Document: NUREG-0800
Document ID: f1629507-6318-4e71-94a6-9d6664ba96a3
Document Type: srp
Title: of the plant safety analysis report (SAR).  Although NRC did not endorse the annexes of
Source: NUREG-0800
Source URL: https://www.nrc.gov/docs/ML0706/ML070660327.pdf
Revision Date: 2023-06
Chapter: 7
Section ID: 7.6
CFR Part: 
CFR Title: 

Content:
many operating systems, machine code, and callable library function aspects of the system may not be able to be successfully scanned and are just as likely to be where avenues for exploitation exist. COTS systems are likely to be proprietary and generally unavailable for review. It is likely that there is no reliable method to determine security vulnerabilities for Operating systems (for example, Microsoft and other operating system suppliers do not provide access to the source code for operating systems and callable code libraries). In such cases, unless such systems are modified by the application developer, the security effort should be limited to ensuring that the features within the system do not compromise the security requirements of the system, and the security functions should not be compromised by the other system functions. 9.5 Test Phase (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.5) The objective of testing security functions is to ensure that the system security requirements are validated by execution of integration, system, and acceptance tests where practical and necessary. Testing includes system hardware configuration (including all external connectivity), software integration testing, software qualification testing, system integration testing, system qualification testing, and system factory acceptance testing. 9.5.1 System Features (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.5.1) The security requirements and configuration items are part of validation of the overall system requirements and design configuration items. Therefore, security design configuration items are just one element of the overall system validation. Each system security feature should be validated to verify that the implemented system does not increase the risk of security vulnerabilities and does not reduce the reliability of safety functions. 9.5.2 Development Activities (Regulatory Guide 1.152, Revision 2, Regulatory Position 2.5.2) The