Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
is recommended that licensee’s procedures establish specific responsibilities for positions described in Section C.10.10 of RG 5.71. 13.6.6-23 Revision 0 – November 2010 A.4 Maintaining the Cyber Security Program As required by 10 CFR 73.54(b)(2), the licensee must implement the elements in this section to adequately protect the site from cyber attacks. The CSP states the following: • The licensee will employ a life-cycle approach consistent with the controls described in Appendix C of RG 5.71. • The licensee needs to maintain security controls for CDAs to achieve the overall cyber security program objectives. • For new or existing CDAs undergoing modifications, the licensee should follow the process described in Section 4.2 of the CSP. A.4.1 Continuous Monitoring and Assessment In order to comply with 10 CFR 73.54(b)(2), 10 CFR 73.54(d)(2), and 10 CFR 73.54(e)(2), the licensee should monitor the controls described in Appendix C to RG 5.71. Automated support tools are used for near real-time cyber management for CDAs. The CSP describes a continuous monitoring program, including the following: • ongoing assessments to verify that security controls remain in place throughout the life cycle • verification that rogue assets have not been connected to the infrastructure • periodic assessment to verify effectiveness and need for the security controls described in Appendices B and C to RG 5.71 • periodic security program review to evaluate and improve the effectiveness of the program • support for configuration management • possible updates to the CSP 13.6.6-24 Revision 0 – November 2010 A.4.1.1 Periodic Assessment of Security Controls As required by 10 CFR 73.54(b)(2) and 10 CFR 73.54(d)(2), the licensee must maintain the cyber security program and evaluate and manage cyber risks. The CSP states the following: • The licensee must perform periodic assessments to verify that the security controls implemented for each CDA remain robust, resilient,