Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
tential security vulnerabilities caused by installation of the digital system. The risk assessment should include an evaluation of new security constraints in the system; an assessment of the proposed system changes and their impact on system security; and an evaluation of operating procedures for correctness and usability. The results of this assessment should provide a technical basis for establishing certain security levels for the systems and the plant. 9.7 Operation Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.7) The operation lifecycle process involves the use of the safety system by the licensee in its intended operational environment. During the operations phase, the licensee should ensure that the system security is intact by techniques such as periodic testing and monitoring, review of system logs, and real-time monitoring where possible. The licensee should evaluate the impact of safety system changes in the operating environment on safety system security; assess the effect on safety system security of any proposed changes; evaluate operating procedures for compliance with the intended use; and analyze security risks affecting the licensee and the system. The licensee should evaluate new security constraints in the system; assess proposed system changes and their impact on system security; and evaluate operating procedures for correctness and usability. 9.8 Maintenance Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.8) The maintenance phase is activated when the licensee changes the system or associated documentation. These changes may be categorized as follows: • Modifications (i.e., corrective, adaptive, or perfective changes) • Migration (i.e., the movement of system to a new operational environment) Appendix 7.1-D-25 March 2007 • Replacement (i.e., the withdrawal of active support by the operation and maintenance organization, partial or total replacement by a new system, or installation of an upgraded