Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
and network systems associated with SSEP functions are referred to as CS. The CST identifies CS by conducting an initial consequence analysis of systems, equipment, communication systems, and networks to determine those which, if compromised, exploited, or failed, could impact the SSEP functions of the nuclear facility, without taking into account existing mitigating measures. • perform a dependency and pathway analysis of any system or equipment associated with SSEP functions to determine whether they are CS. • identify and document CDA that have a direct, supporting, or indirect role in the proper functioning of CS. 13.6.6-14 Revision 0 – November 2010 As required by 10 CFR 73.54(b)(1), the licensee must examine each CS and document the results. The submitted CSP discusses the means to document the following: • description of CDA • identification of each CDA within each CS • description of CDA functional(s) • identification of the consequences to the CS and SSEP functions, if a compromise were to occur • identification of the digital devices having direct or indirect roles in CS function • description of security functional requirements or specifications that includes: – security requirements for vendor or developers to maintain system integrity – secure configuration, installation, and operation of the CDA – effective use and maintenance of security features or functions – known vulnerabilities regarding configuration and use of administrative functions – effective use of user- accessible security features or functions – methods for user interaction with CDA – user responsibilities in maintaining the security of the CDA 13.6.6-15 Revision 0 – November 2010 A.3.1.4 Reviews and Validation Testing As required by 10 CFR 73.54(e)(1), the CSP must describe implementation of the program and address site-specific conditions. The submitted CSP states that CST conducted a review and performed validation activities and for each CDA— •