Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
establishes how digital computer and communication systems and networks within the scope of 10 CFR 73.54 will be adequately protected from cyber attacks up to and including the DBT. A.3 Cyber Security Program Implementation A licensee must establish, implement, and maintain a program that complies with the requirements of 10 CFR 73.54(b)(2) and 10 CFR 73.55(b)(8) to protect systems within the scope of 10 CFR 73.54(a)(1). The CSP complies with 10 CFR 73.54 as follows: • establishes and implements the defensive model described in Section 3.15 of this plan, with the security controls described in Sections C.3.1, C.3.2, and C.3.3 of RG 5.71 • maintains the program described in Section C.4 of RG 5.71 • ensures that documentation of security controls is available for each CDA for inspection • ensures that the NRC will approve any changes that decrease the effectiveness of the plan • ensures that reports of any cyber attacks or incidents at the site are made to the NRC as required by 10 CFR 73.71, “Reporting of Safeguards Events” and Appendix G, “Reportable Safeguards Events,” to 10 CFR Part 73, “Physical Protection of Plants and Materials.” 13.6.6-9 Revision 0 – November 2010 A.3.1 Analyzing Digital Computer Systems A.3.1.1 Security Assessment and Authorization As required by 10 CFR 73.54(f), licensees must develop and maintain policies and procedures to implement the CSP. The CSP discusses the following policies and procedures: • a formal documented security planning, assessment, and authorization policy that describes the purpose, scope, roles, responsibilities, management commitments, and coordination among departments and the implementation of the security program and the controls listed in Appendices B and C of RG 5.71 • a formal documented procedure to facilitate the implementation of the cyber security program and the security assessment 13.6.6-10 Revision 0 – November 2010 A.3.1.2 Cyber Security Team In order to comply with 10 CFR