Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
counts no less frequently than once every 30 days – document and immediately notify system administrators of all account creation, deletion, and modification activities to ensure that administrators are aware of any account modifications and can investigate potential cyber attacks 13.6.6-37 Revision 0 – November 2010 B.1.7 Unsuccessful Login Attempts • Implement security controls to limit the number of invalid access attempts by a user. Document this requirement in the access control policy. The number of failed login attempts in a specified time period may vary by CDA/CS. For example, the licensee may implement a security control that will automatically lock out the account after more than three invalid login attempts are made within a 1-hour time period. The licensee’s system enforces the lock out mode automatically. • The access control policy includes a requirement that only authorized individuals, who are not the user, can unlock accounts once the maximum number of unsuccessful login attempts has been exceeded. Alternatively, other verification techniques or mechanisms that incorporate identity challenges may be used. B.1.10 Session Lock Configure CDAs/CS to do the following: • Initiate a session lock after 30 minutes of inactivity. • Implement alternative controls and document the justification for alternative controls or countermeasures for those instances in which a CDA/CS cannot support session locks. • Monitor and record physical access to the CDA/CS to detect and respond to intrusions immediately. B.1.17 Wireless Access Restrictions Conduct scans no less frequently than once every week for unauthorized wireless access points, in accordance with this document, and disable access points if unauthorized access points are discovered. B.1.18 Insecure and Rogue Connections Verify that, during deployment of CDAs/CS, when changes or modifications have been made to CDAs/CS, and no less frequently than once every month, CDAs/CS are free of insecure