ML15302A433

Beaver Valley Power Station, Unit Nos. 1 and 2 - Issuance of Amendments Request to Change Cyber Security Implementation Plan Milestone 8 Completion Date (CAC Nos. MF5879 and MF5880)

ML15302A433
Person / Time
Site:	Beaver Valley
Issue date:	12/01/2015
From:	Lamb T A Plant Licensing Branch 1
To:	Larson E A FirstEnergy Nuclear Operating Co
Lamb T A, NRR/DORL/LPLI-2
References
CAC MF5879, CAC MF5880
Download: ML15302A433 (19)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 December 1, 2015 Mr. Eric A. Larson, Site Vice President FirstEnergy Nuclear Operating Company Beaver Valley Power Station Mail Stop A-BV-SEB1 P.O. Box 4, Route 168 Shippingport, PA 15077

SUBJECT:

BEAVER VALLEY POWER STATION, UNIT NOS. 1 AND 2 -ISSUANCE OF AMENDMENTS RE: REQUEST TO CHANGE CYBER SECURITY IMPLEMENTATION PLAN MILESTONE 8 COMPLETION DATE (CAC NOS. MF5879 AND MF5880)

Dear Mr. Larson:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 295 to Renewed Facility Operating License No. DPR-66 for the Beaver Valley Power Station, Unit No. 1 (BVPS-1), and Amendment No. 183 to Renewed Facility Operating License No. NPF-73 for the Beaver Valley Power Station, Unit No. 2 (BVPS-2).

These amendments consist of changes to the Facility Operating Licenses in response to your application dated March 19, 2015, as supplemented by letter dated May 6, 2015. The amendments change the BVPS-1 and BVPS-2 Facility Operating Licenses.

Specifically, the license amendments revise the Cyber Security Plan Milestone 8 full implementation date as set forth in the cyber security plan implementation schedule, by extending the full implementation date to December 31, 2017. A copy of the related safety evaluation is enclosed.

The Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Docket Nos. 50-334 and 50-412

Enclosures:

1. Amendment No. 295 to DPR-66 2. Amendment No. 183 to NPF-73 3. Safety Evaluation cc w/enclosures:

Distribution via Listserv Taylor A. Lamb, Project Manager Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FIRSTENERGY NUCLEAR OPERATING COMPANY FIRSTENERGY NUCLEAR GENERATION.

LLC DOCKET NO. 50-334 BEAVER VALLEY POWER STATION. UNIT NO. 1 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 295 Renewed License No. DPR-66 1. The Nuclear Regulatory Commission (the Commission) has found that: A. The application for amendment by FirstEnergy Nuclear Operating Company, (FENOC)* acting on its own behalf and as agent for FirstEnergy Nuclear Generation, LLC (the licensees), dated March 19, 2015, as supplemented by letter dated May 6, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I. B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• FENOC is authorized to act as agent for FirstEnergy Nuclear Generation, LLC, and has exclusive responsibility and control over the physical construction, operation, and maintenance of the facility.

Enclosure 1 2. Accordingly, the license is amended as indicated in the attachment to this license amendment, and Paragraph 2.D of Renewed Facility Operating License No. DPR-66 is hereby amended to read as follows: FENOC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FE NOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 1 O CFR 50.90 and 10 CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by license Amendment No. 287, and amended by License Amendment No. 295. 3. This license amendment is effective as of its date of issuance and shall be implemented within 30 days.

Attachment:

Changes to the Renewed Facility Operating License Date of Issuance:

December 1 , 2015 FOR THE NUCLEAR REGULATORY COMMISSION . Douglas A. Broaddus, Chief Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ATTACHMENT TO LICENSE AMENDMENT NO. 295 FACILITY OPERATING LICENSE NO. DPR-66 DOCKET NO. 50-334 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains marginal lines indicating the areas of change. Remove Page 7 Page 7 D. Physical Protection FENOC shall fully implement and maintain in effect all provisions of the approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FE NOC shall fully implement and maintain in effect all provisions of the approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by License Amendment No. 287, and amended by License Amendment No. 295. E. All work and activities in connection with this project shall be performed pursuant to the provisions of the Commonwealth of Pennsylvania Clean Streams Acts of June 24, 1913, as amended and of June 22, 1937, as amended, and in accordance with all permits issued by the Department of Environmental Resources of the Commonwealth of Pennsylvania.

F. License Renewal Commitments

-The UFSAR supplement, as revised, submitted pursuant to 10 CFR 54.21 ( d), describes certain future activities to be completed prior to and/or during the period of extended operation.

FENOC shall complete these activities in accordance with Appendix A of NUREG-1929, Safety Evaluation Report Related to the Beaver Valley Power Station, Units 1 and 2, dated October 2009, and Supplement 1 of NUREG-1929, dated October 2009, and shall notify the NRC in writing when activities to be completed prior to the period of extended operation are complete and can be verified by NRC inspection.

G. UFSAR Supplement Changes -The information in the UFSAR supplement, as revised, submitted pursuant to 10 CFR54.21 ( d), shall be incorporated into the UFSAR as required by 10 CFR 50.71 (e) following the issuance of this renewed operating license. Until that update is complete, FENOC may not make changes to the information in the supplement.

Following incorporation into the UFSAR, the need for prior Commission approval of any changes will be governed by 1 O CFR 50.59. H. Capsule Withdrawal Schedule -For the renewed operating license term, all capsules in the reactor vessel that are removed and tested must meet the test procedures and reporting requirements of American Society for Testing and Materials (ASTM) E 185-82 to the extent practicable for the configuration of the specimens in the capsule. Any changes to the capsule withdrawal schedule, including spare capsules, must be approved by the NRC prior to implementation.

I. Containment Liner Volumetric Inspection

-a) If degradation (greater than 10 percent of the nominal thickness not attributable to fabrication/erection practices) is identified in the non-random areas examined using ultrasonic testing (UT) as described in Supplement 1 of NUREG-1929, UT examinations shall be performed at additional non-random areas, to be selected based on this operating experience.

Should additional degradation be identified, additional non-random areas shall be UT examined until no further degradation (greater than 1 O percent of the nominal thickness) is identified.

All areas with degradation shall be reexamined over at least the next three successive inspection periods to ensure that progression of the degradation is not occurring.

Beaver Valley Unit 1 Amendment No. 295 Renewed Operating License DPR-66 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 FIRSTENERGY NUCLEAR OPERATING COMPANY FIRSTENERGY NUCLEAR GENERATION.

LLC DOCKET NO. 50-412 BEAVER VALLEY POWER STATION. UNIT NO. 2 AMENDMENT TO RENEWED FACILITY OPERATING LICENSE Amendment No. 183 Renewed License No. NPF-73 1. The Nuclear Regulatory Commission (the Commission) has found that: A. The application for amendment by FirstEnergy Nuclear Operating Company, (FENOC)* acting on its own behalf and as agent for FirstEnergy Nuclear Generation, LLC (the licensees), dated March 19, 2015, as supplemented by letter dated May 6, 2015, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I. B. The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; C. There is reasonable assurance (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; D. The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and E. The issuance of this amendment is in accordance with 1 O CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied.

• FENOC is authorized to act as agent for FirstEnergy Nuclear Generation, LLC, and has exclusive responsibility and control over the physical construction, operation, and maintenance of the facility.

Enclosure 2 2. Accordingly, the license is amended as indicated in the attachment to this license amendment, and Paragraph

2. E of Renewed Facility Operating License No. NPF-73 is hereby amended to read as follows: FENOC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FE NOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 1 O CFR 50.90 and 1 O CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by License Amendment No. 17 4, and amended by License Amendment No. 183. 3. This license amendment is effective as of its date of issuance and shall be implemented within 30 days.

Attachment:

Changes to the Renewed Facility Operating License Date of Issuance:

December 1 , 2015 FOR THE NUCLEAR REGULATORY COMMISSION Douglas A. Broaddus, Chief Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation ATTACHMENT TO LICENSE AMENDMENT NO. 183 FACILITY OPERATING LICENSE NO. NPF-73 DOCKET NO. 50-412 Replace the following page of the Renewed Facility Operating License with the attached revised page. The revised page is identified by amendment number and contains marginal lines indicating the areas of change. Remove Page 8 Page 8 (2) The facility requires an exemption from the requirements of 10 CFR 50, Appendix J, Section lll.D.2(b)(ii).

The justification of this exemption is contained in Section 6.2.6 of Supplement 5 to the Safety Evaluation Report and modified by a letter dated July 26, 1995. The staffs environmental assessment was published on May 12, 1987 (52 FR 17651) and on June 9, 1995 (60 FR 30611 ). Therefore, pursuant to 10 CFR 50.12(a)(1) and 10 CFR 50.12(a)(2)(ii) and (iii), Beaver Valley Power Station, Unit 2 is exempt from the quoted requirements and instead, is required to perform the overall air lock leak test at pressure Pa before establishing containment integrity if air lock maintenance has been performed that could affect the air lock sealing capability.

Local leak rate testing at a pressure of not less than Pa may be substituted for an overall air lock test where the design permits. E. Physical Security FENOC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FENOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by License Amendment No. 174, and amended by License Amendment No.183. F. Fire Protection Program (Section 9.5.1 of SER Supplement

3) FENOC shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report through Amendment No. 17, and submittals dated May 18, May 20, May 21, June 24 and July 6, 1987, and as described in the Safety Evaluation Report dated October 1985, and Supplements 1 through 6, subject to the following provision:

FENOC may make changes to the approved fire protection program without prior approval of the Commission only if those changes would not adversely affect the ability to achieve and maintain safe shutdown in the event of a fire. Beaver Valley Unit 2 Amendment No. 183 Renewed Operating License NPF-73 UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NOS. 295 AND 183 TO RENEWED FACILITY OPERATING LICENSE NOS. DPR-66 AND NPF-73 FIRSTENERGY NUCLEAR OPERATING COMPANY FIRST ENERGY NUCLEAR GENERATION.

LLC BEAVER VALLEY POWER STATION. UNIT NOS. 1 AND 2 DOCKET NOS. 50-334 AND 50-412

1.0 INTRODUCTION

By application dated March 19, 2015 (Agencywide Documents Access and Management System (ADAMS) Accession No. ML 15084A346), as supplemented by letter dated May 6, 2015 (ADAMS Accession No. ML 15127 A202), FirstEnergy Nuclear Operating Company, et al. (FENOC or the licensee), requested changes to the Renewed Facility Operating Licenses (FOLs) for Beaver Valley Power Station, Unit Nos. 1 and 2 (BVPS-1 and BVPS-2). The proposed change would revise the BVPS-1 and BVPS-2 Renewed FOLs. Specifically, the proposed license amendment would revise the Cyber Security Plan (CSP) Milestone 8 full implementation date as set forth in the CSP implementation schedule.

Portions of the letter dated March 19, 2015, contain sensitive unclassified non-safeguards information and, accordingly, those portions are withheld from public disclosure in accordance with the provisions of paragraph 2.390(d)(1) of Title 10 of the Code of Federal Regulations (10 CFR). The supplement dated May 6, 2015, provided additional information that clarified the application, did not expand the scope of the application as originally noticed, and did not change the staff's original proposed no significant hazards consideration determination as published in the Federal Register on July 7, 2015 (80 FR 38774).

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRC or the Commission) staff reviewed and approved the licensee's existing CSP implementation schedule by License Amendment No. 287 to Renewed FOL No. DPR-66, dated July 28, 2011, for BVPS-1, and by License Amendment No. 174 to Renewed FOL No. NPF-73, dated July 28, 2011, for BVPS-2 (ADAMS Accession No. ML 111940123).

The approved amendment incorporated the CSP into the facility's current licensing basis via revision to the physical protection license condition.

The NRC staff considered the following regulatory requirements and guidance in its review of the Enclosure 3 current license amendment request (LAR) to modify the existing CSP implementation schedule:

• 10 CFR Section 73.54, "Protection of digital computer and communication systems and networks," which states, in part, that: "Each [CSP] submittal must include a proposed implementation schedule.

Implementation of the licensee's cyber security program must be consistent with the approved schedule."

• The licensee's Renewed FOLs include a license condition that requires the licensee to fully implement and maintain in effect all provisions of the Commission-approved CSP.

• The BVPS Amendments Nos. 287 and 17 4, dated July 28, 2011, which approved the licensee's CSP implementation schedule, include the following statement: "FENOC shall fully implement and maintain in effect all provisions of the Commission-approved CSP, including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p)."

• In a publicly available NRC memorandum dated October 24, 2013 (ADAMS Accession No. ML 13295A467), "Review Criteria for Title 10 of the Code of Federal Regulations Part 73.54, Cyber Security Implementation Schedule Milestone 8 License Amendment Requests," the NRC staff listed criteria to consider during evaluations of licensees' requests to postpone their cyber security program implementation date (commonly known as Milestone 8). The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54 that, "[i]mplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML 110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the NRG-approved CSP implementation schedule, therefore, will require prior NRC approval as required by 1 O CFR 50.90. 3.0 TECHNICAL EVALUATION Background information regarding cyber security implementation plans and a description of each milestone can be found in the Nuclear Energy Institute (NEI) letter dated February 28, 2011, "Template for the Cyber Security Plan Implementation Schedule" (ADAMS Package Accession No. ML 110600206).

3.1 Licensee's

Requested Change Amendment No. 287 to Renewed FOL No. DPR-66 for BVPS-1 was issued on July 28, 2011. Amendment No. 174 to Renewed FOL No. NPF-73 for BVPS-2 was issued on July 28, 2011. The NRC staff also approved the licensee's CSP implementation schedule as discussed in the safety evaluation (SE) issued with the amendments.

The implementation schedule had been submitted by the licensee based on the template prepared by NEI, which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules by letter dated March 1, 2011 (ADAMS Accession No. ML 110070348).

The licensee's proposed implementation schedule for the CSP identified completion dates and bases for the following eight milestones:

1) Establish the Cyber Security Assessment Team (CSAT); 2) Identify Critical Systems (CSs) and Critical Digital Assets (CDAs); 3) Install a deterministic one-way device between lower level devices and higher level devices; 4) Implement portable media and mobile device control program; 5) Implement observation and identification of obvious cyber-related tampering to existing insider mitigation rounds; 6) Implement cyber security controls to physical security target set CDAs; 7) Conduct ongoing monitoring and assessment activities for physical security target set CDAs; 8) Fully implement the CSP. Currently, Milestone 8 of the licensee's CSP requires the licensee to fully implement the CSP by February 1, 2016. In its March 19, 2015, application, FENOC requested to change the Milestone 8 completion date to December 31, 2017. 3.2 NRC Staff Evaluation The cyber security implementation schedule demonstrates the licensee's ongoing implementation of its CSP prior to full implementation.

For BVPS, the date for full implementation is specified by Milestone

8. The aggregate of the CSP interim milestones, which are listed in Section 3.1 of this SE, demonstrate ongoing implementation of the CSP. The importance of ongoing implementation is reflected in the NRC staff's October 24, 2013, memorandum, which contains guidance for considering requests to postpone the CSP full implementation date. The criteria in the guidance are: 1) Identification of the specific requirement or requirements of the CSP that the licensee needs additional time to implement.

2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

3) A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available. 4) An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.

5) A description of the licensee's methodology for prioritizing completion of work for critical digital assets associated with significant safety consequences and with reactivity effects in the balance of plant. 6) A discussion of the licensee's cyber security program performance up to the date of the license amendment request. 7) A discussion of cyber security issues pending in the licensee's corrective action program. 8) A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee submitted its application on March 19, 2015, after the NRC staff issued the guidance.

The licensee's application addressed each of the criteria in the guidance.

The NRC staff has evaluated the licensee's application addressing the above criteria in its submittal dated March 19, 2015, and its May 6, 2015, supplement.

The NRC staff's evaluation is below, numbered to match the criteria above. 1) Identification of the specific requirement or requirements of the CSP that the licensee needs additional time to implement.

The licensee stated that it needs additional time to implement CSP Section 3.1, "Analyzing Digital Computer Systems and Networks and Applying Cyber Security Controls." The licensee identified the challenges to completing implementation of the CSP requirement.

2) Detailed justification that describes the reason the licensee requires additional time to implement the specific requirement or requirements identified.

The licensee noted that there are ongoing issues that need resolution prior to completing implementation of CSP Section 3.1. These include CDA assessment, remediation activities, and change management challenges.

The licensee provided the following details on the efforts: a) CDA assessment work is resource intensive.

• BVPS has approximately 1,300 CDAs.

• A large number of security controls must be addressed for each CDA.

• Assessment tool set-up is challenging.

• Rework is a major concern. b) Remediation activities need to be carefully considered.

• Security controls modifications are unique and new to the plant and suppliers.

• Plant modifications must be carefully implemented to ensure they do not impact plant safety and operation.

• Suppliers are releasing products in response to the cyber security rule that need to be evaluated and investigated prior to implementation.

c) Change management challenges.

• Cyber security is challenging because it integrates into day-to-day plant operations, maintenance, engineering, and procurement activities.

• Integration of cyber security controls is taking longer than expected due to impacts on the work control process and maintenance activities.

• Added burden on maintenance to address security control integrity during maintenance work on CDAs.

• Cyber security for plant CDAs is new, and the security controls being implemented on the plant CDAs are new to maintenance, system engineering, and operations.

Modifications must be implemented cautiously to ensure safe and reliable operation of plant equipment.

Before modifications are implemented, significant verification analysis and testing must be performed to minimize or eliminate impacts to plant equipment.

• Plant modifications that add cyber security controls create new change management challenges.

As cyber security controls are implemented, new tasks are added to normal maintenance activities.

The full impact of cyber security controls on the maintenance processes was difficult to predict when plant modifications were initially scoped and developed.

The NRC staff has had extensive interaction with the nuclear industry since licensees first developed their CSP implementation schedules.

Based on this interaction, the NRC staff recognizes that CDA assessment work is much more complex and resource intensive than originally anticipated and that the licensee has a large number of additional tasks not originally considered when developing its CSP implementation schedule.

The NRC staff concludes there are implementation issues with large numbers of CDAs and the need to address security controls for each. Based on the information provided by the licensee in its application, the NRC staff finds that the licensee will not be able to fully implement its CSP by February 1, 2016, and that the licensee's explanation of the need for additional time is acceptable.

3) A proposed completion date for Milestone 8 consistent with the remaining scope of work to be conducted and the resources available.

The licensee proposed a Milestone 8 completion date of December 31, 2017, to allow more time to methodically plan, prioritize work efforts, and schedule the implementation of the required design changes. The proposed date will provide more time to prioritize work efforts and schedule resources to help avoid rework and scope change. Based on the licensee's application, the NRC staff concludes that delaying final implementation of the CSP will provide an opportunity to complete the large volume of work in an orderly manner and avoid rework. 4) An evaluation of the impact that the additional time to implement the requirements will have on the effectiveness of the licensee's overall cyber security program in the context of milestones already completed.

The licensee indicated cyber security implementation activities that have already been completed ensure that the BVPS is, and will continue to be, secure. The licensee noted that the digital computer and communication systems and networks are adequately protected against cyber attacks during implementation of the remainder of the program by the proposed Milestone 8 date of December 31, 2017. The licensee provided that the completed activities provide a high degree of protection against cyber security attacks while BVPS implements the full program. The licensee then detailed the activities completed in each of the Milestones 1 through 7. The NRC staff concludes that the licensee's progress toward full implementation is reasonable and the impact of the requested additional implementation time on the effectiveness of the overall cyber security program is being effectively managed. 5) A description of the licensee's methodology for prioritizing completion of work for CDAs associated with significant safety consequences and with reactivity effects in the balance of plant (BOP). The licensee stated that its methodology for prioritizing Milestone 8 activities is centered on considerations for safety, security, emergency preparedness (EP), and BOP (continuity of power) consequences.

The methodology is based on defense-in-depth, installed configuration and complexity of the CDA and susceptibility to commonly identified threat vectors. Prioritization for CDA assessment begins with safety-related CDAs and continues through lower priority non-safety and EP CDAs:

• Safety-Related CDAs

• Important to Safety CDAs (including BOP CDAs that directly impact continuity of power) and Control System CDAs

• Physical Security CDAs

• Non-Safety Related CDAs and EP CDAs The NRC staff finds that based on the large number of digital assets described above, and the limited resources to perform these activities, the licensee's methodology for prioritizing work on CDAs is logical, conservative, and appropriate.

6) A discussion of the licensee's cyber security program performance up to the date of the LAR. The licensee stated interim Milestones 1 through 7 activities completed by December 31, 2012, provide a high degree of protection against cyber security-related attacks during implementation of the full program. The licensee provided discussions about implementing completed milestones.

It also stated that ongoing monitoring and time-based periodic actions provide continuing program performance monitoring. The NRC staff finds that the licensee's completion of Milestones 1 through 7 provides significant protection against cyber attacks. The NRC staff concludes that the licensee is using the tools at its disposal to implement, verify, and improve the effectiveness of the cyber security program. 7) A discussion of cyber security issues pending in the licensee's corrective action program (CAP). The licensee stated that the BVPS CAP is used to document all cyber issues in order to trend, correct, and improve the BVPS CSP. The CAP database documents and tracks, from initiation to closure, all cyber security required actions, including issues identified during ongoing program assessment activities.

Adverse trends are monitored for program improvement and addressed via the CAP process. The licensee listed cyber security program issues and activities pending in the CAP. The NRC staff finds that the examples reflect the evolution and implementation of the cyber security program and reinforce the licensee discussion above. The NRC concludes that the discussion reflects a functioning CAP. 8) A discussion of modifications completed to support the cyber security program and a discussion of pending cyber security modifications.

The licensee provided a brief discussion of a completed modification.

It is consistent with the discussions about the other criteria provided above, and the licensee's CSP. The NRC staff finds the discussion acceptable.

3.3 Revision

to License Condition By letter dated March 19, 2015, the licensee proposed to modify paragraph 2.0 of Renewed FOL No. OPR-66 and paragraph 2.E of Renewed FOL No. NPF-73, which provide license conditions to require the licensee to fully implement and maintain in effect all provisions of the NRG-approved CSP. The license condition in paragraph 2.0 of Renewed FOL No. OPR-66 for BVPS-1 is modified as follows: FE NOC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 1 O CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FE NOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by license Amendment No. 287, and amended by License Amendment No. 295. The license condition in paragraph 2.E of Renewed FOL No. NPF-73 for BVPS-2 is modified as follows: FENOC shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provisions of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, which contains Safeguards Information protected under 10 CFR 73.21 is entitled: "Beaver Valley Power Station (BVPS) Physical Security Plan" submitted by letter September 9, 2004, and supplemented September 30, 2004, October 14, 2004, and May 12, 2006. FENOC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The Beaver Valley Power Station CSP was approved by License Amendment No. 17 4, and amended by License Amendment No. 183.

3.4 NRC Staff Conclusion

Based on its review of the licensee's submittal, the NRC staff concludes that (1) implementation of Milestones 1 through 7 provides significant protection against cyber attacks; (2) the licensee's explanation of the need for additional time is compelling; and (3) it is acceptable for BVPS to complete Milestone 8 (full implementation of the CSP) by December 31, 2017. The NRC staff has reasonable assurance that full implementation of the CSP by December 31, 2017, will provide adequate protection of the public health and safety and the common defense and security.

The NRC staff also concludes that upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff finds the proposed change to the CSP full implementation schedule acceptable.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the Pennsylvania State official was notified of the proposed issuance of the amendment.

The State official had no comments.

5.0 ENVIRONMENTAL

CONSIDERATION This is an amendment of a 10 CFR Part 50 license that relates solely to safeguards matters and does not involve any significant construction impacts. This amendment is an administrative change to extend the date by which the licensee must have its CSP fully implemented.

Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(12).

Pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. Principal Contributors:

John Rycyna, NSIR Taylor Lamb, NRR Date: December 1, 2015 December 1, 2015 Mr. Eric A. Larson, Site Vice President FirstEnergy Nuclear Operating Company Beaver Valley Power Station Mail Stop A-BV-SEB1 P.O. Box 4, Route 168 Shippingport, PA 15077

SUBJECT:

BEAVER VALLEY POWER STATION, UNIT NOS. 1AND2-ISSUANCE OF AMENDMENTS RE: REQUEST TO CHANGE CYBER SECURITY IMPLEMENTATION PLAN MILESTONE 8 COMPLETION DATE (CAC NOS. MF5879 AND MF5880)

Dear Mr. Larson:

The U.S. Nuclear Regulatory Commission (the Commission) has issued the enclosed Amendment No. 295 to Renewed Facility Operating License No. DPR-66 for the Beaver Valley Power Station, Unit No. 1 (BVPS-1 ), and Amendment No. 183 to Renewed Facility Operating License No. NPF-73 for the Beaver Valley Power Station, Unit No. 2 (BVPS-2).

These amendments consist of changes to the Facility Operating Licenses in response to your application dated March 19, 2015, as supplemented by letter dated May 6, 2015. The amendments change the BVPS-1 and BVPS-2 Facility Operating Licenses.

Specifically, the license amendments revise the Cyber Security Plan Milestone 8 full implementation date as set forth in the cyber security plan implementation schedule, by extending the full implementation date to December 31, 2017. A copy of the related safety evaluation is enclosed.

The Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Docket Nos. 50-334 and 50-412

Enclosures:

1. Amendment No. 295 to DPR-66 2. Amendment No. 183 to NPF-73 3. Safety Evaluation cc w/enclosures:

Distribution via Listserv DISTRIBUTION:

PUBLIC LPLl-2 R/F RidsACRS_MailCTR Resource RidsNrrDorlDpr Resource RidsNsirCsd Resource RidsNrrLALRonewicz Resource ADAMS Accession No.: ML 15302A433 OFFICE NRR/LPLl-2/PM NRR/LPLl-2/LA NAME TLamb LRonewicz DATE 11/3/15 12/1/15 Sincerely, IRA/ Taylor A. Lamb, Project Manager Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation RidsNrrDssStsb Resource RecordsAmend RidsRgn1 MailCenter Resource RidsNrrDorllpl1-2 Resource RidsNrrPMBeaverValley Resource *via e-mail NSIR/CSD*

OGC NRR/LPLl-2/BC NRR/LPLl-2/PM JAndersen CSafford DBroaddus Tlamb (REnnis for) 11/30/15 11/20/15 11/24/15 12/1/15 OFFICIAL RECORD COPY