Document: NUREG-0800
Document ID: 6714076f-86e8-4770-bb1a-5fea3d3bc956
Document Type: srp
Title: CYBER SECURITY PLAN
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML1026/ML102630477.pdf
Revision Date: 2023-06
Chapter: 13
Section ID: 13.6.6
CFR Part: 
CFR Title: 

Content:
ure and Rogue Connections Verify that, during deployment of CDAs/CS, when changes or modifications have been made to CDAs/CS, and no less frequently than once every month, CDAs/CS are free of insecure (i.e., rogue) connections, such as vendor connections and modems. B.2.1 Audit and Accountability Policy and Procedures Develop, disseminate, and annually review and update the following while using an independent party for the audit reviews: • a formal, documented audit and accountability policy that addresses the purpose, scope, roles, responsibilities, management commitments, and internal coordination of the policy • a formal, documented procedure that facilitates the implementation of the audit and accountability policy and associated audit and accountability security controls 13.6.6-38 Revision 0 – November 2010 B.2.2 Auditable Events Review and update the list of defined auditable events no less frequently than once a year. B.2.5 Response to Audit Processing Failures CDAs provide a warning when the allocated audit record storage volume reaches a defined percentage of maximum audit record storage capacity, which is based on the function of how quickly storage capacity is consumed and the organization’s resources and response times (e.g., 60 to 70 percent of storage capacity). B.2.6 Audit Review, Analysis, and Reporting Review and analyze the CDA/CS audit records no less frequently than once every 30 days for indications of inappropriate or unusual activity and report findings to designated official. B.3.1 Critical Digital Asset/Critical System and Communications Protection Policy and Procedures Develop, disseminate, and annually review and update the following: • a formal, documented CDA/CS system and communications protection policy that addresses the purpose, scope, roles, responsibilities, management commitments, and internal coordination of the system • a formal, documented procedure that facilitates the implementation of the CDA/CS system and