Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
with the implementation schedules for all other operational programs. The NRC will inspect the implementation of this program in accordance with NRC Inspection Manual Chapter IMC-2504, “Construction Inspection Program—Non-ITAAC Inspections.” The reviewer will ensure that the program and associated implementation milestones are included within the license condition on operational program implementation. • For reviews of CSPs for an operating reactor, the implementation schedule must consider refueling outages. • For reviews of CSPs the phrase “cyber attack” must be defined in the CSP as “Any event in which there is a reason to believe that an adversary has committed or caused, or attempted to commit or cause, or has made a credible threat to commit or cause malicious exploitation of a CDA.” See ADAMS Accession No. ML101550052. IV. EVALUATION FINDINGS The reviewer should verify that the applicant/licensee has provided sufficient information and that the review and calculations (if applicable) support conclusions of the following type to be included in the NRC staff’s safety evaluation report. The reviewer should also state the bases for those conclusions. 13.6.6-44 Revision 0 – November 2010 The evaluation findings for a CSP review should be substantially equivalent to the following statement: A CSP has been submitted to demonstrate that the cyber security program will provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the DBT described in 10 CFR 73.1. The CSP has been withheld from public disclosure in accordance with the provisions of 10 CFR 2.390(d)(1). The applicant/licensee described the cyber security program based on the requirements of 10 CFR 73.54, including the audit of the effectiveness of the cyber security program at least every 24 months, as required by 10 CFR 73.55(m); safety and security interface, as required by 10 CFR 73.58; and