IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) IAEA-NSS17-GradedApproach-SecurityLevels-Risk-DBT: IAEA NSS-17 - Graded Approach + Computer Security Levels + Risk-Informed Methodology + Threat Assessment + DBT Alignment + Consequence Analysis

NSS-17 + NSS-42-G adopt a graded approach with Computer Security Levels (CSLs) ranging from 1 (highest, applied to safety + security critical systems) to 5 (lowest, applied to general administrative systems). CSL assignment based on consequence analysis: potential adverse impact of compromise on nuclear safety + nuclear security + physical protection + emergency response + safeguards + safe operation + radiation protection. Risk-informed methodology: Threat Assessment evaluates capability + intent + opportunity of adversary; Vulnerability Assessment evaluates technical + procedural + physical weaknesses; Consequence Analysis evaluates impact on safety + security + radiological + financial + reputational + operational; Risk = Threat x Vulnerability x Consequence with treatment options. Design Basis Threat (DBT) alignment: facility cyber controls must address DBT scenarios issued by State Regulatory Body (insider + outsider + state-sponsored + organised crime + activist + script kiddie + cyber-physical hybrid attacks); DBT review periodicity (typically every 3-5 years + after significant change); operator computer security plan must defeat DBT-level attacks per CSL. Coordinates with NSS-10 Development Use and Maintenance of DBT + NSS-13 Recommendations Physical Protection + IAEA Safety Standards (SSG-39 Design of Instrumentation and Control Systems for Nuclear Power Plants + GSR Part 7 Emergency Preparedness). NSS-42-G expanded DBT methodology to include cyber + IT/OT + supply chain + insider threat. IAEA NSS-17 + Graded Approach + CSLs + Risk + DBT + Consequence Analysis applies.