Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
increase the risk of security vulnerabilities and does not reduce the reliability of safety functions. 9.5.2 Development Activities (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.5.2) The developer should configure and enable the designed security features correctly. The developer should also test the system hardware architecture, external communication devices, and configurations for unauthorized pathways and system integrity. Attention should be focused on built-in OEM features. Appendix 7.1-D-24 March 2007 9.6 Installation, Checkout, and Acceptance Testing (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.6) In installation and checkout, the safety system is installed and tested in the target environment. The licensee should perform an acceptance review and test the safety system security features. The objective of installation and checkout security testing is to verify and validate the correctness of the safety physical and logical system security features in the target environment. 9.6.1 System Features (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.6.1) The licensee should ensure that the system features enable the licensee to perform post- installation testing of the system to verify and validate that the security requirements have been incorporated into the system appropriately. 9.6.2 Development Activities (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.6.2) The licensee should have a digital system security program. The security policies, standards, and procedures should ensure that installation of the digital system will not compromise the security of the digital system, other systems, or the plant. This may require the licensee to perform a security assessment, which includes a risk assessment, to identify the potential security vulnerabilities caused by installation of the digital system. The risk assessment should include an evaluation of new security constraints in the system; an assessment of the proposed