# CS Measures for Nuclear Power Plant Protection: A Systematic Literature Review
## 1 Introduction  
The digitalization of many of today's Critical Infrastructure (CI) sectors has been extended to nuclear power plants (NPPs). The main control rooms of NPPs have integrated new digitalized human-system interfaces to facilitate the previously paper-based work and analog controls used by personnel [1]. Nonetheless, the digitalization of Instrumentation and Control (I&C) systems and the adoption of open-system architectures have escalated the threat of cyber attacks into a serious CS issue [2]. One of the most well-known cyber attacks against NPPs in the last decade is the cyber warfare weapon known as Stuxnet [3]. According to reports, hundred of thousands of computers in multiple countries were affected by this worm attack, with 58% of the infected systems being located in Iran [4]. Stuxnet used intermediary devices, such as USB sticks, to gain access to the victim systems. It has been reported that almost one-fifth of Iran's nuclear centrifuges have been damaged by the attack [5]. To tackle cyber threats affecting NPPs and to prevent attacks similar to Stuxnet from happening, safety regulations and standards have been published for digital safety system development and protection [6] in order to be used to protect NPPs' Critical Digital Assets (CDAs), which are the assets that are fundamental to the functioning of the nuclear plant and, therefore, are most sensitive to cyber attacks [7]. An example of a CS plan and related activities for NPP protection is shown in Figure 1.  
The United States Nuclear Regulatory Commission (USNRC) has published various regulatory guidelines and specific guides for the design and construction of nuclear plant facilities that are internationally referenced. CS risk assessment practices involving system, asset, threat, vulnerability risk analysis, and intrusion tests [8, 9] to reduce the number of vulnerabilities and potential damage have also been developed and proposed. The definition of standards and policies and the installation of security software alone are often not sufficient to ensure the security of nuclear facilities, or of any other critical infrastructure. In fact, many of the recent CS incidents were linked to human carelessness and unpreparedness of the personnel in detecting and preventing cyber attacks. A great deal of research has been done to demonstrate the correlation between systems' security and the human factor. The authors of [10] showed in their study how a number of personality traits and attitudinal predispositions, such as impulsiveness, can affect an individual's ability in CS assurance. It was suggested by the authors that to address this issue, focused training that accounts for the human attributes should be given to personnel. The authors of [11] highlighted the importance of effective communication among individuals in attaining safety and security in an NPP. To achieve this, they suggested using an integrated training approach based on consultation with experts in each relevant discipline on a continuous basis. All of these procedures and others that will be discussed in this work are defined herein as _CS measures_ for NPP safety and security, meaning any type of method or instrument that has been developed and applied for NPP CS. Specifically, these measures include all types of CS procedures, tools, or other instrumentation, such as Intrusion Detection and Protection Systems (IDPSs), CS awareness and training campaigns, and any other type of solution used for CS assurance in NPPs. Unfortunately, the lack of a comprehensive analyses and evaluations of current measures for NPP CS presents a challenge in the development of an effective and comprehensive CS framework. Additionally, current research focused on surveying the literature on solutions for NPP CS is noted to have proved very limited information on the attributes of each proposal. For this reason, in this work, we will be describing all of the CS measures proposed in the literature for NPP protection based on their characteristics.