Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
orders to require power reactor licensees to implement measures to enhance cyber security. These security measures require an assessment of cyber systems and the implementation of corrective measures sufficient to provide protection against the cyber threats at the time the orders were issued. The requirements maintain the intent of the security order by establishing the requirement for a cyber security program to protect digital computer and communication systems and networks that, if compromised, can adversely impact SSEP. This includes support systems and equipment. 2. Recently, the NRC revised 10 CFR 73.55 to codify the cyber security requirements for NRC-licensed power reactors. In particular, 10 CFR 73.55(a)(1) and 10 CFR 73.55(b)(8) require that an applicant or licensee submit a CSP and establish, maintain, and implement a cyber security program. Finally, 10 CFR 73.55 requires an audit of the effectiveness of the cyber security program at least every 24 months. 3. Appendix G to 10 CFR Part 73 requires licensees to report or record, as appropriate, safeguards events. These events include cyber attacks. 4. As required by 10 CFR 73.58, licensees must assess and manage the potential for adverse effects on safety and security, including the site emergency plan, before implementing changes to plant configurations, facility conditions, or security. 13.6.6-6 Revision 0 – November 2010 III. REVIEW PROCEDURES The purpose of the review procedures is to determine whether a CSP is in line with the guidance in RG 5.71, the provisions of applicable NRC regulations, the information requirements of Section I above, and the acceptance criteria of Section II above. Table 1 provides a checklist for reviewers to use when reviewing the body of the CSP. Table 2 and Table 3 provide listings of security controls with time associations. Reviewers can use these for comparison with the frequencies in the CSPs being reviewed. 13.6.6-7 Revision 0 – November 2010 Table 1 - Acceptance