Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
uired by 10 CFR 73.54(c)(2), licensees must apply and maintain defense- in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. The submitted CSP provides for the implementation of defensive strategies that ensure the capability to detect, respond to, and recover from a cyber attack. The defensive strategies consist of the following: • security controls implemented in accordance with Section 3.1.6 of the CSP and the defense model outlined in Regulatory Position C.3.2 of RG 5.71 • defense-in-depth measures described in Section 6 of Appendix C to RG 5.71 • detailed defensive architecture described in Section 7 of Appendix C to RG 5.71 • maintenance of a cyber security program in accordance with Section 4 of Appendix A to RG 5.71 The defense model establishes the logical and physical boundaries between CDAs with similar risks and CDAs with lower security risks. 13.6.6-18 Revision 0 – November 2010 A.3.1.6 Application of Security Controls As required by 10 CFR 73.54(c)(1) and 10 CFR 73.54(c)(2), the licensee must design its cyber security program with defense-in-depth, including implementation of security controls to protect CDAs from cyber attacks. The licensee establishes defense- in-depth strategies by implementing and documenting the following: • defensive model (Section C.3.2 of RG 5.71) • physical security program and physical barriers • operational and management controls described in Appendix C to RG 5.71 • technical controls described in Appendix B to RG 5.71 13.6.6-19 Revision 0 – November 2010 Technical Security Controls The submitted CSP discusses using the information collected from Section 3.1.4 of the CSP to conduct one or more of the following: 1. Implement all security controls specified in Appendix B to RG 5.71. 2. If a security control cannot be applied, implement an alternative control listed in Appendix B to RG 5.71 by doing one of the following: A. Document the basis for the