Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ed milestone is included. Review Interfaces Other required Standard Review Plan (SRP) sections interface with this section as follows: 1. SRP Section 13.6, “Physical Security” 2. SRP Section 13.4, “Operational Programs” (For COL reviews of operational programs, the review of the applicant/licensee’s implementation plan is performed under this section.) II. ACCEPTANCE CRITERIA Acceptance criteria are based on meeting the relevant requirements of the following Commission regulations: 1. 10 CFR 73.54 2. 10 CFR 73.55(a)(1), 10 CFR 73.55(b)(8), and 10 CFR 73.55(m) 3. Appendix G, “Reportable Safeguards Events,” to 10 CFR Part 73, “Physical Protection of Plants and Materials” 13.6.6-4 Revision 0 – November 2010 4. 10 CFR 73.58, “Safety/Security Interface Requirements for Nuclear Power Reactors” Specific criteria acceptable to meet1 the relevant requirements of the Commission’s regulations identified above are as follows for each review described in Section I of this SRP section: The security plan is considered acceptable if it agrees with the plan template in Regulatory Guide (RG) 5.71, "Cyber Security Programs for Nuclear Facilities," the most recent NRC-approved Nuclear Energy Institute (NEI) 08-09, "Cyber Security Plan for Nuclear Power Reactors," or any other NRC-approved set of guidelines. 1. As required by 10 CFR 73.54, an applicant/licensee or licensee must provide a high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design-basis threat (DBT) described in 10 CFR 73.1, “Purpose and Scope.” 2. As required by 10 CFR 73.55(a)(1) and 10 CFR 73.55(b)(8), an applicant/licensee or licensee must submit a CSP and establish, maintain, and implement a cyber security program. 3. As required by 10 CFR 73.55(m)(2), an audit of the effectiveness of the cyber security program must be conducted. 4. Appendix G to 10 CFR Part 73 requires licensees to report or