Document: NUREG-0800
Document ID: c90016c6-e03f-4224-8ff3-87a6f7d3ca42
Document Type: srp
Title: Appendix 7-A
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0525/ML052500547.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7
CFR Part: 
CFR Title: 

Content:
include purpose, organization, responsibilities, risks, and security. Purpose requires a general description of the software maintenance process and the goals of that process. The plan should list the general functions that the software maintenance organization will be expected to perform, and provide general information on obtaining field trouble reports. Maintenance should be limited to the process of modifying a software design output to repair nonconforming items or to implement pre-planned actions necessary to maintain performance. Modifications to improve performance or other attributes, or to adapt the design outputs to a modified environment should be considered design changes. Organization requires a description of the software maintenance organization. The plan should describe the boundaries between the software maintenance organization and other company organizations. Reporting channels should be described. Formal communication channels between the maintenance organization and the customers using the software should be provided, so that incorrect behavior of the software during operation can be identified, isolated and corrected. This communication structure should provide assurance that software failures during operation will not be ignored. Responsibilities requires a definition of the responsibilities and authority of the software maintenance organization. Risks requires a description of the method used for software risk management during maintenance, with particular attention to risks that have the potential for compromising safety. Security requires a description of the methods to be used to prevent contamination of the corrected software by viruses, Trojan horses or other nefarious additions. The required security level for each maintenance project phase should be provided. The plan should identify the controls needed over maintenance activities and maintenance and test equipment to prevent unauthorized changes to hardware, software and system