Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ng on a production CDA because of the potential for an adverse impact on SSEP functions, alternate controls (e.g., providing a replicated system or CDA to conduct scanning) will be employed. 13.6.6-28 Revision 0 – November 2010 A.4.2 Change Control As required by 10 CFR 73.54(d)(3), the licensee must ensure that modifications are evaluated to ensure that cyber security objectives are met. The CSP states the following: • It is advised that the licensee/applicant will systematically plan, approve, test, and document changes to the environment of a CDA. • Changes to existing CDAs or addition of a new CDA must be made in a manner that ensures that the SSEP functions are protected from a cyber attack. • During the operation and maintenance life-cycle phases, the program establishes that changes made to CDAs, design control and configuration management procedures or other procedural processes ensure that the existing security controls are effective and that any pathway that can be exploited to compromise a CDA is protected from cyber attacks. • During the retirement phase, the design control and configuration management procedures or other procedural processes address safety, reliability, and security engineering activities. 13.6.6-29 Revision 0 – November 2010 A.4.2.1 Configuration Management In order to comply with 10 CFR 73.54(d)(3), 10 CFR 73.54(f), and 10 CFR 73.54(g), licensees should ensure that modifications to critical digital assets, are evaluated before implementation to ensure that the cyber security performance are maintained. The CSP states the following: • It is advised that the licensee will implement and document the configuration management controls described in Section C.11 of RG 5.71. • The licensee will implement a configuration and change management system as described in Section C.11 of RG 5.71. • Before modifications are implemented, the licensee must evaluate them using the criteria in Section 4.2 of the CSP to ensure that the