Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ases of the life cycle. • The licensee will establish procedures for screening, evaluating, mitigating, and dispositioning threat and vulnerability notifications received from credible sources. This includes implementation of security controls to mitigate new issues. A.4.2.3 Modification of CDAs As required by 10 CFR 73.54(d)(3), the licensee must ensure that modifications to CDAs are evaluated before implementation. It is recommended that the licensee must disseminate, review, and update the following when a CDA modification is conducted: • documented security assessment and authorization policy to reflect all modifications • documented procedure to facilitate the implementation of the security reassessment and authorization policy and associated controls 13.6.6-32 Revision 0 – November 2010 A.4.2.4 Updating Cyber Security Practices In order to comply with 10 CFR 73.54(e), the CST should update the cyber security practices. It is advised that the CST review, update, and modify information on cyber security policies, procedures, practices, existing cyber security controls, network architecture, security devices, and any other information associated with the state of the security program or security controls provided in Appendices B and C to RG 5.71 when changes occur to a CDA or the environment. This information includes the following: • detailed network architectures and diagrams • configuration information on security devices or CDAs • new plant or corporate-wide cyber security defensive strategies or security controls being developed and policies, procedures, practices, and technologies related to their deployment • the site’s physical and operational security program • cyber security requirements for vendors and contractors • identified potential pathways for attacks • recent cyber security studies or audit results • identified infrastructure support systems whose failure or manipulation could impact the proper functioning of CS