UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities
SyDP 7.2 Information security – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities 7.2-ICC: Identification of classified contracts

Dutyholders remain responsible for SNI at all times, including when services are outsourced on their own sites or on third-party premises and systems. A mechanism identifies whether SNI will be transferred to or generated by a third party under a contract, ideally early in a secure by design process for projects, and assesses each contract's inherent risk (for example with ONR's Inherent Risk Profile Questionnaire, used by the List N Portal). The 'concentration of risk' principle scopes which facilities fall under routine ONR attention, with ONR informed and a list kept of facilities below the threshold. Bidders are alerted that a contract involves SNI (Cabinet Office contractual process), procurement teams are trained, third parties receive SNI handling and incident reporting documentation through a security aspects letter and an inaugural meeting, and a central, independently reviewed register of contracts and subcontracts involving SNI is kept.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in SyDP 7.2 Information security – UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll UK ONR Cyber Security and Information Assurance (CSIA) for Nuclear Facilities controls