Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
s to facilitate the implementation of the contingency planning policy and associated contingency planning controls 13.6.6-41 Revision 0 – November 2010 C.9.3 Contingency Plan Testing The licensee is responsible for conducting tests or exercises or both and documenting the contingency plan at least annually to verify its effectiveness and the organization’s readiness to execute this plan. C.9.4 Contingency Plan Training The licensee is responsible for training personnel in their contingency roles and responsibilities with respect to the CDAs and providing refresher training at least annually or consistent with the licensee’s overall contingency program, whichever period is shorter. C.9.6 Critical Digital Asset Backups The licensee is responsible for the following: • testing and documenting backup information monthly to verify media reliability and information integrity • establishing and documenting the timeframe in which data or the CDA must be restored and the frequency at which critical data and configurations are changing C.11.2 Configuration Management Policy and Procedures The licensee develops, disseminates, and annually reviews and updates formal, documented configuration management policy and implementing procedures that address the purpose, scope, roles, responsibilities, management commitment, coordination among licensee entities, associated configuration management controls, and compliance. C.11.3 Baseline Configuration The licensee documents the up-to-date baseline configurations and audits the configurations quarterly. Baseline configurations include but are not limited to a current list of all components (e.g., hardware, software), configuration of peripherals, version releases of current software, and switch settings of machine components. The licensee defines the minimum physical and logical access for the modifications. Additionally, the licensee employs electronic means to monitor CDA access to ensure that only authorized systems and