Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
uirements of IEEE Std 603-1991. 9. CYBER SECURITY CRITERIA Sub-Clause 5.9 of IEEE Std 603-1991 states, “The design shall permit the administrative control of access to safety system equipment. These administrative controls shall be supported by provisions within the safety systems, by provision in the generating station design, or by a combination thereof.” For digital computer-based systems, controls of both physical and electronic access to safety system and data should be provided to prevent unauthorized changes. Controls should address access via network connections and via maintenance equipment. There should be no access via network connections, and access via maintenance equipment should be limited to those times the maintenance equipment is actually being used for maintenance. Additionally, the design of the plant data communication systems should ensure that the systems do not present an electronic path by which a person can make unauthorized changes to plant safety systems or display erroneous plant status information to the operators. Computer-based safety systems (including hardware and software) should be secured against both physical and electronic threats. The consideration of hardware should ensure there is limited physical access control, and that there are no modems or connectivity to external networks. Security of computer-based system software relates to the ability to survive unauthorized, undesirable, and unsafe intrusions throughout the life cycle of the safety system. Computer-based systems are secure from electronic vulnerabilities if unauthorized and inappropriate access and use of those systems is deterred, detected, and mitigated. The security of computer-based systems is established through (1) designing the security features that will meet licensee’s security requirements in the systems, (2) developing the systems that do not contain undocumented codes (e.g., back door coding, logic and/or time bomb codes) and that are resilient