Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ices acquisition policy and associated system and services acquisition controls. C.12.6 Licensee/Applicant Testing The licensee requires annual audits of CDAs to verify the following: • The security controls present during testing remain in place and are functioning correctly in the production system. • CDAs are free from known vulnerabilities and security compromises and continue to provide information on the nature and extent of compromises, should they occur. • The change management program is functioning effectively and is recording configuration changes appropriately. 13.6.6-43 Revision 0 – November 2010 C.13.1 Threat and Vulnerability Management The licensee does the following: • performs assessments and scans for vulnerabilities in CDAs at least once each quarter and at random intervals in accordance with Section 4.1.3 of Appendix A to RG 5.71 and when new potential CDA vulnerabilities are reported or identified • analyzes vulnerability scan reports and remediates vulnerabilities immediately to provide a high degree of assurance that CDAs/CS are protected from cyber attacks up to and including the DBT • employs vulnerability scanning tools that include the capability to update the list of cyber vulnerabilities scanned and updates the list of CDA vulnerabilities scanned monthly and when new vulnerabilities are identified and reported • employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in CDA vulnerabilities and mitigation/flaw remediation activities • ensures that SSEP functions are not adversely impacted by scanning The following additional guidance for the reviewer is provided: • For reviews of CSPs for a new reactor, a table in FSAR Chapter 13 provides the implementation schedule, along with the implementation schedules for all other operational programs. The NRC will inspect the implementation of this program in accordance with NRC Inspection Manual Chapter IMC-2504, “Construction