Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
t develop and maintain written policies and procedures to implement the CSP. The applicant/licensee must review the cyber security program as a component of the physical security program in accordance with the requirements of 10 CFR 73.55(m), including the periodicity requirements. The applicant/licensee must retain all records and supporting technical documentation required to satisfy the recordkeeping requirements of 10 CFR 73.54 until the Commission terminates the license for which the records were developed. The applicant/licensee must also maintain the superseded portions of such records for at least 3 years after the record is superseded, unless otherwise specified by the Commission. The scope of the review is programmatic. The NRC staff does not review design information contained in the CSP. Specific information to be reviewed, referenced to applicable sections of 10 CFR 73.54, includes the following: 1. the purpose and scope of the applicant/licensee=s cyber security program (10 CFR 73.54(a)) 2. the performance basis of the applicant/licensee=s cyber security program (10 CFR 73.54(c) and 10 CFR 73.54(e)) 3. a discussion of the licensee’s formal, documented security planning, assessment, and authorization policy (10 CFR 73.54(f)) 4. a discussion of the applicant/licensee’s cyber security training (10 CFR 73.54(d)(1)) 5. a discussion of the applicant/licensee’s identification of CDAs (10 CFR 73.54(b)(1)) 6. a discussion of the applicant/licensee’s reviews and validation testing of critical systems (CS) and CDAs (10 CFR 73.54(b)(2)) 7. the applicant/licensee’s defense-in-depth protective strategies (10 CFR 73.54(c)(2)) 8. a discussion of the application of security controls (10 CFR 73.54(c)(1)) 9. a discussion of the incorporation of the cyber security program into the physical protection program (10 CFR 73.54(b)(3)) 10. a discussion of policies and implementing procedures for the cyber security program (10 CFR 73.54(f)) 11. a discussion of