Document: NRC Regulatory Guide
Document ID: c6321e39-3d1b-40a6-ace3-8c6a0c54e2cd
Document Type: regulatory_guide
Title: Developing Software Life Cycle Processes for Digital Computer Software Used in Safety Systems of Nuclear Power Plants + HISTORY - HISTORY 08/2012 – DG-1210 , Proposed Revision 1 08/1996 – DG-1059 , Proposed Revision 0 (Rev. 1)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML1031/ML103120727.pdf
Revision Date: 2023-06
Chapter: 
Section ID: RG-1.173
CFR Part: 
CFR Title: 

Content:
a licensee’s adherence to the provisions of 10 CFR 73.54, “Protection of Digital Computer and Communication Systems and Networks,” (Ref. 7) will be evaluated per regulatory programs specific to that regulation and in accordance with the applicant's NRC-approved cyber security plan. IEEE Std. 1074-2006 is not endorsed in this regulatory guide as being appropriate for compliance with 10 CFR 73.54. There are other activities that have been added to the new IEEE Std. 1074-2006 version such as: A.1.2.9 “Plan Release Management,” A.1.3.6 “Close Project,” A.2.3 “Software Importation Activity Group” of activities, and A.3.3.4 “Manage Software Release,” which are all supported activities to this Regulatory Guide 1.173. Other alterations to the original have been made where the IEEE Std. 1074-1995, Clause 3.3, “Software Quality Management Process” was dropped from the 2006 version. The applicant and licensee should refer to Regulatory Guide 1.28 “Quality Assurance Program Criteria” (Ref. 8) for more information on this topic. The other process section, “Verification and Validation Process,” was removed from the IEEE Std. 1074-1995 version and transformed to a peer and/or technical review set of activities in the new Annex A.5.1, “Evaluation Activity Group.” In any lifecycle frame the developer should always provide review, audit, and test milestones for the software project. However, this does not alleviate the applicant or licensee from performing a formal software V&V, technical reviews, or audits to meet general quality and reliability requirements in GDC 1 or GDC 21, “Protection System Reliability and Testability,” of Appendix A to 10 CFR Part 50, as well as Criterion II, III, XI, and XVIII of Appendix B. Additional information and guidance for performing a software V&V can be found in Regulatory Guide 1.168 “Verification, Validation, Reviews and Audits for Digital Computers Software Used in Safety Systems of Nuclear Power