Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
valuate and manage cyber risks. The CSP states the following: • The licensee must perform periodic assessments to verify that the security controls implemented for each CDA remain robust, resilient, and effective. • The CST must verify the status of the controls annually or in accordance with the guidance described in Appendices B and C to RG 5.71, whichever is more frequent. A.4.1.2 Effectiveness Analysis The CSP states the following: • The CST monitors and measures the cyber security program and security controls to ensure that the controls were implemented correctly and are operating as intended, thus assuring protection against cyber attacks. • Licensee reviews of the security program and controls include periodic testing of the security controls and re-evaluation of adversary capabilities. • Licensee reviews of the security program and controls include audits of the following: – physical security program and implementing procedures – safety/security interface activities – testing, maintenance, and calibration programs – operating experience 13.6.6-25 Revision 0 – November 2010 program • The licensee considers feedback from the NRC and law enforcement agencies. • The CST verifies the effectiveness of security controls annually or in accordance with Appendices B and C to RG 5.71. • The CST reviews records of maintenance and repairs to ensure that security functions are maintained in accordance with recommendations provided by the manufacturer. The insights gained from these analyses are used to: • improve performance and effectiveness of the cyber security program, • manage and evaluate risk, • improve the effectiveness of implemented security controls described in Appendices B and C to RG 5.71, • ascertain whether new security controls are required to protect CDAs from cyber attack, • verify that existing security controls are functioning properly and are effective at protecting CDAs from cyber attack, and • facilitate