NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity NRC7354-4: Security Controls Implementation per NRC RG 5.71 Appendix B/C

Implement security controls per 10 CFR 73.54(c) consistent with NRC Regulatory Guide 5.71 Appendix B (Technical and Operational Cyber Security Controls) + Appendix C (Cyber Security Programme Controls). Technical controls per Appendix B cover (a) access control including unique identification + authentication + authorisation + concurrent session control + remote access + wireless restrictions + portable and mobile device controls, (b) audit and accountability including event types + content + storage + reporting + analysis + retention, (c) configuration management including baselines + least functionality + change control + verification, (d) system and information integrity including malicious code protection + monitoring + spam protection + flaw remediation + integrity verification, (e) defence-in-depth including boundary protection + isolation + monitoring at boundaries + protection from cyber-attacks during processing + transmission + storage, (f) maintenance including controlled maintenance + maintenance personnel + remote maintenance + diagnostic tools. Programme controls per Appendix C cover policy + procedures + roles and responsibilities + training and awareness + system security planning + security assessment + incident response + system and services acquisition + supply chain + risk assessment + contingency planning + safeguards. NRC RG 5.71 Appendix B contains approximately 145 control objectives + Appendix C contains 30 programmatic control objectives. Mapping evidence to RG 5.71 controls is the primary basis for NRC inspection findings.