Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
7.1-D-25 March 2007 • Replacement (i.e., the withdrawal of active support by the operation and maintenance organization, partial or total replacement by a new system, or installation of an upgraded system). System modifications may be derived from requirements specified to correct errors (corrective), to adapt to a changed operating environment (adaptive), or to respond to additional licensee requests or enhancements (perfective). 9.8.1 Maintenance Activities (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.8.1) Modifications of the safety system should be treated as development processes and should be verified and validated as described above. Security functions should be assessed as described in the above regulatory positions, and should be revised (as appropriate) to reflect requirements derived from the maintenance process. When migrating systems, the licensee should verify that the migrated systems meet the safety system security requirements. The maintenance process should continue to conform to existing safety system security requirements unless those requirements are to be changed as part of the maintenance activity. 9.8.2 Quality Assurance (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.8.2) The licensee should address security in its quality assurance program. The security quality assurance section can be incorporated into the existing quality assurance program. The cyber- security features should be maintained under a configuration management program. The licensee’s quality assurance group (such as information/network security expert) should conduct periodic audits to determine the effectiveness of the digital safety system security procedures. If the safety system security functions were not previously verified and validated using a level of effort commensurate with the safety system security functional requirements, and appropriate documentation is not available or adequate, the licensee should determine whether the missing or