ML23100A117

NRC Response - Indian Point Energy Center Generating Units 1, 2, and 3 Letter with Enclosures Regarding Changes to Remove the Cyber Security Plan License Condition

ML23100A117
Person / Time
Site:	Indian Point
Issue date:	11/17/2023
From:	Sturzebecher K Reactor Decommissioning Branch
To:	Fleming J Holtec
Sturzebecher K
References
EPID L-2022-LLA-0072
Download: ML23100A117 (21)

Text

November 17, 2023 Jean A. Fleming Vice President, Licensing, Regulatory Affairs, and PSA Holtec International, LLC Krishna P. Singh Technology Campus 1 Holtec Boulevard Camden, NJ 08104

SUBJECT:

INDIAN POINT NUCLEAR GENERATING UNITS 1, 2, AND 3 - ISSUANCE OF AMENDMENT NO. 66, 298 AND 274 REGARDING CHANGES TO REMOVE THE CYBERSECURITY PLAN LICENSE CONDITION (EPID L-2022-LLA-0072)

Dear Jean Fleming:

The U.S. Nuclear Regulatory Commission (NRC, the Commission) has issued the enclosed Amendment No. 66 to Provisional Operating License No. DPR-5 for Indian Point, Unit 1 (IP1),

Amendment No. 298 to Renewed Facility License No. DPR-26 for Indian Point, Unit 2 (IP2), and Amendment No. 274 to Renewed Facility License No. DPR-64 for Indian Point, Unit 3 (IP3). The amendments delete the Cyber Security Plan from License Condition 3.d of the IP1, License Condition 2.H of the IP2, License Condition 2.G of the IP3 for the Indian Point Energy Center (IPEC) in response to your application dated December 22, 2016 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML22140A126). The Notice of Application for Amendment was published in the Federal Register on December 7, 2022 (87 FR 75074).

As discussed in the enclosed safety evaluation, the NRC staff has reviewed the proposed changes and concluded that the licensee's request to remove the existing cybersecurity license condition from the facility operating licenses is acceptable. The basis for our conclusion is contained in the attached safety evaluation.

Pursuant to Paragraph (c)(12) of Title 10 of the Code of Federal Regulations (10 CFR) 51.22, "Criterion for categorical exclusion; identification of licensing and regulatory actions eligible for categorical exclusion or otherwise not requiring environmental review," the Commission has determined that the issuance of this amendment is categorically excluded, and pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared. Approval of this amendment is an administrative change that relates solely to safeguards matters and does not involve any significant construction impacts.

A copy of the related safety evaluation is provided in Enclosure 4. A Notice of Issuance will be included in the Commissions monthly Federal Register notice.

J. Fleming The NRC staff has determined that its documented safety evaluation does not contain Sensitive Security-Related Information (SUNSI) pursuant to 10 CFR 2.390, Public inspections, exemptions, requests for withholding. In accordance with Title 10 of the Code of Federal Regulations 2.390, Public inspections, exemptions, requests for withholding, of the NRCs Agency Rules of Practice and Procedure, a copy of this letter will be available electronically for public inspection in the NRC Public Document Room or from the Publicly Available Records component of NRCs ADAMS. ADAMS is accessible from the NRC website at https://www.nrc.gov/reading-rm/adams.html.

If you have any questions concerning the above, please contact me at 301-415-8534 or via email at Karl.Sturzebecher@nrc.gov.

Sincerely, Signed by Sturzebecher, Karl on 11/17/23 Karl J. Sturzebecher, Project Manager Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery, and Waste Programs Office of Nuclear Material Safety and Safeguards Docket Nos.50-003, 50-247, 50-286

Enclosures:

1. Amendment No. 66 to DPR-5

2. Amendment No. 298 to DPR-26

3. Amendment No. 274 to DPR-64

4. Safety Evaluation Cc w/enclosures: Indian Point ListServ

HOLTEC DECOMMISSIONING INTERNATIONAL, LLC AND HOLTEC INDIAN POINT 2, LLC INDIAN POINT NUCLEAR GENERATING STATION, UNIT NO. 1 DOCKET NO.50-003 AMENDMENT TO PROVISIONAL OPERATING LICENSE Amendment No. 66 Renewed License No. DPR-5

1. The U.S. Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment by Holtec Decommissioning International, LLC (HDI), on behalf of Holtec Indian Point 2, LLC (IP1 & IP2) for Indian Point Nuclear Generating Station, Unit No. 1 at the Indian Point Energy Center complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR), Chapter I, Nuclear Regulatory Commission; B. The facility will be maintained in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the rules and regulations of the Commission; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; E. The issuance of this amendment is in accordance with 10 CFR Part 51, Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions, of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, as the paragraphs in 3.d) of Provisional Operating License No.

DPR-5, and is hereby amended by deleting this paragraph regarding the cyber security plan:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The HDI CSP was approved by License Amendment No. 55, as supplemented by changes approved by License Amendment Nos. 57, 59, and 60.

3. The license amendment is effective as of its date of issuance and shall be implemented within 60 days.

FOR THE NUCLEAR REGULATORY COMMISSION Signed by Anderson, Shaun on 11/15/23 Shaun Anderson, Chief Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery, and Waste Programs Office of Nuclear Material Safety and Safeguards

Attachment:

Change to Renewed Facility License No. DPR-5 Date of Issuance:

November 17, 2023

ATTACHMENT TO LICENSE AMENDMENT NO. 66 INDIAN POINT NUCLEAR GENERATING STATION, UNIT NO. 1 PROVISIONAL OPERATING LICENSE NO. DPR-5 DOCKET NO.50-003 Replace the following pages of Provisional Operating License No. DPR-5 with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the area of change.

Provisional Operating License No. DPR-26 REMOVE INSERT Page 3 Page 3

HDI has been granted Commission authorization to use "stand alone preemption authority" under Section 161A of the Atomic Energy Act, 42 U.S.C. 2201a with respect to the weapons described in Section II supplemented with Section Ill of Attachment 1 to its application submitted by letter dated August 20, 2013, as supplemented by letters dated November 21, 2013, and July 24, 2014, and citing letters dated April 27, 2011, and January 4, 2012. HDI shall fully implement and maintain in effect the provisions of the Commission-approved authorization.

4. Deleted

5. Deleted

6. Deleted a) Deleted b) Provisional Trust (i) The provisional trust agreement must be in a form acceptable to the NRC.

(ii) Investments in the securities or other obligations of Holtec International or its affiliates, subsidiaries, successors, or assigns are and shall be prohibited. Except for investments tied to market indexes or other non-nuclear-sector mutual funds, investments in any entity owning one or more nuclear power plants are and shall be prohibited.

(iii) The provisional trust agreement must provide that no disbursements or payments from the trust, other than for ordinary administrative expenses, shall be made by the trustee unless the trustee has first given the Director of the Office of Nuclear Reactor Regulation 30 days prior written notice of payment. The provisional trust agreement shall further contain a provision that no disbursements or payments from the trust shall be made if the trustee receives prior written notice of objection from the NRC.

(iv) The provisional trust agreement must provide that the agreement cannot be amended in any material respect, or terminated, without 30 days prior written notification to the Director of the Office of Nuclear Reactor Regulation.

(v) The appropriate section of the provisional trust agreement shall state that the trustee, investment advisor, or anyone else directing the investments made in the trust shall adhere to a "prudent investor" standard, as specified in 18 CFR 35.32(a)(3) of the Federal Energy Regulatory Commission's regulations.

(vi) Use of assets in the provisional trust, in the first instance, shall be limited to the expenses related to decommissioning IP1 or IP2 as defined by the NRC in its regulations and issuances, and as provided in this license and any amendments thereto.

Amendment No. 66

HOLTEC DECOMMISSIONING INTERNATIONAL, LLC AND HOLTEC INDIAN POINT 2, LLC INDIAN POINT NUCLEAR GENERATING UNIT NO. 2 DOCKET NO. 50-247 AMENDMENT TO RENEWED FACILITY LICENSE Amendment No. 298 Renewed License No. DPR-26

1. The U.S. Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment by Holtec Decommissioning International, LLC (HDI), on behalf of Holtec Indian Point 2, LLC (IP1 & IP2) for Indian Point Nuclear Generating Station, Unit No. 2 at the Indian Point Energy Center complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR), Chapter I, Nuclear Regulatory Commission; B. The facility will be maintained in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the rules and regulations of the Commission; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; E. The issuance of this amendment is in accordance with 10 CFR Part 51, Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions, of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, as the paragraphs in 2.H of Renewed Operating License No. DPR-26, and is hereby amended by deleting this paragraph regarding the cyber security plan:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The HDI CSP was approved by License Amendment No. 266, as supplemented by changes approved by License Amendment Nos. 279, 284, and 286.

3. The license amendment is effective as of its date of issuance and shall be implemented within 60 days.

FOR THE NUCLEAR REGULATORY COMMISSION Signed by Anderson, Shaun on 11/15/23 Shaun Anderson, Chief Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery, and Waste Programs Office of Nuclear Material Safety and Safeguards

Attachment:

Change to Renewed Facility License No. DPR-26 Date of Issuance:

November 17, 2023

ATTACHMENT TO LICENSE AMENDMENT NO. 298 INDIAN POINT NUCLEAR GENERATING UNIT NO. 2 RENEWED FACILITY LICENSE NO. DPR-26 DOCKET NO. 50-247 Replace the following pages of Renewed Facility License No. DPR-26 with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the area of change.

Renewed Facility License No. DPR-26 REMOVE INSERT Page 5 Page 5

HDI has been granted Commission authorization to use "stand alone preemption authority" under Section 161A of the Atomic Energy Act, 42 U.S.C. 2201a with respect to the weapons described in Section II supplemented with Section Ill of Attachment 1 to its application submitted by letter dated August 20, 2013, as supplemented by letters dated November 21, 2013, and July 24, 2014, and citing letters dated April 27, 2011, and January 4, 2012. HDI shall fully implement and maintain in effect the provisions of the Commission-approved authorization.

I. Deleted per Amdt. 133, 7-6-88.

J. Deleted per Amdt. 133, 7-6-88.

K. Deleted per Amendment No. 294.

L. Deleted per Amendment 238.

M. Deleted per Amendment 238.

N. Mitigation Strategy License Condition The licensee shall develop and maintain strategies for addressing large fires and explosions and that include the following key areas:

(a) Fire fighting response strategy with the following elements:

1. Pre-defined coordinated fire response strategy and guidance

2. Assessment of mutual aid fire fighting assets

3. Designated staging areas for equipment and materials

4. Command and control

5. Training of response personnel (b) Operations to mitigate fuel damage considering the following:

1. Protection and use of personnel assets

2. Communications

3. Minimizing fire spread

4. Procedures for implementing integrated fire response strategy

5. Identification of readily-available pre-staged equipment

6. Training on integrated fire response strategy Amendment No. 298

HOLTEC DECOMMISSIONING INTERNATIONAL, LLC AND HOLTEC INDIAN POINT 3, LLC INDIAN POINT NUCLEAR GENERATING UNIT NO. 3 DOCKET NO. 50-286 AMENDMENT TO RENEWED FACILITY LICENSE Amendment No. 274 Renewed License No. DPR-64

1. The U.S. Nuclear Regulatory Commission (NRC, the Commission) has found that:

A. The application for amendment by Holtec Decommissioning International, LLC (HDI), on behalf of Holtec Indian Point 3, LLC (IP3) for Indian Point Nuclear Generating Station, Unit No. 3 at the Indian Point Energy Center complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commissions rules and regulations set forth in Title 10 of the Code of Federal Regulations (10 CFR), Chapter I, Nuclear Regulatory Commission; B. The facility will be maintained in conformity with the application, as amended, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the rules and regulations of the Commission; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; E. The issuance of this amendment is in accordance with 10 CFR Part 51, Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions, of the Commissions regulations and all applicable requirements have been satisfied.

2. Accordingly, the license is amended by changes as indicated in the attachment to this license amendment, to paragraphs in 2.G of Renewed Operating License No. DPR-64, and is hereby amended by deleting this paragraph regarding the cyber security plan:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p). The HDI CSP was approved by License Amendment No. 243, as supplemented by changes approved by License Amendment Nos. 254, 260, and 263.

3. The license amendment is effective as of its date of issuance and shall be implemented within 60 days.

FOR THE NUCLEAR REGULATORY COMMISSION Signed by Anderson, Shaun on 11/15/23 Shaun Anderson, Chief Reactor Decommissioning Branch Division of Decommissioning, Uranium Recovery, and Waste Programs Office of Nuclear Material Safety and Safeguards

Attachment:

Change to Renewed Facility License No. DPR-64 Date of Issuance:

November 17, 2023

ATTACHMENT TO LICENSE AMENDMENT NO. 274 INDIAN POINT NUCLEAR GENERATING UNIT NO. 3 RENEWED FACILITY LICENSE NO. DPR-64 DOCKET NO. 50-286 Replace the following pages of Renewed Facility License No. DPR-64 with the attached revised pages. The revised pages are identified by amendment number and contain marginal lines indicating the area of change.

Renewed Facility License No. DPR-26 REMOVE INSERT Page 4 Page 4

HDI has been granted Commission authorization to use stand alone preemption authority under Section 161A of the Atomic Energy Act, 42 U.S.C. 2201a with respect to the weapons described in Section II supplemented with Section Ill of Attachment 1 to its application submitted by letter dated August 20, 2013, as supplemented by letters dated November 21, 2013, and July 24, 2014, and citing letters dated April 27, 2011, and January 4, 2012. HDI shall fully implement and maintain in effect the provisions of the Commission-approved authorization.

H. Deleted per Amendment No. 270 I. DELETED J. DELETED K. DELETED L. DELETED M. DELETED N. DELETED O. Deleted per Amendment No. 270 P. Deleted Q. DELETED R. DELETED S. DELETED T. DELETED U. DELETED V. DELETED Amendment No. 274

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS RELATED TO AMENDMENT NOS. 66, 298 AND 274 TO PROVISIONAL OPERATING LICENSE NO. DPR-5 RENEWED FACILITY OPERATING LICENSES NOS. DPR-26 AND DPR-64 HOLTEC DECOMMISSIONING INTERNATIONAL, LLC, HOLTEC INDIAN POINT 2, LLC, AND HOLTEC INDIAN POINT 3, LLC INDIAN POINT NUCLEAR GENERATING UNITS 1, 2 AND 3 DOCKET NOS.50-003, 50-247, and 50-286

1.0 INTRODUCTION

By letter dated December 11, 2008 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML083510667), Entergy Nuclear Operations Inc. (Entergy) notified the U.S. Nuclear Regulatory Commission (NRC) that all remaining spent fuel assemblies had been removed from the Indian Point Unit 1 (IP1) spent fuel pool (SFP) and placed in the existing Independent Spent Fuel Storage Installation (ISFSI). Additionally, by the same letter it notified the NRC that the IP1 SFP had been drained. By letter dated February 8, 2017, (ML17044A004) pursuant to Title 10 of the Code of Federal Regulations (10 CFR) Section 50.82(a)(1)(i), Entergy provided formal notification to the NRC that it planned to permanently cease power operations at Indian Point Nuclear Generating Unit Nos. 2 (IP2) and 3 (IP3) by April 30, 2020, and April 30, 2021 respectively. Entergy permanently ceased power operations at IP1 on October 31, 1974, IP2 on April 30, 2020, and IP3 on April 30, 2021. By letter dated May 12, 2020 (ML20133J902), Entergy certified that all fuel was permanently removed from the IP2 reactor and placed in the SFP on May 12, 2020. Entergy certified that all fuel was permanently removed from the IP3 reactor vessel and placed in the SFP on May 11, 2021, by a letter of the same date (ML21131A157). Based on the docketing of these certifications for permanent cessation of operations and permanent removal of fuel from the reactor vessels, as specified in 10 CFR 50.82(a)(2), the 10 CFR Part 50 license for IP1, IP2, and IP3 no longer authorizes operation of the reactor or emplacement or retention of fuel into the reactor vessel.

Spent fuel is currently stored onsite at the Indian Point Energy Center (IPEC) facility in the IP2 SFP, IP3 SFP and ISFSI.

Enclosure 4

By letter dated May 20, 2022 (ML22140A126), Holtec Decommissioning International, LLC (HDI), on behalf of Holtec Indian Point 2, LLC (IP1 & IP2) and Holtec Indian Point 3, LLC (IP3),

collectively referred to as IPEC, requests an amendment to Provisional License No. DPR-5 for IP1, Renewed Facility License No. DPR-26 for IP2, and Renewed Facility Operating License No. DPR-64 for IP3. Specifically, this license amendment request proposes to remove the cybersecurity plan (CSP) requirements contained in License Condition 3.d of the IP1 Provisional License, License Condition 2.H of the IP2 Renewed Facility License, and License Condition 2.G of the IP3 Renewed Facility License. The proposed change is requested to support the decommissioning of IPEC. The licensee states this request considers the cooling period for spent fuel stored in the SFPs after the IP2 and IP3 reactors have been permanently shut down that is consistent with recent NRC guidance on cybersecurity requirements for decommissioning facilities.

The NRC staff initially reviewed and approved the licensees original CSP implementation schedule by Amendment No. 55 to Provisional Operating License No. DPR-5 for IP1, Amendment No. 266 to Facilities Operating License (FOL) No. DPR-26 for IP2, and Amendment No. 243 to FOL No. DPR-64 for IP3 all dated August 2, 2011 (ML11152A027), concurrent with the incorporation of the CSP into the facilitys current licensing basis. Subsequently, the NRC staff also reviewed and approved by license amendment two extensions to the original full implementation date. The first extension approval extended the full implementation date to June 30, 2016 (ML14316A526), and the second extension approval extended the full implementation date to December 31, 2017 (ML16064A215).

The NRC staff then reviewed and approved the licensees current CSP implementation schedule by Amendment No. 57 to Provisional Operating License No. DPR-5 for IP1, Amendment No. 279 to FOL No. DPR-26 for IP2, and Amendment No. 254 to FOL No. DPR-64 for IP3 dated December 8, 2017 (ML17315A000), extending the completion date for Milestone 8 to December 31, 2018.

2.0 REGULATORY EVALUATION

The NRC staff considered the following regulatory requirements and guidance during its review of the May 20, 2022, license amendment application to remove the IP1, IP2, and IP3 CSP license conditions:

• The regulation under 10 CFR 73.54, Protection of digital computer and communication systems and networks, requires that as of November 23, 2009, each licensee currently licensed to operate a nuclear power plant under 10 CFR Part 50 shall submit a CSP that satisfies the requirements of 10 CFR 73.54 for Commission review and approval.

• SECY-12-0088, The Nuclear Regulatory Commission Cyber Security Roadmap, dated June 25, 2012 (ML12135A050), communicates the staffs approach or roadmap for evaluating the need for cybersecurity requirements for NRC licensees and facilities to include: (1) fuel cycle facilities; (2) non-power reactors; (3) independent spent fuel storage installations (ISFSIs); and (4) byproduct materials licensees.

• A memorandum dated December 5, 2016, from the NRC Executive Director for Operations, Cyber Security Requirements for Decommissioning Nuclear Power Plants (ML16172A284) was prepared to inform the Commission as to how the staff intended to apply 10 CFR 73.54, Protection of digital computer and communications systems and networks, to nuclear power reactor licensees who have transitioned from an operating status to a decommissioning status.

3.0 TECHNICAL EVALUATION

3.1 Licensees Requested Change In its request dated May 20, 2022, HDI requested the removal of the existing cybersecurity license condition from the IP1 Provisional License, IP2 and IP3 renewed facility licenses.

HDI asserted there is a reduced cybersecurity risk due, in part, to the fact there are fewer critical digital assets at a decommissioning reactor in comparison to the number of critical digital assets at an operating reactor. The licensee stated that once spent fuel is moved from the reactor vessel and placed in the SFP, the digital computers and communication systems and networks that require cyber protection are primarily those associated with security and emergency preparedness functions, and those safety systems that support operation of the SFP. Based on the analysis provided by HDI in its May 20, 2022, request, after 15 months cooling time following cessation of IP3 reactor operations there is little chance that the spent fuel in the SFP could heat up to clad ignition temperature within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />, which is sufficient time for mitigation strategies to prevent spent fuel heat up damage. Once the spent fuel has sufficiently decayed, the potential consequences of a cyberattack are significantly reduced.

3.2 NRC Staff Evaluation of Requested Change The NRC staff evaluated HDIs application using the regulatory requirements and guidance cited in Section 2.0 of this safety evaluation. The cybersecurity requirements contained in 10 CFR 73.54 apply to licensees currently licensed to operate a nuclear power plant. The NRC staff has determined that 10 CFR 73.54 does not apply to reactor licensees that have submitted certifications of permanent cessation of operations and permanent removal of fuel under 10 CFR 50.82(a)(1) or 10 CFR 52.110(a)(1), and whose certifications have been docketed by the NRC. Due to the submission of notifications to the NRC of the permanent cessation of power operations at IP2 and IP3 on April 30, 2020 and April 30, 2021 respectively, the placement of spent fuel in the ISFSI for IP1 on December 11, 2002, and removal of all fuel from the reactors of IP2 and IP3 May 12, 2020 and May 11, 2021, along with the docketing of these certifications by the NRC the IP1, IP2 and IP3 licenses no longer authorize use of the facility for power operation or emplacement or retention of fuel into the reactor vessel. Therefore, the NRC staff has determined that 10 CFR 73.54 no longer applies to IP1, IP2 or IP3 because the licensee is no longer licensed to operate a nuclear power plant or place or retain fuel in the reactor vessel.

Notwithstanding the determination that 10 CFR 73.54 does not apply to licensees that have submitted the certifications described above and that are consequently no longer licensed to operate a nuclear power plant or place or retain fuel in the reactor vessel, such licensees are still subject to their CSP license conditions until the condition is removed from the license pursuant to a license amendment request under 10 CFR 50.90. Accordingly, licensees that are decommissioning but still have fresh fuel in their SFPs remain subject to their CSP license conditions. As stated in the December 5, 2016, memorandum, the staff evaluates requests for removal of CSP license conditions on a case-by-case basis. Additionally, within that memorandum, the staff considered if there is a sufficient cooling period for the spent fuel to mitigate the risk of heat up to clad ignition temperature within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />. The staff concluded that 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is sufficient time for plant staff to reliably implement required mitigation strategies to prevent spent fuel heat up damage.

In accordance with the guidance in the December 5, 2016, memorandum, the staff assessed the status of the spent fuel for IP1, IP2, and IP3. Spent fuel for IP1 was transferred to an ISFSI on December 11, 2008, spent fuel for IP2 was put into the SFP on May 12, 2020 and spent fuel for IP3 was placed into the SPF on May 11, 2021. The fuel has currently been in the IP2 SFP and IP3 SFP for at least 15 months. The staff determined that the fuel has undergone a sufficient cooling period to mitigate the risk of clad ignition within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> prior to the implementation of effective mitigation strategies. Accordingly, if a cyberattack were to result in the draining of the SFP at least 15 months after permanent shutdown of IP2 and IP3, the spent fuel would be cool enough to provide the licensee with sufficient time to take effective measures to mitigate the consequences of any cyber attack.

As stated in the Cyber Roadmap Memo, dry cask storage in ISFSIs allows spent fuel that has already been cooled in the SFP for 1 year to be surrounded by inert gas inside a storage cask.

Licensees that are subject to 10 CFR 72.212, Conditions of General License Issued Under § 72.210 (i.e., licenses limited to storage of spent fuel in casks) must also comply with specific portions of 10 CFR 73.55 [Requirements for Physical Protection of Licensed Activities in Nuclear Power Reactors against Radiological Sabotage] requirements for physical security and the ASM [additional security measure] Orders, but are not subject to the provisions of 10 CFR 73.54, which specifically applies to operating reactors and COL [combined operating license]

applicants. All of the spent fuel from IP2 and IP3 has cooled in a SPF over one year and can be moved to an ISFSI for storage. Stored within an ISFSI, the cybersecurity requirements of 10 CFR 73.54 are no longer applicable; however, the ISFSI will still be protected by the applicable physical security requirements and ASMs.

Based on its review of HDIs submissions, the NRC staff concludes that HDIs request to remove the existing cybersecurity license condition from IP1s Provisional License No. DPR-5, IP2 and IP3 Renewed Facility License Nos. DPR-26 and DPR-64 is acceptable and consistent with maintaining adequate protection of the public health and safety and the common defense and security.

3.3 Revision to License Condition 3.d of the IP1 Provisional License By letter dated May 20, 2022, HDI proposed to modify License Condition 3.d of the IP1 Provisional License, License Condition 2.H of the IP2 Renewed Facility License, and License Condition 2.G of the IP3 Renewed Facility License to remove the license condition requiring the licensee to fully implement and maintain in effect all provisions of the NRC-approved CSP.

The License Condition 3.d of the Provisional License No. DPR-5, for IP1 is modified to delete the following statement:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54 (p). The ENO CSP was approved by License Amendment No. 55, as supplemented by changes approved by License Amendment Nos. 57, 59, and 60.

The License Condition 2.H of the Renewed Facility License No. DPR-26, for IP2 is modified to delete the following statement:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54 (p). The ENO CSP was approved by License Amendment No. 266, as supplemented by changes approved by License Amendment Nos. 279, 284, and 286.

The License Condition 2.G of the Renewed Facility License No. DPR-64, for IP3 is modified to delete the following statement:

HDI shall fully implement and maintain in effect all provisions of the Commission-approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54 (p). The ENO CSP was approved by License Amendment No. 243, as supplemented by changes approved by License Amendment Nos. 254, 260, 263, and 271.

HDI has requested approval of this modification by January 31, 2023. Based on IP3s permanent shutdown date on April 30, 2021, and the earlier shutdown of IP2 on April 30, 2020, the calculated decay time of 15 months elapsed on August 1, 2022.

4.0 STATE CONSULTATION

The NRC provided technical support to the New York State Energy Research and Development Authority (NYSERDA) during their review of HDIs license amendment request. The NRC staff informally addressed a total of eight questions relating to elimination of the CSP.

In accordance with the Commissions regulations, the New York State official was notified of the proposed issuance of the amendment on December 9, 2022. The State official provided comments dated February 14, 2023 (ML23052A214), opposing HDIs request for the NRC to amend and remove the CSP requirements for the IPEC site before all spent fuel at the site has been removed from spent fuel pools and placed into dry cask storage. The comments were taken into consideration in the safety evaluation.

5.0 ENVIRONMENTAL CONSIDERATION

This amendment relates solely to safeguards matters and does not involve any significant construction impacts. The Commission has previously issued a proposed finding that the amendment involves no significant hazards consideration, and there has been no public comment or request for a hearing and petition for leave to intervene (petition) with respect to the action on such finding published in the Federal Register on December 7, 2022 (87 FR 75074)

(ML22313A010). The amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12), because it is issuance of an amendment to a license solely related to a safeguards matter and it does not involve any significant construction impacts. Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

Principal Contributor: S. Coker, NSIR

Ltr ML23100A117

• via email OFFICE NMSS/DWUP/RDB NSIR/DPCP/CSB* NSIR/DPCP/CSB NMSS/DUWP/RDB NAME KSturzebecher KS SCoker SC BYip BY SAnderson SA DATE Apr 11, 2023 Apr 13, 2023 Apr 17, 2023 Nov 15, 2023 OGC/GCHA/AGCOR OFFICE NMSS/DUWP/RDB NMSS/DWUP/RDB

/NLO*

NAME KGamin KG SAnderson SA KSturzebecher KS DATE Nov 15, 2023 Nov 15, 2023 Nov 17, 2023