Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
a level of effort commensurate with the safety system security functional requirements, and appropriate documentation is not available or adequate, the licensee should determine whether the missing or incomplete documentation should be generated. In making this determination of whether to generate missing documentation, the minimum safety system security functional requirements should be taken into consideration. 9.8.3 Incident Response (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.8.3) The licensee should develop an incident response and recovery plan for responding to digital system security incidents (e.g., intrusions, viruses, worms, Trojan horses, or bomb codes). The plan should be developed to address various loss scenarios and undesirable operations of plant digital systems, including possible interruptions in service due to the loss of system resources, data, facility, staff, and/or infrastructure. The plan should define contingencies for ensuring minimal disruption to critical services in these instances. 9.8.4 Audits and Assessments (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.8.4) The licensee should perform periodic computer system security self-assessments and audits, which are key components of a good security program. The licensee should assess proposed safety system changes and their impact on safety system security; evaluate anomalies that are discovered during operation; assess migration requirements; and assess modifications made Appendix 7.1-D-26 March 2007 including V&V tasks to ensure that vulnerabilities have not been introduced into the plant environment from modifications. 9.9 Retirement Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.9) In the retirement lifecycle phase, the licensee should assess the effect of replacing or removing the existing safety system security functions from the operating environment. The licensee should include in the scope of this assessment the effect on safety and