Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
REVIEW RESPONSIBILITIES Primary - Office of Nuclear Security and Incident Response Secondary - None I. AREAS OF REVIEW The U.S. Nuclear Regulatory Commission (NRC) evaluates the applicant/licensee’s plan to provide high assurance that the digital computer and communication systems and networks associated with safety, security, and emergency preparedness (SSEP) functions, as well as support systems and equipment, which if compromised, would adversely impact safety, security, or emergency preparedness functions, are adequately protected against cyber attacks. This requirement to provide a cyber security plan (CSP) to the NRC for review is codified in Title 10 of the Code of Federal Regulations (CFR), Section 73.54, “Protection of Digital Computer and Communication Systems and Networks.” Applicant/licensees must identify those assets that must be protected against cyber attacks; establish, implement, and maintain a cyber security program for the protection of the assets; and ensure that the cyber security program is incorporated into the physical protection program. The cyber security program must implement security controls to protect Critical Digital Assets (CDA) from cyber attacks, apply and maintain defense-in-depth protective strategies, mitigate the effects of cyber attacks, and ensure that the 13.6.6-2 Revision 0 – November 2010 functions of the CDAs are not adversely impacted by the cyber attacks. The cyber security program must include adequate training, evaluate and manage cyber risk, and ensure that the cyber security performance objectives for CDAs are maintained during modifications. The applicant/licensee must establish, implement, and maintain a CSP that implements the cyber security program requirements of 10 CFR 73.54. The applicant/licensee must develop and maintain written policies and procedures to implement the CSP. The applicant/licensee must review the cyber security program as a component of the physical security program in accordance