United StatesNRC cyber security event notifications by nuclear power plant licensees
NRC cyber security event notifications, 10 CFR 73.77
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a licensee subject to the cyber security requirements of 10 CFR 73.54, meaning a licensee of a nuclear power plant under part 50 or 52. Declare operates_essential_service where that holds; the Commission licenses these plants as critical infrastructure and no role names a nuclear licensee more closely.
- Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyber attack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
- Notify the NRC Headquarters Operations Center within four hours after discovery of a cyber attack that could have caused such an adverse impact, after discovery of a suspected or actual cyber attack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
- Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyber attack against the systems in scope.
- Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each licensee subject to the provisions of section 73.54 shall notify the NRC Headquarters Operations Center via the Emergency Notification System.
Notification is due within one hour after discovery of a cyber attack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions, or that compromised support systems and equipment resulting in adverse impacts to safety, security, or emergency preparedness functions within the scope of section 73.54.
Notification is due within four hours after discovery of a cyber attack that could have caused an adverse impact to safety-related or important-to-safety functions, security functions, or emergency preparedness functions. Notification is due within four hours after discovery of a suspected or actual cyber attack initiated by personnel with physical or electronic access to digital computer and communication systems and networks within the scope of section 73.54.
Notification is due within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyber attack. The licensee shall use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in its cyber security program within twenty-four hours of their discovery.
The Nuclear Regulatory Commission's cyber security event notification rule is effective . Compliance with the rule was required by for those licensed to operate under parts 50 and 52 of title 10 of the Code of Federal Regulations and subject to section 73.54.
When LexLint raises it
When your app profile says your app runs an essential service.