Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
nge management system as described in Section C.11 of RG 5.71. • Before modifications are implemented, the licensee must evaluate them using the criteria in Section 4.2 of the CSP to ensure that the performance objectives identified in 10 CFR 73.54(a)(1) are maintained. 13.6.6-30 Revision 0 – November 2010 A.4.2.2 Security Impact Analysis of Changes and Environment In order to comply with 10 CFR 73.54(d)(3), the security impact analysis should assist in managing potential vulnerabilities, weaknesses, and risks introduced by changes in the system, network, environment, or emerging threats. The CSP states the following: • It is advised that the CST will perform a security impact analysis in accordance with CSP Section 4.1.2 before implementing a design or configuration change or when changes to the environment occur. • The CST will evaluate, document, and incorporate into the security impact analysis the safety and security interdependencies of other CDAs or systems. The CST will also update and document the following: – location of CDA and connected assets – connectivity pathways – infrastructure interdependencies – application of defensive strategies including: ◦ defensive models ◦ security controls ◦ other defensive strategy measures – plant-wide physical and cyber security policies and procedures, including attack mitigation and incident response and recovery • The licensee will perform impact analyses as part of the change approval process and address identified gaps to protect CDAs from attack as described in Section 4.2.6 of this plan. 13.6.6-31 Revision 0 – November 2010 • The licensee will manage the cyber security of SSEP functions and CDAs through ongoing evaluation, as described in Appendices B and C to RG 5.71, during all phases of the life cycle. • The licensee will establish procedures for screening, evaluating, mitigating, and dispositioning threat and vulnerability notifications received from credible sources. This