Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
vision 0 – November 2010 A.3.2 Incorporating the Cyber Security Program into the Physical Protection Program The licensee must follow the provisions of 10 CFR 73.54(b)(3), 10 CFR 73.55(a)(1), 10 CFR 73.55(c)(6), and 10 CFR 73.55(f)(2). The CSP discusses the following efforts necessary to integrate the management of physical and cyber security: • establishment of a security organization, independent from operations, to incorporate both cyber and physical security • documentation of physical and cyber security interdependencies • development of policies and procedures joining management, physical, and cyber security controls • incorporation of policies and procedures to secure the CDAs from attacks up to and including the DBT • coordination of the acquisition of physical or cyber security services, training, devices, and equipment • coordination of personnel training • integration and coordination of incident response personnel • training of senior management • performance of periodic exercises of simulated physical and cyber attacks 13.6.6-22 Revision 0 – November 2010 A.3.3. Policies and Implementing Process As required by 10 CFR 73.54(f), the licensee must develop and maintain policies and procedures to implement the CSP. The CSP states the following: • The licensee is advised to develop and implement policies and procedures to meet the security control objectives provided in Appendices B and C to RG 5.71. • The licensee is advised to document, review, approve, issue, use, and revise policies and implementation procedures as described in Section 4 of the CSP. • The licensee is advised to ensure personnel responsible for implementing and overseeing the program report to an executive who is responsible for nuclear plant operation. • It is recommended that licensee’s procedures establish specific responsibilities for positions described in Section C.10.10 of RG 5.71. 13.6.6-23 Revision 0 – November 2010 A.4 Maintaining the Cyber