Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
security-related incidents affecting CDAs or SSEP functions or both. • The licensee retains superseded portions of these records for at least 3 years after the record is superseded, unless otherwise specified by the NRC. 13.6.6-36 Revision 0 – November 2010 Table 2 - Regulatory Guide 5.71, Appendix B, Technical Security Controls (This table contains only those technical controls with time associations. To aid the reviewer, the description of the periodicity of these controls has been expanded beyond that which is provided in RG 5.71.) B.1.1 Access Control Policy and Procedure • Develop, disseminate, and annually review and update a formal, documented CDA and CS access control policy which addresses the purpose, scope, roles, responsibilities, management commitments, and internal coordination of such policy. • Audit CDAs annually or immediately upon changes in personnel responsibilities or major changes in system configurations or functionality. B.1.2 Account Management • Review CDA/CS accounts in a manner consistent with the access control list provided in the design control package, access control program, and cyber security procedures. Initiate required actions on CDA/CS accounts no less frequently than once every 30 days. • Review and document CDA/CS accounts at a maximum interval consistent with the most recent version of NEI 03-12, “Security Plan, Training and Qualification Plan, and Safeguards Contingency Plan,” endorsed by the NRC for CDAs/CS in vital areas and CDAs/CS that provide security functions protecting vital areas. • Employ automated mechanisms that support CDA/CS account management functions and enable CDAs/CS to: – terminate temporary, guest, and emergency accounts no less frequently than once every 30 days – disable inactive accounts no less frequently than once every 30 days – document and immediately notify system administrators of all account creation, deletion, and modification activities to ensure that administrators