Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
potential pathways for attacks • recent cyber security studies or audit results • identified infrastructure support systems whose failure or manipulation could impact the proper functioning of CS 13.6.6-33 Revision 0 – November 2010 A.4.2.5 Review and Validation Testing of Modification or Addition of a CDA In order to comply with 10 CFR 73.54(d)(3), the CST should document the results of reviews and validation tests. The CST documents the results of reviews and validation tests of each CDA modification and addition using the process described in Regulatory Position C.3.1.4 of RG 5.71. A.4.2.6 Application of Security Controls Associated with a Modification or Addition As required by 10 CFR 73.54(c)(1) and 10 CFR 73.54(d)(3), the licensee must apply security controls associated with modifications. The licensee undertakes the following when new CDAs are introduced: • deploys the CDA into the appropriate level of the defensive model described in Section 3.1.5 of this plan, • applies the technical controls identified in Appendix B to RG 5.71 in a manner consistent with the process described in Section 3.2 of RG 5.71, and • confirms that the operational and management controls described in Appendix C of RG 5.71 are applied and effective for the CDA. 13.6.6-34 Revision 0 – November 2010 A.4.3 Cyber Security Program Review The cyber security program establishes the necessary measures and procedures to implement periodic reviews of applicable program elements, in accordance with the requirements of 10 CFR 73.55(m) and 10 CFR 73.54(g). The licensee conducts reviews as follows: • the program’s effectiveness at least every 24 months • within 12 months of initial implementation of program • within 12 months of a change to personnel, procedures, equipment, or facilities that could adversely affect security • as necessary based upon site-specific analyses, assessments, or other performance indicators • by individuals independent of those personnel