Document: NRC Regulatory Guide
Document ID: c6321e39-3d1b-40a6-ace3-8c6a0c54e2cd
Document Type: regulatory_guide
Title: Developing Software Life Cycle Processes for Digital Computer Software Used in Safety Systems of Nuclear Power Plants + HISTORY - HISTORY 08/2012 – DG-1210 , Proposed Revision 1 08/1996 – DG-1059 , Proposed Revision 0 (Rev. 1)
Source: NRC Regulatory Guide Division 1
Source URL: https://www.nrc.gov/docs/ML1031/ML103120727.pdf
Revision Date: 2023-06
Chapter: 
Section ID: RG-1.173
CFR Part: 
CFR Title: 

Content:
conforming Materials, Parts, or Components,” requires, in part, that measures are established to control materials, parts, or components that do not conform to requirements in order to prevent their inadvertent use or installation. • Criterion XVII, “Quality Assurance Records,” requires, in part, that sufficient records be maintained so that data that are closely associated with the qualification of personnel, procedures, and equipment are identifiable and retrievable. DG-1210, Page 4 Description of Change The original version of this regulatory guide endorsed IEEE Std. 1074-1995. With the refocus on the life-cycle planning activities, which is the initiation task in devising a software project life cycle, the IEEE Std. 1074-2006 version realigns the original set of planning activities in to one activity group and adds a new section called “Determine Security Objectives.” In response to this new section, the Regulatory Guide 1.173 has also added a new Subsection Part C, 1, d, “Secure Analysis,” and acknowledges that planning for security and confirming the security accreditations is necessary and part of a secure analysis. However, to meet criteria of IEEE Std. 603-1991 and 10 CFR 50, the development of digital safety system software requires a secure development and operational environment (SDOE) be provided, Regulatory Guide 1.152 provides specific guidance concerning the establishment of SDOEs. It should be noted that any material submitted in support of cyber security will not be reviewed as part of SDOE review. Applicants should be aware that other NRC requirements and guidance may lead to specific cyber security controls during the software development process and/or the inclusion of security features in or around digital safety systems; however, a licensee’s adherence to the provisions of 10 CFR 73.54, “Protection of Digital Computer and Communication Systems and Networks,” (Ref. 7) will be evaluated per regulatory programs specific to