Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
t, or facilities that could adversely affect security • as necessary based upon site-specific analyses, assessments, or other performance indicators • by individuals independent of those personnel responsible for program implementation and management The licensee documents the results and recommendations of program reviews, management findings, and any actions taken as a result of recommendations from prior program review. The licensee generates a report to the site’s plant manager and to the site’s corporate management at least one level higher than the individual having responsibility for day-to-day plant operation. The licensee maintains these reports in an auditable form, available for inspection, and enters findings from program reviews into the site’s Corrective Action Program. 13.6.6-35 Revision 0 – November 2010 A.5 Document Control and Records Retention and Handling As required by 10 CFR 73.54(h), the licensee must establish and implement a cyber security document control and records policy and related procedures. The CSP states the following: • The licensee establishes the necessary measures and procedures to ensure that records of items and activities are developed, reviewed, approved, issued, used, and revised to reflect completed work affecting cyber security. • The licensee retains records and supporting documentation required to satisfy the requirements of 10 CFR 73.54 and 10 CFR 73.55 until the NRC terminates the facility operating license. Records required for retention include, but are not limited to, all digital records, log files, audit files, and non-digital records that capture, record, and analyze network and CDA events. The licensee retains these records to document access history and discover the source of cyber attacks or other security-related incidents affecting CDAs or SSEP functions or both. • The licensee retains superseded portions of these records for at least 3 years after the record is superseded, unless otherwise