ML12237A094

Issuance of Amendment Cyber Security Program

ML12237A094
Person / Time
Site:	Seabrook
Issue date:	11/02/2012
From:	Lamb J G Plant Licensing Branch 1
To:	Walsh K, O'Keefe M NextEra Energy Seabrook
Lamb J G
References
TAC ME8959
Download: ML12237A094 (12)

Text

UNITED NUCLEAR REGULATORY WASHINGTON.

D.C.

November 2,2012 Mr. Kevin Walsh, Vice President Seabrook Nuclear Plant clo Michael O'Keefe NextEra Energy Seabrook, LLC P.O. Box 300 Seabrook, NH 03874 SEABROOK STATION, UNIT NO.1-ISSUANCE OF AMENDMENT RE: CYBER SECURITY PROGRAM (TAC NO. ME8959)

Dear Mr. Walsh:

The Commission has issued the enclosed Amendment No. 132 to Facility Operating License No. NPF-86 for the Seabrook Station, Unit NO.1 (Seabrook).

This amendment consists of changes to the facility operating license in response to your application dated June 20, 2012. The amendment revises the scope of the Cyber Security Plan Implementation Schedule Milestone

1. 6 and the existing license condition in the facility operating license. A copy of our safety evaluation is also enclosed.

Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Sincerely, , , .' ) < /" John G. Lamb, Senior Project Manager Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-443

Enclosures:

1. Amendment No. 132 to NPF-86 2. Safety Evaluation cc w/encls: Distribution via Listserv UNITED NUCLEAR REGULATORY WASHINGTON, D.C. 20555-0001 NEXTERA ENERGY SEABROOK, LLC, ET AL.* DOCKET NO. 50-443 SEABROOK STATION, UNIT NO.1 AMENDMENT TO FACILITY OPERATING LICENSE Amendment No. 132 License No. NPF-86 The Nuclear Regulatory Commission (the Commission) has found that: The application for amendment filed by NextEra Energy Seabrook, LLC, et at., (the licensee) dated June 20,2012, complies with the standards and requirements of the Atomic Energy Act of 1954, as amended (the Act), and the Commission's rules and regulations set forth in 10 CFR Chapter I; The facility will operate in conformity with the application, the provisions of the Act, and the rules and regulations of the Commission; There is reasonable assurance: (i) that the activities authorized by this amendment can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the Commission's regulations; The issuance of this amendment will not be inimical to the common defense and security or to the health and safety of the public; and The issuance of this amendment is in accordance with 10 CFR Part 51 of the Commission's regulations and all applicable requirements have been satisfied

• NextEra Energy Seabrook, LLC is authorized to act as agent for the: Hudson Light & Power Department, Massachusetts Municipal Wholesale Electric Company, and Taunton Municipal Ught Plant and has exclusive responsibility and control over the physical construction, operation and maintenance of the facility.

-2 Accordingly, the license is amended by changes to paragraphs 2.C.(2} and 2.E of Facility Operating License No. NPF-86 is and hereby amended to read as follows: Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 132, and the Environmental Protection Plan contained in Appendix B are incorporated into the Facility License No. NPF-86. NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission'-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans, submitted by letter dated September 23, 2004, and supplemented by letters dated October 15, October 22, and October 29,2004, and May 18, 2006, is entitled: "Florida Power and Light & FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan." The set contains Safeguards Information protected under 10 CFR 73.21. NextEra Energy Seabrook, LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}.

The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by a clarification approved by License Amendment NO.132). This license amendment is effective as of the date of its issuance and shall be implemented by December 31,2012.

COMMISSION Meena Khanna, Chief Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation

Attachment:

Changes to the License Date of Issuance:

November 2. 2012 ATTACHMENT TO LICENSE AMENDMENT NO. FACILITY OPERATING LICENSE NO. DOCKET NO. Replace the following pages of Facility Operating license No. NPF-86 with the attached pages. The revised pages are identified by amendment number and contain marginal lines indicating the area of change. Remove Insert 3 3 6 6

-NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use at any time any byproduct, source, and special nuclear material as sealed neutron sources for reactor startup, sealed sources for reactor instrumentation and radiation monitoring equipment calibration, and as fission detectors in amounts as required; NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to receive, possess, and use in amounts as required any byproduct, source, or special nuclear material without restriction to chemical or physical form, for sample analysis or instrument calibration or associated with radioactive apparatus or components; NextEra Energy Seabrook, LLC, pursuant to the Act and 10 CFR 30, 40, and 70, to possess, but not separate, such byproduct and special nuclear materials as may be produced by the operation of the facility authorized herein; and DELETED This license shall be deemed to contain and is subject to the conditions specified in the Commission's regulations set forth in 10 CFR Chapter I and is subject to all applicable provisions of the Act and to the rules, regulations, and orders of the Commission now or hereafter in effect; is subject to the additional conditions specified or incorporated below: Maximum Power Level NextEra Energy Seabrook, LLC, is authorized to operate the facility at reactor core power levels not in excess of 3648 megawatts thermal (100% of rated power). Technical Specifications The Technical Specifications contained in Appendix A, as revised through Amendment No. 132 *, and the Environmental Protection Plan contained in Appendix B are incorporated into the Facility License No. NPF-86. NextEra Energy Seabrook, LLC shall operate the facility in accordance with the Technical Specifications and the Environmental Protection Plan. License Transfer to FPL Energy Seabrook.

LLC** On the closing date(s) of the transfer of any ownership interests in Seabrook Station covered by the Order approving the transfer, FPL Energy Seabrook, LLC**, shall obtain from each respective transferring owner all of the accumulated decommissioning trust funds for the facility, and ensure the deposit of such funds and additional funds, if necessary, into a decommissioning trust or trusts for Seabrook Station established by FPL Energy Seabrook, LLC**, such that the amount of such funds deposited meets or exceeds the amount required under 10 CFR 50.75 with respect to the interest in Seabrook Station FPL Energy Seabrook, LLC**, acquires on such dates(s).

• Implemented

• • On April 16,2009, the name "FPL Energy Seabrook, LLC" was changed to "NextEra Energy Seabrook.

LLC". AMENDMENT NO. 132

-E. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to tpe authority of 10 CFR 50.90 and 10 CFR 50.54{p}.

The combined set of plans, submitted by letter dated September 23, 2004, and supplemented by letters dated October 15, October 22, and October 29, 2004, and May 18, 2006, is entitled: "Florida Power and Light & FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan." The set contains Safeguards Information protected under 10 CFR 73.21. NextEra Energy Seabrook.

LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP). including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p}.

The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by a clarification approved by License Amendment No. 132). F. Fire Protection NextEra Energy Seabrook, LLC, shall implement and maintain in effect all provisions of the approved fire protection program as described in the Final Safety Analysis Report, the Fire Protection Program Report, and the Fire Protection of Safe Shutdown Capability report for the facility, as supplemented and amended, and as approved in the Safety Evaluation Report, dated March 1983; Supplement 4, dated May 1986; Supplement 5, dated July 1986; Supplement 6, dated October 1986; Supplement 7, dated October 1987; and Supplement 8, dated May 1989 subject to the following provisions:

NextEra Energy Seabrook, LLC, may make changes to the approved fire protection program without prior approval of the Commission, only if those changes would not adversely affect the ability to achieve and maintain shutdown in the event of a fire. G. DELETED H. Financial Protection The licensees shall have and maintain financial protection of such type and in such amounts as the Commission shall require in accordance with Section 170 of the Atomic Energy Act of 1954, as amended, to cover public liability claims. I. DELETED 1The Training and Qualification Plan and Safeguards Contingency Plan are Appendices to the Security Plan. Amendment No. 00, 113 122, UNITED NUCLEAR REGULATORY WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR SECURITY AND INCIDENT RESPONSE RELATED TO AMENDMENT NO. 132 TO FACILITY OPERATING LICENSE NO. NPF-86 NEXTERA ENERGY SEABROOK, LLC, ET AL.* SEABROOK STATION, UNIT NO.1 DOCKET NO. 50-443

1.0 INTRODUCTION

By application dated June 20, 2012, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML 12178A070), NextEra Energy Seabrook, LLC (NextEra, the licensee) requested changes to the facility operating license for Seabrook Station, Unit 1 (Seabrook).

The proposed changes would revise the scope of Cyber Security Plan (CSP) Implementation Schedule Milestone 6 and the existing license condition in the facility operating license. Milestone 6 of the CSP implementation schedule concerns the identification, documentation, and implementation of cyber security controls (technical, operational, and management) for critical digital assets (CDAs) related to target set equipment.

NextEra is requesting to modify the scope of Milestone 6 to apply to the technical cyber security controls only. The operational and management controls, as described in Nuclear Energy Institute (NEI) 08-09, Revision 6, "Cyber Security Plan for Nuclear Power Reactors," would be implemented concurrent with the full implementation of the cyber security program (Milestone 8). Thus, all CSP activities would be fully implemented by the completion date, identified in Milestone 8 of the licensee's CSP implementation schedule.

Portions of the letter dated June 20,2012, contain sensitive unclassified non-safeguards information and, accordingly, those portions are withheld from public disclosure.

2.0 REGULATORY EVALUATION

The U.S. Nuclear Regulatory Commission (NRC) staff reviewed and approved the licensee's existing CSP implementation schedule by License Amendment No. 127, dated August 23, 2011 (ADAMS Accession No. !\IlL 112070048), concurrent with the incorporation of the CSP into the facility current licensing basis. The NRC staff considered the following regulatory requirements and guidance, in its review of the current license amendment request, to modify the existing CSP implementation schedule:

Enclosure

-2 Title 10 of the Code of Federal Regulations (10 CFR) 73.54 states: "Each [CSP] submittal must include a proposed implementation schedule.

Implementation of the licensee's cyber security program must be consistent with the approved schedule." The licensee's facility operating license includes a license condition that requires the licensee to fully implement and maintain in effect all provisions of the approved CSP. Amendment No. 127, dated August 23,2011, which approved the licensee's CSP and implementation schedule, included the following statement: "The implementation of the CSP, including the key intermediate milestone dates and the full implementation date, shall be in accordance with the implementation schedule submitted by the licensee by letter March 31, 2011, and approved by the NRC staff with this license amendment.

All subsequent changes to the NRC-approved CSP implementation schedule will require prior NRC approval pursuant to 10 CFR 50.90." In a letter to NEI dated March 1, 2011 (ADAMS Accession No. ML 11 0070348), the NRC staff acknowledged that the cyber security implementation schedule template was "written generically, and licensees that use the template to develop their proposed implementation schedules may need to make changes to ensure the submitted schedule accurately accounts for site-specific activities." 3.0 TECHNICAL EVALUATION Amendment No. 127 to Facility Operating License No. NPF-86 for the Seabrook Station was issued on August 23, 2011. The NRC staff also approved the licensee's CSP implementation schedule, as discussed in the safety evaluation issued with the amendment.

The implementation schedule had been submitted by the licensee based on a template prepared by NEI, which the NRC staff found acceptable for licensees to use to develop their CSP implementation schedules (ADAMS Accession No. ML 110600218).

The licensee's proposed implementation schedule for the cyber security program identified completion dates and bases for the following eight milestones: Establish the Cyber Security Assessment Team; Identify Critical Systems and CDAs; Install a deterministic one-way device between lower level devices and higher level devices; Implement the security control "Access Control For Portable And Mobile Devices," Implement observation and identification of obvious cyber related tampering to existing insider mitigation rounds by incorporating the appropriate elements; Identify, document, and implement cyber security controls as per "Mitigation of Vulnerabilities and Application of Cyber Security Controls" for CDAs that could adversely impact the design function of physical security target set equipment;

7) Commence ongoing monitoring and assessment activities for those target set CDAs whose security controls have been implemented; and Fully implement the CSP.

-3 3.1 Licensee's Proposed Change Currently, Milestone 6 of Seabrook's CSP requires NextEra to identify, document, and implement cyber security controls for CDAs that could adversely impact the design function of physical security target set equipment by December 31, 2012. These cyber security controls consist of technical, operational and management security controls.

In its June 20, 2012, application, NextEra proposed to modify Milestone 6 to change the scope of the cyber security controls due to be implemented on December 31,2012, to include only the NEI 08-09, Revision 6, Appendix D, "Technical Security Controls." NextEra proposes to amend its CSP to provide that operational and management security controls, identified in Milestone 6, will be fully implemented by a later date, which is the completion date identified in Milestone 8 of the CSP implementation schedule.

The licensee stated that implementing the technical cyber security controls for target-set CDAs provides a high degree of protection against cyber-related attacks that could lead to radiological sabotage.

The licensee further stated that many of its existing programs are primarily procedure-based programs and must be implemented in coordination with the comprehensive cyber security program. The licensee also stated that the existing programs currently in place at Seabrook (e.g., physical protection, maintenance, configuration management, and operating experience) provide sufficient operational and management cyber security protection during the interim period, until the cyber security program is fully implemented.

3.2 NRC Staff Evaluation The underlying purpose of the Cyber Security Implementation Schedule was for licensees to demonstrate ongoing implementation of their CSP prior to full implementation, which is set for the date specified in Milestone

8. In addition to Milestone 6 and its associated activities, licensees will be completing six other milestones (Milestones 1 through 5 and Milestone

7) by December 31,2012. Activities include establishing a Cyber Security Assessment Team, identifying critical systems and CDAs, installing deterministic one-way devices between defensive levels, implementing access control for portable and mobile devices, implementing methods to observe and identify obvious cyber-related tampering, and conducting ongoing monitoring and assessment activities for target set CDAs. In the aggregate, the interim milestones demonstrate ongoing implementation of the cyber security program at Seabrook.

The NRC staff has reviewed NextEra's evaluation of the proposed change in its submittal dated June 20, 2012, and, as set forth below, finds that by completing Milestones 1 through 5, Milestone 6 with implementation of technical controls to target-set CDAs, and Milestone 7, Seabrook will have an acceptable level of cyber security protection until full program implementation is achieved.

Technical cyber security controls include access controls, audit and accountability, CDA and communications protection, identification and authentication, and system hardening.

These controls are executed by computer systems, as opposed to people, and consist of hardware and software controls that provide automated protection to a system or application.

Implementation of technical cyber security controls promotes standardization, trust, interoperability, connectivity, automation, and increased efficiency.

For these reasons, the NRC staff concludes that the licensee's approach is acceptable.

The NRC staff also recognizes that full implementation of operational and management cyber security controls, in accordance with requirements of the Seabrook CSP, will be achieved with full implementation of the Seabrook CSP by the date set in Milestone

8. That is, all required elements for the operational and management cyber security controls, in accordance with the Seabrook CSP, will be implemented in their entirety at the time of full implementation of the CSP. The NRC staff does not regard the CSP milestone implementation dates as regulatory commitments that can be changed unilaterally by the licensee, particularly in light of the regulatory requirement at 10 CFR 73.54, that H[iJmplementation of the licensee's cyber security program must be consistent with the approved schedule." As the NRC staff explained in its letter to all operating reactor licensees dated May 9, 2011 (ADAMS Accession No. ML 110980538), the implementation of the plan, including the key intermediate milestone dates and the full implementation date shall be in accordance with the implementation schedule submitted by the licensee and approved by the NRC. All subsequent changes to the approved CSP implementation schedule, thus, will require prior NRC approval, pursuant to 10 CFR 50.90. 3.3 Revision to License Condition By letter dated June 20, 2012, the licensee proposed to modify Paragraph 2.E, "Physical Security," of Facility Operating License No. NPF-86, which provides a license condition to require the licensee to fully implement and maintain in effect all provisions of the approved CSP. The license condition in Paragraph 2.E of Facility Operating License No. NPF-86 for Seabrook is modified as follows: E. Physical Security The licensee shall fully implement and maintain in effect all provisions of the Commission-approved physical security, training and qualification, and safeguards contingency plans including amendments made pursuant to provision of the Miscellaneous Amendments and Search Requirements revisions to 10 CFR 73.55 (51 FR 27817 and 27822) and to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The combined set of plans 1, submitted by letter dated September 23, 2004, and supplemented by letters dated October 15, October 22, and October 29,2004, and May 18, 2006, is entitled: "Florida Power and Light & FPL Energy Seabrook Physical Security Plan, Training and Qualification Plan and Safeguards Contingency Plan." The set contains Safeguards Information protected under 10 CFR 73.21. NextEra Energy Seabrook, LLC shall fully implement and maintain in effect all provisions of the Commission-approved cyber security plan (CSP), including changes made pursuant to the authority of 10 CFR 50.90 and 10 CFR 50.54(p).

The NextEra Energy Seabrook, LLC CSP was approved by License Amendment No. 127 (as supplemented by a clarification approved by License Amendment No. 132).

-3.4 Summary Based on its review of the NextEra's license amendment request, as set forth above, the NRC staff concludes that the proposed changes to Milestone

1. 6 of the licensee's CSP implementation schedule are acceptable.

The NRC staff also concludes that, upon full implementation of the licensee's cyber security program, the requirements of the licensee's CSP and 10 CFR 73.54 will be met. Therefore, the NRC staff finds the proposed changes acceptable.

4.0 STATE CONSULTATION

In accordance with the Commission's regulations, the New Hampshire and Massachusetts State officials were notified of the proposed issuance of the amendment.

The State officials provided no comments.

5.0 ENVIRONMENTAL

CONSIDERATION This amendment relates solely to safeguards matters and does not involve any significant construction impacts. Accordingly, this amendment meets the eligibility criteria for categorical exclusion set for in 10 CFR 51.22(c)(12).

Pursuant to 10 CFR 51.22(b), no environmental assessment need to be prepared in connection with the issuance of this amendment.

6.0 CONCLUSION

The Commission has concluded, based on the considerations discussed above, that: (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner; (2) there is reasonable assurance that such activities will be conducted in compliance with the Commission's regulations; and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public. Principal Contributor:

Monika Coflin Date: November 2,2012 November 2,2012 Mr. Kevin Walsh Site Vice President c/o Michael O'Keefe Seabrook Station NextEra Energy Seabrook, LLC P.O. Box 300 Seabrook, NH 03874 SEABROOK STATION, UNIT NO.1-ISSUANCE OF AMENDMENT RE: CYBER SECURITY PROGRAM (TAC NO. ME8959)

Dear Mr. Walsh:

The Commission has issued the enclosed Amendment No. 132 to Facility Operating License No. NPF-86 for the Seabrook Station, Unit No.1 (Seabrook).

This amendment consists of changes to the facility operating license in response to your application dated June 20, 2012. The amendment revises the scope of the Cyber Security Plan Implementation Schedule Milestone

1. 6 and the existing license condition in the facility operating licenses.

A copy of our safety evaluation is also enclosed.

Notice of Issuance will be included in the Commission's biweekly Federal Register notice. Sincerely, Ira! John G. Lamb, Senior Project Manager Plant Licensing Branch 1-2 Division of Operating Reactor Licensing Office of Nuclear Reactor Regulation Docket No. 50-443

Enclosures:

1. Amendment No. 132 to NPF-86 2. Safety Evaluation cc w/encls: Distribution via Listserv DISTRIBUTION:

PUBLIC LPLI-2 R/F RidsAcrsAcnw_MailCTR Resource RidsNrrDorlDpr Resource RidsNrrDorlLpl1-2 Resource RidsRgn1 MailCenter Resource RidsNsirDsp Resource RidsNrrPMSeabrook Resource RidsNrrLAABaxter Resource RidsOgcRp Resource REnnis, NRR/DORL ADAMS Accession No" ML 12237 A094 "" *via memorandum OFFICE NAME LPL 1-2/PM' I JLamb ? p:J LPL 1-2/LA ABaxter NSIR/BC CErlanger*

OGC-NLO RWeisman LPL 1-2/BC MKhanna i DATE 09/26/2d12 09/25/2012 08/21/2012

..OffiCial Record Copy 10/18/2012 11/212012