United StatesNRC protection of digital computer and communication systems and networks at nuclear power plants
NRC cyber security requirements for nuclear power plants, 10 CFR 73.54
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a licensee licensed to operate a nuclear power plant under part 50 of 10 CFR, or an applicant for an operating or combined license who is required to include a cyber security plan. Declare operates_essential_service where that holds; the Commission licenses these plants as critical infrastructure and no role names a nuclear licensee more closely.
- Submit a cyber security plan that satisfies section 73.54 for Commission review and approval, with a proposed implementation schedule, and implement your cyber security program consistent with the approved schedule.
- Provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat.
- Protect the digital computer and communication systems and networks associated with safety-related and important-to-safety functions, security functions, emergency preparedness functions, and the support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.
- Establish, implement, and maintain a cyber security program as a component of the physical protection program, designed to implement security controls, apply defense-in-depth protective strategies to detect, respond to, and recover from cyber attacks, and mitigate their adverse effects.
- Conduct cyber security event notifications in accordance with section 73.77, include measures for incident response and recovery for cyber attacks in the cyber security plan, and retain records until the Commission terminates the license for which they were developed.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each licensee currently licensed to operate a nuclear power plant under part 50 had to submit a cyber security plan that satisfies the section for Commission review and approval by . Each licensee subject to the section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat.
The licensee shall protect digital computer and communication systems and networks associated with safety-related and important-to-safety functions, security functions, emergency preparedness functions, and support systems and equipment which, if compromised, would adversely impact those functions. The licensee shall establish, implement, and maintain a cyber security program for the protection of the identified assets and incorporate it as a component of the physical protection program.
The cyber security program must be designed to implement security controls and apply and maintain defense-in-depth protective strategies to ensure the capability to detect, respond to, and recover from cyber attacks. As part of the cyber security program, the licensee shall conduct cyber security event notifications in accordance with the provisions of section 73.77. The cyber security plan must include measures for incident response and recovery for cyber attacks. The Nuclear Regulatory Commission's power reactor security final rule is effective on .
When LexLint raises it
When your app profile says your app runs an essential service.