NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity
Regulatory Guide 5.71 Appendix C Security Controls

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity RG5.71-C.6: Configuration Management

Licensees must maintain configuration management for critical digital assets throughout their lifecycle.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 245 controls across 107 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

IEC 62304:2015 Medical Device Software Lifecycle Processes · 5 controls

  • IEC62304-4.1 Quality Management System
  • IEC62304-5.1 Software Development Planning
  • IEC62304-5.2 Software Requirements Analysis
  • IEC62304-5.3 Software Architectural Design
  • IEC62304-7.2 Risk Control Measures

FedRAMP Rev 5 · 4 controls

  • FEDRAMP-CM-1 Configuration Management Policy
  • FEDRAMP-CM-2 Baseline Configuration
  • FEDRAMP-CM-6 Configuration Settings
  • FEDRAMP-CP-9 System Backup

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-04 User application hardening (Essential)
  • ASD37-10 Server application hardening (Very Good)
  • ASD37-11 Operating system hardening (Very Good)

Annex 11 to EU GMP - Computerised Systems · 3 controls

Automotive SPICE (ASPICE) v4.1 - Process Assessment Model · 3 controls

  • MLE.1 Machine Learning Requirements Analysis
  • MLE.3 Machine Learning Training
  • SUP.8 Configuration Management

BSI IT-Grundschutz · 3 controls

  • BSI-23 Baseline configuration establishment
  • BSI-24 Configuration change control
  • BSI-26 System component inventory

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 3 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management
  • RMD-1 Reference Data Management

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 3 controls

  • ISO-15189-5.1 Legal entity
  • ISO-15189-5.4 Structure and authority
  • ISO-15189-6.7 Service agreements

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 3 controls

  • ISO-19650-1-4 Information management concepts
  • ISO-19650-1-7 Common Data Environment (CDE) concept
  • ISO-19650-3-5.3 Trigger events for information exchange

ISO 22320:2018 · 3 controls

  • ISO-22320-5.1 General process requirements
  • ISO-22320-5.3 Incident management structure (command)
  • ISO-22320-5.4 Roles and responsibilities

ISO/IEC 23894:2023 · 3 controls

  • ISO23894-1 Scope of AI Risk Management
  • ISO23894-3 AI-Specific Terminology
  • ISO23894-6.2 Scope, Context and Criteria

ISO/IEC 27004:2016 · 3 controls

  • 27004-3 Terms and definitions
  • 27004-A.2 Patching and Vulnerability Measures
  • 27004-B.1 Example measurement definitions

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 3 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.2 Scope, context, and criteria for privacy

ISO/IEC 29100:2024 · 3 controls

  • 29100-1 Scope
  • 29100-3 Terms and definitions
  • 29100-4.1 Actors and roles

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
  • NIST-CSF-PR.PS-01 Configuration management practices are established and applied

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-190 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

Trinidad and Tobago Data Protection Act 2011 · 3 controls

  • TRINIDAD-1 Scope, Definitions, Commission
  • TRINIDAD-2 Lawful Processing and Consent
  • TRINIDAD-3 Data Subject Rights

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

  • 58.1 Scope
  • 58.3 Definitions

AICPA Privacy Management Framework (PMF) · 2 controls

API 1164 · 2 controls

  • API1164-14 Physical Security
  • API1164-22 Configuration management for OT systems

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-1.1 Security Policy and Governance
  • AWWA-4.3 Configuration Management

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-1 Scope and Definitions
  • AL-DPA-3 Lawful Basis for Processing

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 2 controls

  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

FFIEC IT Examination Handbook · 2 controls

  • FFIEC-05 Roles and responsibilities definition
  • FFIEC-10 Secure configuration standards

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-702 Definitions (§501.702)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

  • 60601-1.3 Terminology and definitions
  • 60601-1.4.1 General requirements

IEC 62443 · 2 controls

  • IEC62443-14 System security hardening
  • IEC62443-22 Configuration management for OT systems

ISO 20400:2017 - Sustainable Procurement · 2 controls

  • ISO-20400-4.2 Principles of sustainable procurement
  • ISO-20400-7.2 Integrating sustainability into specifications

ISO 26262:2018 - Functional Safety for Road Vehicles · 2 controls

  • ISO-26262-3-5 Item definition
  • ISO-26262-8-7 Configuration management

ISO 41001:2018 - Facility Management Systems · 2 controls

  • ISO-41001-4.1 Understanding the organization and its context
  • ISO-41001-4.3 Determining the scope of the FM management system

ISO 56002 · 2 controls

  • ISO-56002-4.3 Determining the scope of the innovation management system
  • ISO-56002-8.3.4 Develop solutions

ISO 8000 - Data Quality · 2 controls

  • ISO8000-DQM-02 Data Quality Dimensions
  • ISO8000-MDG-03 Continuous Improvement

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

  • ISO-17025-5.1 Legal entity
  • ISO-17025-5.4 Personnel for the management system

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

  • ISO-25012-5.2 Defining data quality measures
  • ISO-25012-5.3 Planning and performing data quality evaluations

ISO/IEC 27011:2024 · 2 controls

  • 27011-1 Scope
  • 27011-3 Terms and definitions

ISO/IEC 27014:2020 · 2 controls

  • 27014-1 Scope
  • 27014-3 Terms and definitions

ISO/IEC 27019:2024 · 2 controls

  • ISO27019-14 System security hardening
  • ISO27019-22 Configuration management for OT systems

ISO/IEC 27400:2022 · 2 controls

  • 27400-3 Terms and definitions
  • 27400-6.4 Default Configuration Security

ISO/IEC 29147:2018 · 2 controls

  • 29147-3 Terms and definitions
  • 29147-9.2 Contact mechanisms and scope

ISO/IEC 30111:2019 · 2 controls

  • 30111-3 Terms and definitions
  • 30111-5.1 Organizational policy

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST SP 1800-32 · 2 controls

Nebraska Data Privacy Act · 2 controls

  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation

PCI P2PE · 2 controls

  • PCI-P2PE-05 Roles and responsibilities definition
  • PCI-P2PE-10 Secure configuration standards

PCI PIN Security · 2 controls

  • PCI-PIN-05 Roles and responsibilities definition
  • PCI-PIN-10 Secure configuration standards

PCI SSF · 2 controls

  • PCI-SSF-05 Roles and responsibilities definition
  • PCI-SSF-10 Secure configuration standards

SANS Incident Handler's Handbook and PICERL Methodology · 2 controls

  • PICERL-P2 Risk Assessment
  • PICERL-P3 CSIRT Formation

SOC 2 · 2 controls

  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-CC7.4 CC7.4 Responding to security incidents

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

  • SSAE18-CC7.4 CC7.4 - Incident Response
  • SSAE18-PI1.1 PI1.1 - Processing Integrity Definition

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

South Korea ISMS-P · 2 controls

  • ISMSP-SYS-01 System Hardening and Patch Management
  • ISMSP-SYS-04 Vulnerability Management

Tanzania Personal Data Protection Act 2022 · 2 controls

  • TANZANIA-1 Scope, Registration, Lawful Basis
  • TANZANIA-4 Security and Cross-Border

UK Bribery Act 2010 · 2 controls

  • Section 6(5) Definition of Foreign Public Official
  • Section 8 Definition of Associated Person

UK Gambling Commission LCCP and Remote Technical Standards · 2 controls

  • UKGAMBLE-1 Scope and Applicability to Licensees
  • UKGAMBLE-4 Resilience and Incident Response

US SEC Digital Assets and Crypto Regulatory Framework · 2 controls

  • US-SEC-DA-SC-01 Howey Test Application
  • US-SEC-DA-SC-02 Registration Requirements

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

  • CFR211-A-3 Section 211.3 - Definitions

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.1 Operational Planning and Control

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.4.1 Resources, Roles, Responsibility, and Authority

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-2 Article 2 - Basic Concepts

Barbados Data Protection Act 2019 · 1 control

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

  • COBIT-BAI02 Managed requirements definition

Canada ITSG-33 - IT Security Risk Management · 1 control

  • CA-ITSG33-SC-01 Security Control Catalogue

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

DFARS 252.204-7012 - Safeguarding Covered Defense Information · 1 control

  • 7012(a) Definitions

FBI CJIS Security Policy · 1 control

  • CJIS-7 Configuration Management

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D3-3 Corrective controls

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

French Sapin II Law (Law No. 2016-1691) · 1 control

  • Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-1 Objectives, Powers and Responsibilities of the Supervisor

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-2 Glossary of terms

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

  • ISO-14064-1-5.1 Organizational boundaries

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PI-01 Personnel Security Screening

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-10 Configuration management

ISO/IEC 23837:2023 · 1 control

  • 23837-1.1 Scope

ISO/IEC 27003:2017 · 1 control

  • ISO27003-4.3 Determining the scope of the information security management system

ISO/IEC 27007:2020 · 1 control

  • 27007-5.2 Audit Programme Objectives

ISO/IEC 27031:2011 · 1 control

  • 27031-5.1 IRBC Policy

ISO/IEC 27043:2015 · 1 control

  • ISO27043-04 Roles and responsibilities definition

ISO/IEC 27050-1:2019 · 1 control

  • 27050-1.4 Terms and definitions

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-3 Terms and definitions

ISO/IEC 29134:2023 · 1 control

  • 29134-3 Terms and definitions

ISO/SAE 21434 · 1 control

  • ISO21434-04 Roles and responsibilities definition

ITIL 4 · 1 control

  • ITIL4-10 Configuration management

Illinois Biometric Information Privacy Act (BIPA) · 1 control

  • BIPA-SEC5-1 Biometric Identifier Definition

Kuwait National Cybersecurity Framework · 1 control

OWASP SAMM · 1 control

  • OWASPSAMM-1 Governance: Strategy, Policy, Compliance, Education, Champions

PCI DSS 4.0 · 1 control

  • 2.2.2 2.2.2 Vendor default accounts managed

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-1 Scope, Applicability, Definitions

SIG (Shared Assessments) · 1 control

  • SHAREASSESS-1 Information Governance and Risk

SLSA · 1 control

  • SUPCHAIN-1 Build Integrity - Source, Build, Provenance

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

  • CISABD-1 Take Ownership of Customer Security Outcomes

Singapore Cybersecurity Act 2018 · 1 control

  • SCA-S2 Interpretation and Definitions

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-RES.2 Disaster Recovery

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

  • KISO-1.3 Definitions

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 1 control

  • SWE-2 Relationship to GDPR

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

  • FADP-5 Definitions (Article 5)

UK GDPR (UK General Data Protection Regulation) · 1 control

  • UKGDPRREG-1 Subject Matter, Scope, Principles (Articles 1-11)

UK Open Banking Standard · 1 control

  • OB-OPS.2 Performance Standards

UK Telecommunications (Security) Act 2021 · 1 control

  • UK-TSA-NET-01 Security Architecture

US Foreign Corrupt Practices Act (FCPA) · 1 control

  • 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern

WCAG 2.2 · 1 control

  • WCAGREC-3 Principle 3: Understandable

WHO Global Strategy on Digital Health 2020-2025 · 1 control

  • SO2.2 Digital health architecture blueprint

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Regulatory Guide 5.71 Appendix C Security Controls

Query this from an agent

The graph holds this control, the 245 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity controls