Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
y media which can provide information to assist an adversary is marked at a minimum to identify the sensitive nature of the media • a formal, documented procedure to facilitate the implementation of the media protection policy and all associated media protection controls, including the methodology that defines the purpose, scope, roles, responsibilities, and management commitments in the areas of media receipt, storage, handling, sanitization, removal, reuse, and disposal necessary to provide high assurance that the risk of unauthorized disclosure of information that could be used in a cyber attack to adversely impact the SSEP functions of the nuclear facility is prevented C.1.6 Media Sanitation and Disposal The licensee tracks, documents, and verifies media sanitization and disposal actions and performs quarterly tests on sanitized data to ensure that equipment and procedures are functioning properly. C.3.1 System and Information Integrity Policy and Procedures The licensee develops, disseminates, and annually reviews and updates the following: • a formal documented system and information integrity policy that addresses the purpose, scope, roles, responsibilities, management commitment, coordination among licensee entities, and compliance • formal documented procedures to facilitate the implementation of CDAs and an information integrity policy and associated system and information integrity controls C.3.4 Monitoring Tools and Techniques The licensee tests cyber intrusion detection and prevention systems, consistent with the timeframe defined in NEI 03-12, Section 20.1, for intrusion detection systems, and before being placed back in service after each repair or inoperative state. 13.6.6-40 Revision 0 – November 2010 C.3.5 Security Alters and Advisories The licensee is responsible for the following: • receiving timely security alerts, bulletins, advisories, and directives from credible external organizations, as designated by the NRC and the licensee on