Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ies to, and consequences from, an attack. • Evaluate or reevaluate assumptions or conclusions about the effectiveness of existing cyber security controls, defensive strategies, and attack mitigation methods; and cyber security awareness and training of those working with, or responsible for, CDAs and cyber security controls throughout their system life cycles. • Confirm information from reviews of CDAs and connected digital devices and associated security controls with physical and electronic validation activities. 13.6.6-12 Revision 0 – November 2010 • As needed, identify and implement new cyber security controls. • Document the implementation of alternate or compensating measures in lieu of any security controls (Appendices B and C of RG 5.71). • Document the basis for not implementing certain controls (Appendix B to RG 5.71). • Prepare documentation and oversee implementation of security controls (Appendices B and C to RG 5.71). • Retain all documentation in accordance with 10 CFR 73.55(q) and Section C.5 of RG 5.71. As required by 10 CFR 73.54(d)(2), the CST conducts objective security assessments to evaluate and manage cyber risks. Security assessment determinations are not constrained by operational goals. 13.6.6-13 Revision 0 – November 2010 A.3.1.3 Identification of CDAs As required by 10 CFR 73.54(b)(1), the licensee must identify and document each CDA that has a direct, supporting, or indirect association with the proper functioning of CS. The submitted CSP provides a description of methods that: • identify and document systems, equipment, communication systems, and networks that are associated with the SSEP functions described in 10 CFR 73.54(a)(1), as well as the support systems associated with these SSEP functions. Systems, equipment, and network systems associated with SSEP functions are referred to as CS. The CST identifies CS by conducting an initial consequence analysis of systems, equipment, communication systems, and networks