Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
purpose, scope, roles, responsibilities, management commitments, and internal coordination of the system • a formal, documented procedure that facilitates the implementation of the CDA/CS system and communications protection policy and associated CDA/CS system and communications protection security controls B.4.1 Identification and Authentication Policies and Procedures The identification and authentication policy and procedures provide guidance on managing both user identifiers and CDA/CS authenticators. These items include the following: • disable user identifier after a maximum of 30 days of inactivity • annual changing or refreshing of authenticators B.4.3 Password Requirements Change passwords periodically (e.g., every 30 days for workstations; every 3 months for CDAs in a vital area). B.4.6 Identifier Management Manage and document user identifiers by disabling the user identifier after a maximum of 30 days of inactivity. B.4.7 Authenticator Management Manage CDA/CS authenticators by changing/refreshing authenticators annually. 13.6.6-39 Revision 0 – November 2010 Table 3 - Regulatory Guide 5.71, Appendix C, Management and Operations Security Controls (This table contains only those management and operations controls with time associations. To aid the reviewer, the description of the periodicity of these controls has been expanded beyond that which is provided in RG 5.71.) C.1.1 Media Protection Policy and Procedures The licensee develops, disseminates, and annually reviews and updates the following: • a formal, documented media protection policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among site entities, and compliance for each information category, as defined by the site policies, and ensures that any media which can provide information to assist an adversary is marked at a minimum to identify the sensitive nature of the media • a formal, documented procedure to facilitate the implementation of