Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
listings of security controls with time associations. Reviewers can use these for comparison with the frequencies in the CSPs being reviewed. 13.6.6-7 Revision 0 – November 2010 Table 1 - Acceptance Review Checklist for Cyber Security Plan Evaluation Format and Content Guide Requirement Acceptance Criteria Accept Accept with RAI Reject RG 5.71 Introduction A.1 As required by 10 CFR 73.54(e) and 10 CFR 73.55(c)(6), licensees and applicant/licensees must establish, implement, and maintain a cyber security program for each site to protect digital computer and communication systems and networks from cyber attacks, up to and including the DBT described in 10 CFR 73.1. Licensees and applicants must establish, implement, and maintain a cyber security program for each site. Licensees and applicants may comply with the requirements of 10 CFR 73.54 by implementing the guidance in RG 5.71. A.2 Cyber Security Plan A.2.1 Scope and Purpose Required by 10 CFR 73.54(e), this plan describes how licensees and applicant/licensees will establish a cyber security program to achieve high assurance that digital systems, networks, and communication systems are protected. The CSP describes the following: • implementation and documentation of the “baseline” security controls, as described in Regulatory Position C.3.3 of RG 5.71 • implementation and documentation that the cyber security program employs a life-cycle approach to maintain security controls, as described in Section Regulatory Position C.4. of RG 5.71. 13.6.6-8 Revision 0 – November 2010 A.2.2 Performance-Based Requirements A licensee must establish, implement, and maintain the CSP, as required by 10 CFR 73.55(e). As required by 10 CFR 73.54(b)(3), cyber security is a component of the physical protection program. The CSP establishes how digital computer and communication systems and networks within the scope of 10 CFR 73.54 will be adequately protected from cyber attacks up to and including the DBT. A.3 Cyber Security