Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
icensee is responsible for the following: • receiving timely security alerts, bulletins, advisories, and directives from credible external organizations, as designated by the NRC and the licensee on an ongoing basis, such as third-party security alert notification services and vendor security alert lists, and maintaining a copy of these documents • independently evaluating and determining the need, severity, methods, and timeframes for implementing security directives consistent with the security controls for the CDA (Section 3.1 of Appendix A to RG 5.71) • within established timeframes set by the licensee or as directed by the NRC C.3.7 Software and Information Integrity The licensee reassesses and documents the integrity, operation, and functions of software and information by performing regular integrity, operation, and functional scans consistent with manufacturer or vendor recommendations, either quarterly, or as defined in NEI 03-12, or as required by NRC regulation, whichever is more frequent. C.7 Defense in Depth The licensee implements and documents security boundary control devices between higher security levels and lower security levels that include, except in the case of data diodes, a rule set that at a minimum is updated quarterly. C.8.3 Incident Response Testing and Drills The licensee is responsible for testing and conducting drills of the incident response capability for CDAs at least annually. C.9.1 Contingency Planning Policy and Procedure The licensee develops, disseminates, and annually reviews and updates the following: • a formal, documented contingency planning policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among licensee entities, and compliance • formal, documented procedures to facilitate the implementation of the contingency planning policy and associated contingency planning controls 13.6.6-41 Revision 0 – November 2010 C.9.3 Contingency Plan Testing The licensee is