Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
e CSP must describe implementation of the program and address site-specific conditions. The submitted CSP states that CST conducted a review and performed validation activities and for each CDA— • direct/indirect connection pathways • infrastructure interdependencies • application of defensive strategies, including defensive models, security controls, and other defensive measures 13.6.6-16 Revision 0 – November 2010 In order to comply with 10 CFR 73.54(e)(1), the CST should validate the above activities with a walkdown. The walkdown includes the following: • performing physical inspection of the connections and configuration of each CDA • for each CDA, tracing all communication connections into and out of each termination point along the pathway • examining the physical security of the CDA including the communication pathways • examining the configuration and assessing the effectiveness of existing security controls along the communication pathways • examining interdependencies for each CDA and trust relationships and between CDAs • examining interdependencies with infrastructure support systems emphasizing compromises of electrical power, environmental controls, and fire equipment • examining systems, communication systems, and networks that are potential pathways for attacks • resolving discrepancies found in the review 13.6.6-17 Revision 0 – November 2010 In order to comply with 10 CFR 73.54(e)(1), the CST should perform electronic validations as appropriate. An electronic validation is performed when a walkdown inspection is impractical and consists of tracing a communication pathway from start to finish. Use of electronic equipment may prove a better method than a physical walkdown. A.3.1.5 Defense-in-Depth Protective Strategies As required by 10 CFR 73.54(c)(2), licensees must apply and maintain defense- in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. The submitted CSP