Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
meet licensee’s security requirements in the systems, (2) developing the systems that do not contain undocumented codes (e.g., back door coding, logic and/or time bomb codes) and that are resilient against malicious programs (e.g., viruses, worms, and Trojan horses), and (3) installing and maintaining those systems in accordance with the station administrative procedures and the licensee’s security program. Appendix 7.1-D-21 March 2007 Regulatory Position 2 of Regulatory Guide 1.152, Revision 2, presents the waterfall lifecycle phases as a framework for describing specific digital safety system security guidance. The digital safety system development process should address potential security vulnerabilities in each phase of the digital safety system lifecycle. The waterfall lifecycle consists of the following phases: • Concepts • Requirements • Design • Implementation • Test • Installation, Checkout, and Acceptance Testing • Operation • Maintenance • Retirement. The lifecycle phase-specific security requirements should be commensurate with the risk and magnitude of the harm resulting from unauthorized and inappropriate access, use, disclosure, disruption, or destruction of the digital safety system. Regulatory Positions 2.1 – 2.9 describe digital safety system security guidance for the individual phases of the lifecycle. 9.1 Concepts Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.1) In the concepts phase, the licensee and developer should identify safety system security capabilities that should be implemented. The licensee and developer should perform security assessment to identify potential security vulnerabilities in the relevant phases of the system life cycle. The results of the analysis should be used to establish security requirements for the system (hardware and software). Remote access to the safety system should not be implemented. Computer-based safety systems may transfer data to other systems through one-way