Document: NRC Regulatory Guide
Document ID: d6326081-f430-476d-8098-4edf00868dd9
Document Type: regulatory_guide
Title: Verification, Validation, Reviews, and Audits for Digital Computer Software Used in Safety Systems of Nuclear Power Plants + HISTORY - HISTORY 08/2012 – DG-1267 , Proposed Revision 2 01/2003 – DG-1123 , Proposed Revision 1 08/1996 – DG-1054 , Proposed Revision 0 (Rev. 2)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML1031/ML103160431.pdf
Revision Date: 2023-06
Chapter: 
Section ID: RG-1.168
CFR Part: 
CFR Title: 

Content:
to specific cyber security controls during the software development process and/or the inclusion of security features in or around digital safety systems. Specifically a licensee’s adherence to the provisions of 10 CFR 73.54, “Protection of Digital Computer and Communication Systems and Networks,” (Ref. 9) will be evaluated per regulatory programs specific to that regulation and in accordance with the applicant's NRC-approved cyber security plan. IEEE Std. 1012-2004 and 1028-2008 are not endorsed in this regulatory guide as being appropriate for compliance with 10 CFR 73.54. Related Guidance Industry standard IEEE Std. 7-4.3.2-2003, “IEEE Standard Criteria for Digital Computers in Safety Systems of Nuclear Power Generating Stations” (Ref. 10), which is endorsed by Regulatory Guide 1.152, “Criteria for Use of Computers in Safety Systems of Nuclear Power Plants” (Ref. 11), and Committee on Nuclear Quality Assurance of American Society of Mechanical Engineers (ASME/NQA) DG-1267, Page 5 standard ASME/NQA-1-2008, “Quality Assurance Requirements for Nuclear Facility Applications” (Ref. 12), describe general design verification processes, but does not detail software V&V planning and the conduct of reviews and audits. Two consensus standards on software engineering, IEEE Std. 1012-2004 and IEEE Std. 1028-2008, describe the software industry’s approaches to software V&V, review, and audit activities that are generally accepted in the software engineering community. Meeting these standards helps to meet regulatory requirements by ensuring that disciplined software V&V, review, and audit practices accepted within the software community will be incorporated into software processes applied to safety system software. IEEE Std. 1012-2004 describes the process of software V&V, including elements of software V&V plan (SVVP), and describes a minimum set of V&V activities for software at different integrity levels. IEEE Std. 1028-2008 is a process standard that