Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
d procedure to facilitate the implementation of the cyber security program and the security assessment 13.6.6-10 Revision 0 – November 2010 A.3.1.2 Cyber Security Team In order to comply with 10 CFR 73.54(c)(2), licensees should establish and maintain defense in depth protective strategies. It is advised that the CST should have the authority to conduct an objective assessment, make determinations, implement the defense-in-depth protective strategies, and implement the security controls using the process in Section C.3.3 of RG 5.71. It is recommended that the CST must have broad knowledge in the following areas: • information and digital system technology: – cyber security – software development – communications – systems administration – computer engineering – networking — site and corporate networks – programmable logic controllers – control systems – distributed control systems – computer systems and databases used in design, operation, and maintenance of CDAs • nuclear facility operations, engineering and technical specifications • physical security and emergency preparedness systems and programs 13.6.6-11 Revision 0 – November 2010 In order to comply with 10 CFR 73.54(d)(1), the CST should have particular roles and responsibilities. The submitted CSP lists the roles and responsibilities for the CST, which include the following: • Perform or oversee each stage of cyber security management processes. • Document all key observations, analyses, and findings during the assessment process so that information can be used in the application of security controls. • Evaluate or reevaluate assumptions or conclusions about current cyber security threats. • Evaluate or reevaluate assumptions or conclusions about potential vulnerabilities to, and consequences from, an attack. • Evaluate or reevaluate assumptions or conclusions about the effectiveness of existing cyber security controls, defensive strategies, and attack mitigation