Document: 10 CFR Part 73
Document ID: 2c582f64-f8cb-4316-a92f-b6eec6cc0d2a
Document Type: cfr
Title: Protection of digital computer and communication systems and networks.
Source: 10 CFR Part 73
Source URL: https://www.ecfr.gov/current/title-10/part-73/section-73.54
Revision Date: 
Chapter: 
Section ID: 73.54
CFR Part: 73
CFR Title: 10

Content:
§ 73.54 Protection of digital computer and communication systems and networks. By November 23, 2009 each licensee currently licensed to operate a nuclear power plant under part 50 of this chapter shall submit, as specified in § 50.4 and § 50.90 of this chapter , a cyber security plan that satisfies the requirements of this section for Commission review and approval. Each submittal must include a proposed implementation schedule. Implementation of the licensee's cyber security program must be consistent with the approved schedule. Current applicants for an operating license or combined license who have submitted their applications to the Commission prior to the effective date of this rule must amend their applications to include a cyber security plan consistent with this section. ( a ) Each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in § 73.1 . ( 1 ) The licensee shall protect digital computer and communication systems and networks associated with: ( i ) Safety-related and important-to-safety functions; ( ii ) Security functions; ( iii ) Emergency preparedness functions, including offsite communications; and ( iv ) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions. ( 2 ) The licensee shall protect the systems and networks identified in paragraph (a)(1) of this section from cyber attacks that would: ( i ) Adversely impact the integrity or confidentiality of data and/or software; ( ii ) Deny access to systems, services, and/or data; and ( iii ) Adversely impact the operation of systems, networks, and associated equipment. ( b ) To accomplish this, the licensee shall: ( 1 ) Analyze digital computer and communication systems and networks and identify those assets that must be protected