Document: 10 CFR Part 73
Document ID: 2c582f64-f8cb-4316-a92f-b6eec6cc0d2a
Document Type: cfr
Title: Protection of digital computer and communication systems and networks.
Source: 10 CFR Part 73
Source URL: https://www.ecfr.gov/current/title-10/part-73/section-73.54
Revision Date: 
Chapter: 
Section ID: 73.54
CFR Part: 73
CFR Title: 10

Content:
networks, and associated equipment. ( b ) To accomplish this, the licensee shall: ( 1 ) Analyze digital computer and communication systems and networks and identify those assets that must be protected against cyber attacks to satisfy paragraph (a) of this section, ( 2 ) Establish, implement, and maintain a cyber security program for the protection of the assets identified in paragraph (b)(1) of this section; and ( 3 ) Incorporate the cyber security program as a component of the physical protection program. ( c ) The cyber security program must be designed to: ( 1 ) Implement security controls to protect the assets identified by paragraph (b)(1) of this section from cyber attacks; ( 2 ) Apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks; ( 3 ) Mitigate the adverse affects of cyber attacks; and ( 4 ) Ensure that the functions of protected assets identified by paragraph (b)(1) of this section are not adversely impacted due to cyber attacks. ( d ) As part of the cyber security program, the licensee shall: ( 1 ) Ensure that appropriate facility personnel, including contractors, are aware of cyber security requirements and receive the training necessary to perform their assigned duties and responsibilities. ( 2 ) Evaluate and manage cyber risks. ( 3 ) Ensure that modifications to assets, identified by paragraph (b)(1) of this section, are evaluated before implementation to ensure that the cyber security performance objectives identified in paragraph (a)(1) of this section are maintained. ( 4 ) Conduct cyber security event notifications in accordance with the provisions of § 73.77 . ( e ) The licensee shall establish, implement, and maintain a cyber security plan that implements the cyber security program requirements of this section. ( 1 ) The cyber security plan must describe how the requirements of this section will be implemented and must account for the site-specific conditions that