Document: 10 CFR Part 73
Document ID: 4a082a11-230f-414b-9764-e21be2ad963b
Document Type: cfr
Title: Cyber security event notifications.
Source: 10 CFR Part 73
Source URL: https://www.ecfr.gov/current/title-10/part-73/section-73.77
Revision Date: 
Chapter: 
Section ID: 73.77
CFR Part: 73
CFR Title: 10

Content:
icate intelligence gathering or pre-operational planning related to a cyber attack against digital computer and communication systems and networks within the scope of § 73.54 . ( b ) Twenty-four hour recordable events. ( 1 ) The licensee shall use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in their § 73.54 cyber security program within twenty-four hours of their discovery. ( 2 ) The licensee shall use the site corrective action program to record notifications made under paragraph (a) of this section within twenty-four hours of their discovery. ( c ) Notification process. ( 1 ) Each licensee shall make telephonic notifications required by paragraph (a) of this section to the NRC Headquarters Operations Center via the ENS. If the ENS is inoperative or unavailable, the licensee shall make the notification via a commercial telephone service or other dedicated telephonic system or any other methods that will ensure a report is received by the NRC Headquarters Operations Center within the timeframe. Commercial telephone numbers for the NRC Headquarters Operations Center are specified in appendix A to this part. ( 2 ) Notifications required by this section that contain Safeguards Information may be made to the NRC Headquarters Operations Center without using secure communications systems under the exception in § 73.22(f)(3) for emergency or extraordinary conditions. ( 3 ) Notifications required by this section that contain Safeguards Information and/or classified national security information and/or restricted data must be made to the NRC Headquarters Operations Center using secure communications systems appropriate to the sensitivity/classification level of the message. Licensees making these types of telephonic notifications must contact the NRC Headquarters Operations Center at the commercial numbers specified in appendix A to this part and request a transfer to a secure telephone. ( i ) If the licensee's