Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
controls are required to protect CDAs from cyber attack, • verify that existing security controls are functioning properly and are effective at protecting CDAs from cyber attack, and • facilitate corrective action of any gaps discovered in the security program. 13.6.6-26 Revision 0 – November 2010 A.4.1.3 Vulnerability Assessments & Scans As required by 10 CFR 73.54(b)(2) and 10 CFR 73.54(d)(2), the licensee must maintain the cyber security program and evaluate and manage cyber risks. The CSP states the following: • The licensee will conduct vulnerability scans or assessments, identify deficiencies, and resolve the deficiencies. The frequency of the scans and assessments is at least once each quarter. Refer to RG 5.71, Appendices B and C, for frequency for specific controls. • The CST will perform vulnerability scans or assessments when new vulnerabilities that could potentially affect the effectiveness of the controls are identified. • The CST will employ up-to-date vulnerability scanning tools and techniques. • The CST will evaluate scan and assessment reports and address vulnerabilities that could adversely impact SSEP functions. • The CST will share scanning and assessment information with appropriate personnel to ensure that vulnerabilities that may affect similar or inter- connected CDAs or impact the effectiveness of the CDA functions or the SSEP functions or both are understood, evaluated, and mitigated. 13.6.6-27 Revision 0 – November 2010 • The CST will ensure that the assessment and scanning does not adversely impact SSEP functions. If an impact is detected, the CDA will be removed from service or replicated before assessment and scanning is conducted. • If the Licensee/Applicant cannot conduct vulnerability assessments or scanning on a production CDA because of the potential for an adverse impact on SSEP functions, alternate controls (e.g., providing a replicated system or CDA to conduct scanning) will be employed. 13.6.6-28