A204
Person / Time
Site:	Oyster Creek
Issue date:	09/18/2019
From:	Cruz Z Division of Decommissioning, Uranium Recovery and Waste Programs
To:	Cowan P, Oneid P Holtec Decommissioning International, Holtec
Shared Package
ML19179A202	List: ML19179A203 ML19179A204 ML19179A205
References
EPID L-2018-LLA-0304
Download: ML19179A204 (19)

Text

P.

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 September 18, 2019 Pierre Paul Oneid Senior Vice President and Chief Nuclear Officer Holtec International Krishna P. Singh Technology Campus 1 Holtec Blvd.

Camden NJ 08104 Pamela B. Cowan Senior Vice President and Chief Operating Officer Holtec Decommissioning International, LLC Krishna P. Singh Technology Campus 1 Holtec Blvd.

Camden NJ 08104

SUBJECT:

OYSTER CREEK NUCLEAR GENERATING STATION - ISSUANCE OF LICENSE AMENDMENT FOR REMOVAL OF CYBER SECURITY PLAN REQUIREMENTS (EPID: L-2018-LLA-0304)

Dear Mr. Oneid and Ms. Cowan:

The U.S. Nuclear Regulatory Commission (NRC) has issued the enclosed Amendment No. 298 to Renewed Facility Operating License No. DPR-16 for the Oyster Creek Nuclear Generating Station (Oyster Creek). The amendment removes the Cyber Security Plan (CSP) requirements contained in license condition 2.C.(4), from the Oyster Creek Renewed Facility Operating License in response to the application dated November 12, 2018 (Agencywide Documents Access and Management System [ADAMS] Accession No. ML18317A022) and as supplemented by letter dated March 7, 2019 (ADAMS Accession No. ML19066A317). The Notice of Application for Amendment was published in the Federal Register on December 18, 2018 (83 FR 64889). The amendment is provided as enclosure 1.

The NRC staff has reviewed the proposed changes and concluded that the licensee's request to remove the requirements for a CSP from the facility operating license is acceptable. The basis for the NRC staffs conclusion is contained in the enclosed safety evaluation (enclosure 2).

Pursuant to Paragraph (c)(12) of Title 10 of the Code of Federal Regulations (10 CFR) Section 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," the Commission has determined that the issuance of this amendment is categorically excluded, and pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared.

P. Oneid and P. Cowan Approval of this amendment is based on modifications to systems used for security and/or materials accountability that relates solely to safeguards matters and does not involve any significant construction impacts.

The NRC staff has determined that the attached safety evaluation does not contain Sensitive Security-Related Information pursuant to 10 CFR 2.390, Public inspections, exemptions, requests for withholding. In accordance with 10 CFR 2.390 of the NRC's "Agency Rules of Practice and Procedure," a copy of this letter will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of ADAMS. ADAMS is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html.

The Notice of Issuance will be included in the Commission's next biweekly Federal Register notice. If you have any questions, please contact me at 301-415-3808, or via e-mail at Zahira.Cruz@nrc.gov.

Sincerely, Zahira L. Cruz, Project Manager Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery and Waste Programs Office of Nuclear Material Safety and Safeguards Docket No. 50-219 Enclosures

1. Amendment No. 298 to DPR-16

2. Safety Evaluation cc w/encls: Distribution via Listserv

P. Oneid and P. Cowan

SUBJECT:

OYSTER CREEK NUCLEAR GENERATING STATION - ISSUANCE OF LICENSE AMENDMENT FOR REMOVAL OF CYBER SECURITY PLAN REQUIREMENTS (EPID: L-2018-LLA-0304) DATE: September 18, 2019 DISTRIBUTION:

PUBLIC RDB r/f RidsNMSS Resource RidsRgn1MailCenter Resource ADimitriadis, RI NSheehan, RI DTifft, RI JWeil, OCA DMcIntyre, OPA SCoker, NSIR ADAMS Package Accession No.: ML19179A202 *via email OFFICE NMSS/RDB NMSS/DUWP NSIR/DPCP OGC/NLO NMSS/RDB NMSS/RDB ELee for NAME ASnyder CHolston ABowers MWoods* BWatson ZCruz DATE 6/28/19 7/3/19 6/24/19 9/16/19 7/1/19 9/18/19 OFFICIAL RECORD COPY

HOLTEC DECOMMISSIONING INTERNATIONAL, LLC OYSTER CREEK ENVIRONMENTAL PROTECTION, LLC DOCKET NO. 50-219 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 298 License No. DPR-16

1. The Nuclear Regulatory Commission (the Commission) has found that:

A. The application for license amendment filed by Exelon Generating Company, LLC,1 dated November 12, 2018, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR)

Chapter I, and all required notifications to other agencies or bodies have been duly made; B. The facility will operate in conformity with the application, as supplemented, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commissions regulations set forth in 10 CFR Chapter I; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51, Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions, of the Commissions regulations, and all applicable requirements have been satisfied.

1 Effective July 1, 2019, Oyster Creek Renewed Facility Operating License No. DPR-16, and the general license for the Oyster Creek Independent Spent Fuel Storage Installation was transferred from Exelon Generation Company, LLC (Exelon) to Oyster Creek Environmental Protection, LLC (OCEP) as the licensed owner and to Holtec Decommissioning International, LLC (HDI) as the licensed operator for decommissioning. In a letter dated September 12, 2019, HDI requested the NRC to continue all ongoing regulatory actions and reviews currently underway for Oyster Creek. HDI and OCEP have assumed responsibility for the continuation of these regulatory actions and reviews (Agencywide Documents Access and Management System Accession No. ML19256B999).

Enclosure 1

2. Accordingly, Renewed Facility Operating License No. DPR-16 is amended by removing requirements for a cyber security plan by changing 2.C(4) to remove the second paragraph that reads:

Holtec Decommissioning International shall fully implement and maintain in effect all provisions of the Commission-approved Exelon Generation Company cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Exelon Generation Company CSP was approved by License Amendment No.

280 and modified by License Amendment Nos. 288 and 292.

3. This license amendment is effective as of the date the licensee notifies the Commission in writing that all spent nuclear fuel assemblies have been transferred out of the spent fuel pool and have been placed in dry storage within the independent spent fuel storage installation. This license amendment shall be implemented within 60 days of the effective date.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

Bruce A. Watson, CHP, Chief Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery and Waste Programs Office of Nuclear Material Safety and Safeguards

Attachment:

Change to Renewed Facility Operating License No. DPR-16 Date of Issuance: September 18, 2019 ATTACHMENT TO LICENSE AMENDMENT NO. 298 TO RENEWED FACILITY OPERATING LICENSE NO. DPR-16 DOCKET NO. 50-219 Replace the following pages of Renewed Facility Operating License No. DPR-16 and Appendices A and D, Technical Specifications, with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the areas of change.

Renewed Facility Operating License No DPR-16 REMOVE INSERT first page revised first page OYSTER CREEK ENVIRONMENTAL PROTECTION, LLC AND HOLTEC DECOMMISSIONING INTERNATIONAL, LLC DOCKET NO. 50-219 OYSTER CREEK NUCLEAR GENERATING STATION RENEWED FACILITY OPERATING LICENSE Renewed License No. DPR-16

1. The Nuclear Regulatory Commission (the Commission) having previously made the findings set forth in License No. DPR-16, has now found that:

A. The application for a Renewed Facility Operating License No. DPR-16 filed by the applicant complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in 10 CFR Chapter I and all required notifications to other agencies or bodies have been duly made; B. DELETED C. Actions have been identified and have been or will be taken with respect to (1) managing the effects of aging during the term of this Renewed Facility Operating License No. DPR-16 on the functionality of structures and components that have been identified to require review under 10 CFR 54.21(a)(1); and (2) time-limited aging analyses that have been identified to require review under 10 CFR 54.21(c), such that there is reasonable assurance that the activities authorized by the renewed operating license will continue to be conducted in accordance with the current licensing basis, as defined in 10 CFR 54.3, for the facility, and that any changes made to the facilitys current licensing basis in order to comply with 10 CFR 54.29(a) are in accordance with the Act and the Commissions regulations; D. The facility will be maintained in conformity with the application, as amended; the provisions of the Act; and the rules and regulations of the Commission; E. There is reasonable assurance (i) that the activities authorized by this license can be conducted without endangering the health and safety of the public and (ii) that such activities will be conducted in compliance with the Commissions rules and regulations set forth in 10 CFR Chapter I; F. Oyster Creek Environmental Protection, LLC (Oyster Creek Environmental Protection) is financially qualified and Holtec Decommissioning International, LLC (Holtec Decommissioning International) is financially and technically qualified to engage in the activities authorized by this license in accordance with the rules and regulations of the Commission; Renewed License No. DPR-16 Amendment No. 298

G. Oyster Creek Environmental Protection and Holtec Decommissioning International have satisfied the applicable provisions of 10 CFR Part 140, Financial Protection Requirements and Indemnity Agreements, of the Commissions regulations; H. The issuance of this license will not be inimical to the common defense and security or to the health and safety of the public; I. The receipt, possession and use of source, byproduct, and special nuclear materials as authorized by this license will be in accordance with the Commissions regulations in 10 CFR Parts 30, 40, and 70; and J. The issuance of this license is in accordance with 10 CFR Part 51 of the Commissions regulations and all applicable requirements have been satisfied.

2. Facility Operating License No. DPR-16, dated July 2, 1991, as amended, is superseded in its entirety by Renewed Facility Operating License No. DPR-16, hereby issued to Oyster Creek Environmental Protection and Holtec Decommissioning International, to read as follows:

A. This renewed license applies to the Oyster Creek Nuclear Generating Station, a boiling-water reactor and associated equipment (the facility), owned by Oyster Creek Environmental Protection and maintained and operated for decommissioning by Holtec Decommissioning International. The facility is located in Ocean County, New Jersey, and is described in the licensees Updated Final Safety Analysis Report, as supplemented and amended, and in the licensees Environmental Report, as supplemented and amended.

B. Subject to the conditions and requirements incorporated herein, the Commission hereby licenses:

(1) Holtec Decommissioning International pursuant to Section 104b of the Act and 10 CFR Part 50, to possess, maintain, and decommission Oyster Creek Nuclear Generating Station at the designated location on the Oyster Creek site in Ocean County, New Jersey, in accordance with the procedures and limitations set forth in this renewed license; (2) Oyster Creek Environmental Protection pursuant to Section 104b of the Act and 10 CFR Part 50, to possess Oyster Creek Nuclear Generating Station at the designated location on the Oyster Creek site in Ocean County, New Jersey, in accordance with the procedures and limitations set forth in this renewed license; (3) Holtec Decommissioning International pursuant to the Act and 10 CFR Part 70, to possess at any time special nuclear material that was used as reactor fuel, in accordance with the limitations for storage, as described in the Updated Final Safety Analysis Report, as supplemented and amended;

(4) Holtec Decommissioning International pursuant to the Act and 10 CFR Parts 30, 40, and 70, to receive, possess, and use at any time any byproduct, source, or special nuclear materials as sealed neutron sources that were used for reactor startup, sealed sources that were used for calibration of reactor instrumentation and are used in radiation monitoring equipment, and as fission detectors in amounts as required; (5) Holtec Decommissioning International pursuant to the Act and 10 CFR Parts 30, 40, and 70, to receive, possess and use in amounts as required any byproduct, source, or special nuclear materials without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; and (6) Holtec Decommissioning International pursuant to the Act and 10 CFR Parts 30, 40, and 70, to possess, but not separate such byproduct, source, or special nuclear materials that were produced by the operation of the facility.

C. This license shall be deemed to contain and is subject to the conditions specified in the Commissions regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect and is subject to the additional conditions specified or incorporated below:

(1) DELETED (2) Technical Specifications The Technical Specifications contained in Appendices A and B, as revised through Amendment No. 295, are hereby incorporated in the license. Holtec Decommissioning International shall possess, maintain, and decommission the facility in accordance with the Permanently Defueled Technical Specifications (PDTS).

(3) DELETED (4) Holtec Decommissioning International shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822), and the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The combined set of plans1, submitted by letter dated May 17, 2006, is entitled: Oyster Creek Nuclear Generating Station Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan, Revision 5.

The set contains Safeguards Information protected under 10 CFR 73.21.

1 The Training and Qualification Plan and Safeguards Contingency Plan are Appendices to the Security Plan.

Renewed License No. DPR-16 Amendment No. 298

DELETED Holtec Decommissioning International shall fully implement and maintain in effect all provisions of the Commission-approved Exelon Generation Company cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Exelon Generation Company CSP was approved by License Amendment No. 280 and modified by License Amendment Nos. 288 and 292.

(5) DELETED (6) DELETED (7) DELETED (8) Mitigation Strategy License Condition Develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Firefighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance

2. Assessment of mutual aid firefighting assets

3. Designated staging areas for equipment and materials

4. Command and control

5. Training of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets

2. Communications

3. Minimizing fire spread

4. Procedures for implementing integrated fire response strategy

5. Identification of readily-available pre-staged equipment

6. Training on integrated fire response strategy

7. Spent fuel pool mitigation measures (c) Actions to minimize release to include consideration of:

1. Water spray scrubbing

2. Dose to onsite responders (9) The licensee shall implement and maintain all Actions required by Attachment 2 to NRC Order EA-06-137, issued June 20, 2006, except the last action that requires incorporation of the strategies into the site security plan, contingency plan, emergency plan and/or guard training and qualification plan, as appropriate.

(10) DELETED (11) DELETED (12) DELETED Renewed License No. DPR-16 Amendment No. 298

(13) DELETED (14) DELETED (15) DELETED (16) License Renewal Commitments The UFSAR supplement, as revised, describes certain future activities to be completed prior to April 9, 2009, and during the term of this renewed operating license No. DPR-16. Holtec Decommissioning International shall complete these activities in accordance with Appendix A of NUREG-1875, Safety Evaluation Report Related to the License Renewal of Oyster Creek Generating Station, dated March 2007, as supplemented on September 19, 2008, and shall notify the NRC in writing when implementation of those activities required prior to April 9, 2009 are complete and can be verified by NRC inspection.

(17) Biological Opinion Within 30 days from the issuance date of the renewed license, Holtec Decommissioning International shall comply with the terms and conditions of the Incidental Take Statement associated with certain sea turtles in the Biological Opinion in effect or as subsequently issued by the National Marine Fisheries Service regarding operation of the facility.

D. DELETED E. DELETED F. The licensee shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims.

3. Sale and License Transfer Conditions:

A. DELETED B. DELETED C. DELETED D. DELETED E. DELETED F. DELETED G. DELETED Renewed License No. DPR-16 Amendment No. 298

H. DELETED I. DELETED J. DELETED K. DELETED L. DELETED M. DELETED N. At the time of the closing of the transfer of Oyster Creek, and the respective license from Exelon Generation Company to Oyster Creek Environmental Protection and Holtec Decommissioning International, Exelon Generation Company shall transfer ownership and control of assets from the Oyster Creek Nuclear Generating Station Qualified Fund to the Oyster Creek Environmental Protection Qualified Nuclear Decommissioning Trust. Also, at the time of closing, decommissioning funding assurance provided by Oyster Creek Environmental Protection, using a method allowed under 10 CFR 50.75, must be equal to or greater than the minimum amount calculated on that date pursuant to, and required by 10 CFR 50.75 for Oyster Creek. Furthermore, funds dedicated for Oyster Creek prior to closing shall remain dedicated to Oyster Creek following the closing.

4. This license is effective as of the date of issuance and is effective until the Commission notifies the licensee in writing that the license is terminated.

FOR THE NUCLEAR REGULATORY COMMISSION

/RA/

Bruce S. Mallett Deputy Executive Director for Reactor and Preparedness Programs Office of the Executive Director for Operations

Attachment:

Appendices A and B -

Technical Specifications Date of Issuance: April 8, 2009 Renewed License No. DPR-16 Amendment No. 298

Docket No. 50-219 October 1, 1986 APPENDIX A TO PROVISIONAL OPERATING LICENSE DPR-16*

TECHNICAL SPECIFICATIONS AND BASES FOR OYSTER CREEK NUCLEAR POWER PLANT UNIT NO. 1 OCEAN COUNTY, NEW JERSEY OYSTER CREEK ENVIRONMENTAL PROTECTION, LLC AND HOLTEC DECOMMISSIONING INTERNATIONAL, LLC

• Per Errata Sheet dated 4-6-69 Amendment No. 194, 210, 213, 296, 297, 298

NUREG-0488 APPENDIX B TO OPERATING LICENSE NO. DPR- 16 ENVIRONMENTAL TECHNICAL SPECIFICATIONS FOR OYSTER CREEK NUCLEAR GENERATING STATION DOCKET NO. 50-219 OCEAN COUNTY, NEW JERSEY OYSTER CREEK ENVIRONMENTAL PROTECTION, LLC AND HOLTEC DECOMMISSIONING INTERNATIONAL, LLC NOVEMBER 1978*

• Issued to the ASLB on this date; issued by License Amendment No. 37, June 6, 1979.

Amendment No. 59, 66, 107, 194, 207, 210, 213, 271, 296, 297, 298

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO. 298 TO RENEWED FACILITY LICENSE NO. DPR-16 HOLTEC DECOMMISSIONING INTERNATIONAL, LLC OYSTER CREEK ENVIRONMENTAL PROTECTION, LLC OYSTER CREEK NUCLEAR GENERATING STATION DOCKET NO. 50-219 AND 72-15

1.0 INTRODUCTION

By letter dated February 14, 2018 (Agencywide Documents Access and Management System

[ADAMS] Accession No. ML18045A084) Exelon Generation Company, LLC (Exelon), licensee at the time, submitted certification to the U.S. Nuclear Regulatory Commission (NRC or the Commission) indicating its intention to permanently cease power operations at Oyster Creek Nuclear Generating Station (Oyster Creek), pursuant to Title 10 Code of Federal Regulations (10 CFR) 50.82(a)(1)(i). By letter dated September 25, 2018 (ADAMS Accession No. ML18268A258), Exelon certified to the NRC that as of September 17, 2018, operations had ceased at Oyster Creek. Exelon also certified, pursuant to 10 CFR 50.82(a)(1)(ii), that all fuel had been removed from the reactor vessel. Effective July 1, 2019, Oyster Creek Renewed Facility Operating License No. DPR-16, and the general license for the Oyster Creek Independent Spent Fuel Storage Installation (ISFSI) was transferred from Exelon Generation Company, LLC (Exelon) to Oyster Creek Environmental Protection, LLC (OCEP) as the licensed owner and to Holtec Decommissioning International, LLC (HDI) as the licensed decommissioning operator. In a letter dated September 12, 2019 (ADAMS Accession No. ML19256B999), HDI requested the NRC to continue all ongoing regulatory actions and reviews currently underway for Oyster Creek. HDI and OCEP have assumed responsibility for the continuation of these regulatory actions and reviews.

By letter dated November 12, 2018 (ADAMS Accession No. ML18317A022) and as supplemented by letter dated March 7, 2019 (ADAMS Accession No. ML19066A317), Exelon requested a change to Renewed Facility License No. DPR-16 for the Oyster Creek, pursuant to 10 CFR 50.90. The proposed change would remove reference to the Cyber Security Plan (CSP) and update the associated License Condition 2.C.(4) (hereafter, the cyber security license condition) in the renewed facility license. This will allow HDI and OCEP to terminate the Oyster Creek CSP and associated activities at the site. According to Exelon, the proposed change is based on the lowered risk profile of Oyster Creek, a nuclear power reactor that has permanently ceased operations and has removed all fuel from the reactor vessel. Exelon acknowledged that for a decommissioning facility with a permanently defueled reactor, the spectrum of possible accidents is significantly reduced, and the risk of an offsite radiological release is significantly lower.

The NRC staff previously reviewed and approved the Exelons CSP implementation schedule by License Amendment No. 280 dated August 10, 2011 (ADAMS Accession No. ML111861341), to Enclosure 2

Renewed Facility Operating License DPR-16 concurrent with the incorporation of the CSP into the facilitys current licensing basis. The NRC staff then reviewed and approved Exelons request to initially extend the CSP Milestone 8 (MS8) implementation date from December 31, 2015, to December 31, 2017 with License Amendment No. 288, by letter dated July 30, 2015 (ADAMS Accession No. ML15153A282). Additionally, the NRC issued License Amendment No. 292 dated December 22, 2017 (ADAMS Accession No. ML17289A222), to extend the full implementation date of the Oyster Creek CSP Implementation Schedule for MS8 from December 31, 2017, to August 31, 2021.

2.0 REGULATORY EVALUATION

The NRC staff considered the following regulatory requirements and guidance during its review of the November 12, 2018, application to eliminate the existing Oyster Creek CSP license condition:

• Under 10 CFR Section 73.54, Protection of digital computer and communication systems and networks, requires that as of November 23, 2009, each licensee currently licensed to operate a nuclear power plant under 10 CFR Part 50 submit a cyber security plan for Commission review and approval.

• SECY-12-0088, The Nuclear Regulatory Commission Cyber Security Roadmap, dated June 25, 2012 (ADAMS Accession No. ML12135A050), which states, in part, that [b]y regulation, dry cask storage in [independent spent fuel storage installations] allows spent fuel that has already been cooled in the spent fuel pool for 1 year to be surrounded by inert gas inside a storage cask. Licensees that are subject to 10 CFR 72.212, Conditions of General License Issued Under § 72.210, (i.e., licenses limited to storage of spent fuel in casks) must also comply with specific portions of 10 CFR 73.55,

[Requirements for Physical Protection of Licensed Activities in Nuclear Power Reactors against Radiological Sabotage] requirements for physical security and the ASM

[additional security measure] Orders, but are not subject to the provisions of 10 CFR 73.54, which specifically applies to operating reactors and COL (combined operating license) applicants.

• MEMORANDUM, the subject of which is Cyber Security Requirements for Decommissioning Nuclear Power Plants, dated December 5, 2016 (ADAMS Accession No. ML16172A284), was prepared to inform the Commission as to how the staff intends to apply 10 CFR 73.54, Protection of digital computer and communications systems and networks, requirements to nuclear power reactor licensees who have transitioned from an operating status to a decommissioning status.

3.0 TECHNICAL EVALUATION

3.1 Licensees Requested Change In its request, dated November 12, 2018, Exelon requested the removal of the existing cyber security license condition from the Oyster Creek renewed facility license and removal of the commitment to fully implement the CSP by the MS8 commitment date of August 31, 2021.

In that request, Exelon stated that following permanent shutdown of Oyster Creek and removal of spent fuel from the reactor, the spectrum of possible accidents are

significantly reduced and the risk of an offsite radiological release is significantly lower for a permanently defueled reactor. Exelon asserted that the only design-basis accident that could potentially result in an offsite radiological release at Oyster Creek is the fuel handling accident (FHA) which is predicated on spent fuel being stored in the spent fuel pool (SFP). Exelon stated that spent fuel at Oyster Creek is currently stored in both the SFP and the independent spent fuel storage installation. Exelon asserted in this configuration, the spectrum of possible accident transients and accidents is significantly reduced compared to an operating nuclear power reactor.

Exelon performed an analysis that concluded that 33 days after shutdown, the radiological consequence of the FHA would not exceed the limits established by the U.S.

Environmental Protection Agencys (EPA) Protective Action Guides (PAGs) at the exclusion area boundary. Exelon asserted that since Oyster Creek has been permanently shut down for greater than 33 days, the possibility of an offsite radiological release from a design basis accident that could exceed the EPA PAGs is significantly reduced. Exelons analysis concluded that after sufficient cooling time following cessation of reactor operations, there is little chance that the spent fuel in the SFP could heat-up to clad ignition temperature within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, which is sufficient time for mitigation strategies to prevent spent fuel heat-up damage.

Exelon further noted that this rationale is similar to the rationale used to justify a reduction of emergency preparedness requirements during decommissioning, as detailed in NUREG-1738, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, February 2001 (ADAMS Accession No. ML010430066), and documented in safety evaluations associated with decommissioning plant emergency preparedness exemption requests. Exelon previously submitted an analysis to the NRC of the adiabatic heatup of spent fuel scenario in support of requested exemptions from specific requirements of 10 CFR 50.47 and Appendix E to 10 CFR Part 50 for certain emergency planning requirements as appropriate for a decommissioning facility. By letter dated October 22, 2018, Exelon revised its original adiabatic calculation that was approved on October 16, 2018 from a decay period of 365 days to a 285-day decay period from permanent cessation of power operations. The revised analysis was reviewed and approved by the NRC staff who found that after 285 days, more than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> would be available before a significant offsite release could begin. Therefore, the effective date of the exemption to the Emergency Planning Requirements was modified to an effective date of June 29, 2019 (ADAMS Accession No. ML19098A258). The conclusion that resulted from the analysis was that due to the length of time it would take for the adiabatic heat-up to occur, there is ample time to respond to any partial drain down event that might cause such an occurrence by restoring cooling or makeup, or providing spray. As a result, the likelihood that such a scenario would progress to a zirconium fire is not deemed credible.

Exelon also asserted that there is a reduced cyber security risk due, in part, to the fact there are fewer critical digital assets at a decommissioning facility in comparison to the number of critical digital assets at an operating reactor. Exelon stated that following permanent cessation of reactor operations and removal of fuel from the reactor vessel, the digital computers and communication systems and networks that require cyber protection are primarily those associated with security and emergency preparedness functions, and the functioning of safety systems that support operation of the SFP. Once the spent fuel has sufficiently decayed, the potential consequences of a cyber-attack are significantly reduced.

3.2 NRC Staff Evaluation of Requested Change The NRC staff evaluated Exelons application using the regulatory requirements and guidance cited in Section 2.0 of this safety evaluation. The Cyber Security Rule, as contained in 10 CFR 73.54, applies to licensees currently licensed to operate a nuclear power plant. The NRC staff has determined that 10 CFR 73.54 does not apply to reactor licensees that have submitted certifications of permanent cessation of operations and permanent removal of fuel under 10 CFR 50.82(a)(1) or 10 CFR 52.110(a)(1), and whose certifications have been docketed by the NRC. Once the NRC has docketed these certifications, the licensee is no longer authorized to operate a nuclear power plant, and the requirements of 10 CFR 73.54 no longer apply. Exelon certified to the NRC, pursuant to 10 CFR 50.82(a)(1)(i), that as of September 17, 2018, operations had ceased at Oyster Creek. Exelon also certified, pursuant to 10 CFR 50.82(a)(1)(ii), that all fuel had been removed from the reactor vessel. Therefore, pursuant to 10 CFR 50.82(a)(2), Oyster Creeks 10 CFR Part 50 license does not authorize operation of the Oyster Creek reactor or emplacement or retention of fuel into the reactor vessel, and the NRC staff has determined that the Cyber Security Rule at 10 CFR 73.54 no longer applies to Oyster Creek.

Exelon further determined that the fuel has cooled in the spent fuel pool for a sufficient amount of time such that no design-basis accident could have radiological consequences that exceed the EPA PAGs. Exelon completed site-specific analyses supporting the conclusion that a zirconium fire would be highly unlikely in the event of a beyond-design-basis drain down scenario. The NRC staffs previous reviews and approvals of Exelons associated analyses and the results are included in letters to Exelon dated October 16, 2018 (ADAMS Accession No. ML18220A980), and June 11, 2019 (ADAMS Accession No. ML19098A258). The NRC staff verified Exelons analyses and its calculations and concluded that by June 29, 2019, the spent fuel has decayed well beyond the minimum cooling time of 9.38 months that would allow sufficient time (10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />) to mitigate a spent fuel pool drain down in the adiabatic case. Therefore, even if a cyber-attack were to result in the draining of the SFP, consequences of a cyber-attack are much lower now than while the plant was operating or the fuel in the spent fuel pool was not as cool.

Based on its review of Exelons submissions, the NRC staff concludes that Exelons request to remove the existing cyber security license conditions from the Oyster Creek Renewed Facility License No. DPR-16 is acceptable and consistent with maintaining adequate protection of the public health and safety and the common defense and security.

3.3 Revisions to License Conditions Paragraph 2.C.(4)

By letter dated November 12, 2018, Exelon proposed to modify Paragraph 2.C.(4) of Renewed Facility License No. DPR-16 to remove the license condition requiring the licensee to fully implement and maintain in effect all provisions of the NRC-approved CSP.

The license condition in Paragraph 2.C.(4) of Renewed Facility License No. DPR-16, for Oyster Creek is modified to delete the following statement:

Holtec Decommissioning International shall fully implement and maintain in effect all provisions of the Commission-approved Exelon Generation Company cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The Exelon Generation Company CSP was approved by License Amendment No.

280 and modified by License Amendment No. 288 and 292.

4.0 STATE CONSULTATION

In accordance with the Commissions regulations, the New Jersey Department of Environmental Protection was notified of the proposed issuance of the amendment by e-mail, dated June 26, 2019 (ADAMS Accession No. ML19178A070). The NRC received no comments from the New Jersey Department of Environmental Protection.

5.0 ENVIRONMENTAL CONSIDERATION

This amendment relates solely to safeguards matters and does not involve any significant construction impacts and relates to modifications to systems used for security and/or materials accountability. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment on such finding published in the Federal Register on August 15, 2017 (82 FR 38718). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12). Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The NRC staff has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) there is reasonable assurance that such activities will be conducted in compliance with the Commissions regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: S. Coker, NSIR/DPCP/CSB Date: September 18, 2019