Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
rity requirements for the system (hardware and software). Remote access to the safety system should not be implemented. Computer-based safety systems may transfer data to other systems through one-way communication pathways. 9.2 Requirements Phase Regulatory Guide 1.152, Revision 2, Regulatory Position 2.2) 9.2.1 System Features (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.2.1) The licensees and developers should define the security functional performance requirements and system configuration; interfaces external to the system; and the requirements for qualification, human factors engineering, data definitions, documentation for the software and hardware, installation and acceptance, operation and execution, and maintenance. The security requirements should be part of the overall system requirements. Therefore, the V&V process of the overall system should ensure the correctness, completeness, accuracy, testability, and consistency of the system security requirements. Requirements specifying the use of pre-developed software and systems (e.g., reuse software and commercial off-the-shelf systems) should address the vulnerability of the safety system (e.g., by using pre-developed software functions that have been tested and are supported by operating experience). Appendix 7.1-D-22 March 2007 9.2.2 Development Activities (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.2.2) The development process should ensure the system does not contain undocumented code (e.g., back door coding), malicious code (e.g., intrusions, viruses, worms, Trojan horses, or bomb codes), and other unwanted and undocumented functions or applications. 9.3 Design Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.3) 9.3.1 System Features (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.3.1) The safety system security requirements identified in the system requirements specification should be translated into specific design configuration items in the