Document: NRC Regulatory Guide
Document ID: c6321e39-3d1b-40a6-ace3-8c6a0c54e2cd
Document Type: regulatory_guide
Title: Developing Software Life Cycle Processes for Digital Computer Software Used in Safety Systems of Nuclear Power Plants + HISTORY - HISTORY 08/2012 – DG-1210 , Proposed Revision 1 08/1996 – DG-1059 , Proposed Revision 0 (Rev. 1)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML1031/ML103120727.pdf
Revision Date: 2023-06
Chapter: 
Section ID: RG-1.173
CFR Part: 
CFR Title: 

Content:
ion and review for suitability of the application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems, and components. Criterion VII requires, in part, that measures be established to ensure that purchased material, whether purchased directly or through contractors and subcontractors, conforms to the procurement documents. If preexisting software (i.e., reusable software or commercial off-the-shelf software) is incorporated into a safety system developed under the method described by this regulatory guide, an acceptance process should be included at an appropriate point in the life-cycle model to establish the suitability of the preexisting software for its intended use. The acceptance process, its inputs, outputs, activities, preconditions, and postconditions should meet the applicable regulatory requirements and design bases for the safety system. Regulatory Guide 1.152 provides information on the acceptance of preexisting software. Although not specifically endorsed by any particular regulatory guide, additional detailed information on acceptance processes appear in Electric Power Research Institute (EPRI) TR-106439, “Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications,” issued October 1996 (Ref. 18). d. Secure Analysis. The NRC takes exception to the IEEE Std. 1074-2006’s directions for appropriate security assurance level in Section A.1.1.5 “Determine Security Objectives (Required).” The planning activity is necessary and the applicant or licensee should refer to the following primary security objectives: (i) secure software development environment, and (ii) cyber security. Guidance for secure software development is available in Regulatory Guide 1.152, whereas guidance for cyber security is available in Regulatory Guide 5.71, “Cyber Security Programs for Nuclear Facilities” (Ref. 19). e. Definitions. The following