Document: NRC Regulatory Guide
Document ID: fc586342-92f7-4c77-ae76-79e3674cf288
Document Type: regulatory_guide
Title: Criteria for Programmable Digital Devices in Safety-Related Systems of  Nuclear Power Plants + HISTORY –HISTORY 02/2023 – DG-1374, Proposed Revision 4 Prior to issuance of DG-1374, RG 1.152 was entitled, “Criteria for Use of Computers in Safety-Systems of Nuclear Power Plants” 06/2010 – DG-1249, Proposed Revision 3 – Revise 12/2004 – DG-1130, Proposed Revision 2 – Revise 05/1995 – DG-1039, Proposed Revision 1 03/1983 – DG-1130, Proposed Revision 2 – Revise (Rev. 4)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML2301/ML23012A242.pdf
Revision Date: 2023-05
Chapter: 
Section ID: RG-1.152
CFR Part: 
CFR Title: 

Content:
sees and applicants should avoid implementation of cyber security features directly in the safety-related systems. In any case, implementation of cyber security features shall not adversely impact the performance, effectiveness, reliability, or operation of safety functions. 3.3 With regard to providing safeguards to safety-related PDDs before installation, Clause 5.9.4 of IEEE Std 7-4.3.2-2016 should be supplemented with the following additional consideration: 3.3.1 Receipt, storage, staging, and testing of safety-related PDDs before installation should occur in a secure environment. 3.4 This RG is not intended to address the control-of-access features to prevent malicious cyberattacks. For protection for safety-related systems from malicious cyberattacks, the requirements of 10 CFR 73.54, “Protection of digital computer and communication systems and networks,” address cybersecurity of digital assets, which include those systems used to perform safety-related functions and functions that are important to safety, security, and emergency preparedness. The NRC published 10 CFR 73.54 to require licensees to establish, implement, and maintain cybersecurity plans and programs to protect critical digital assets, including digital safety systems, from malicious cyberattacks. RG 5.71 provides an acceptable approach to meet the requirements of 10 CFR 73.54. For licensees that choose to provide, as part of their license submittal, descriptions of cybersecurity design features intended to address the guidance of RG 5.71, the extent of the staff’s review of these features is limited to ensuring that these features do not adversely affect or degrade the safety-related system’s reliability or its capability to perform its safety functions. Licensees and applicants should also consider the cybersecurity guidance in RG 5.71 in preparing a design certification under 10 CFR Part 52. Within such consideration, measures should be included to ensure that safety-related I&C