Document: NRC Regulatory Guide
Document ID: 3eb179d3-5491-407d-8b0e-eed083d58a17
Document Type: regulatory_guide
Title: Configuration Management Plans for Digital Computer Software Used in Safety Systems of Nuclear Power Plants + HISTORY - HISTORY 08/2012 – DG-1206 , Proposed Revision 1 08/1996 – DG-1055 , Proposed Revision 0 (Rev. 1)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML1032/ML103200044.pdf
Revision Date: 2023-06
Chapter: 
Section ID: RG-1.169
CFR Part: 
CFR Title: 

Content:
ance position 12, “Release Management and Delivery.” IEEE Std. 828-2005 has added this new section in order to control the overall software release management objectives. This new area for the SCM complements the existing standard work found in the software life-cycle project plan. The second new area refers to security features or mechanisms which can play a critical role in supporting software security at higher levels of assurance. IEEE Std. 1012-2004, “IEEE Standard for Software Verification and Validation,” (Ref. 7), as endorsed by Regulatory Guide 1.168, “Verification, Validation, Reviews, and Audits for Digital Computer Software Used in Safety Systems of Nuclear Power Plants” (Ref. 8) requires a security analysis be performed during the development, operation, and maintenance life cycle processes. IEEE Std. 828-2005 adds to this by requiring measures to control security information such as the results of security analyses. To meet criteria of IEEE Std. 603-1991 and 10 CFR 50, Appendix B, the controlled development of digital safety system software is to be performed in a secure development and operational environment (SDOE). For guidance to establish an SDOE, refer to Regulatory Guide 1.152, “Criteria for Use of Computers in Safety Systems of Nuclear Power Plants,” (Ref. 9). This regulatory guide is based on standards and describes methods acceptable for any safety system software and discusses the required SCM activities. The applicant or licensee determines how the required activities will be implemented. Other Codes and Standards This regulatory guide endorses the use of one or more voluntary consensus codes or standards developed by external organizations. These codes or standards may contain references to other codes or standards. These references should be considered individually. If a referenced standard has been incorporated separately into NRC regulations, licensees and applicants must comply with that standard as set forth in the