Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
fied in Appendix B to RG 5.71. 2. If a security control cannot be applied, implement an alternative control listed in Appendix B to RG 5.71 by doing one of the following: A. Document the basis for the countermeasure. B. Perform and document an attack vector/tree analysis of the CDA to confirm that the countermeasure provides the same or greater protection as the corresponding control. 3. Do not implement a control enumerated in Appendix B to RG 5.71 and— A. Perform an attack vector and attack tree analyses of the specific security controls for the CDA that will not be implemented. B. Document that the attack vector does not exist and demonstrate that the control is not necessary. 13.6.6-20 Revision 0 – November 2010 As required by 10 CFR 73.58(b), 10 CFR 73.58(c), and 10 CFR 73.58(d), the licensee must address adverse impacts of security controls. The submitted CSP notes that, before implementing security controls on a CDA, the potential for adverse impact must be assessed. Specifically, the licensee— • should not implement a security control if there is a known adverse impact to SSEP functions • should use alternate controls to mitigate the lack of the security control, in accordance with Section 3.1.6 of the CSP In order to comply with 10 CFR 73.54(c)(2) Licensees should perform effectiveness analysis, vulnerability assessments, and scans The submitted CSP includes provisions to verify that CDAs are adequately protected from cyber attacks up to and including the DBT and that any identified gaps have been closed. The program should recommend the licensee do the following: • Perform an effectiveness analysis, as described in Section C.4.1.2 of RG 5.71. • Perform a vulnerability assessment or scans, as described in Section C.4.1.3 of RG 5.71. 13.6.6-21 Revision 0 – November 2010 A.3.2 Incorporating the Cyber Security Program into the Physical Protection Program The licensee must follow the provisions of 10 CFR 73.54(b)(3), 10 CFR 73.55(a)(1), 10 CFR