Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
The licensee defines the minimum physical and logical access for the modifications. Additionally, the licensee employs electronic means to monitor CDA access to ensure that only authorized systems and services are used. The licensee also documents the justification for the use of alternate (compensating) security controls for instances in which monitoring cannot be done electronically, including the following: • physically restricting access • monitoring and recording physical access to enable immediate detection and response to intrusions • employing auditing and validation measures (e.g., security officer rounds, periodic monitoring of tamper seals) The licensee reviews log records no less frequently than once a quarter in compliance with the physical security plan. 13.6.6-42 Revision 0 – November 2010 C.11.6 Access Restrictions for Change The licensee defines, documents, approves, and enforces physical and logical access restrictions associated with changes to CDAs and generates, retains, and audits the record quarterly and when there are indications that unauthorized changes may have occurred. C.11.8 Least Functionality The licensee reviews CDAs monthly to identify and eliminate unnecessary functions, ports, protocols, and services. C.12.1 System and Services Acquisition Policy and Procedures The licensee develops, disseminates, and annually reviews and updates a formal, documented system and services acquisition policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among licensee entities, associated system and service acquisition controls, and compliance. The licensee develops, disseminates, and annually reviews and updates formal, documented procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls. C.12.6 Licensee/Applicant Testing The licensee requires annual audits of CDAs to verify the following: • The security