US NRC 10 CFR 73.54 - Cyber Security for Nuclear Power Plants
Defense in Depth

US NRC 10 CFR 73.54 - Cyber Security for Nuclear Power Plants USNRCCYBER-4: Defense-in-Depth and Technical Controls

Per 10 CFR 73.54 + NRC Regulatory Guide 5.71: defense-in-depth + access control + monitoring + boundary controls + integrity protection.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 12 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • HKMA-CRAF-Domain3-4-Protection-Detection HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel
  • HKMA-CRAF-Domain5-6-Response-Recovery-SitAwareness HKMA C-RAF Domain 5 (Response and Recovery) + Domain 6 (Situational Awareness) - Incident Response, Recovery, Threat Landscape, Information Sharing

FISMA · 1 control

  • FISMA-NIST-800-53-RMF-800-171-FIPS Operationalisation via NIST 800-53 + 800-37 RMF + 800-171 + FIPS 199 + FIPS 200
  • GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics

ISO/IEC 27011:2024 · 1 control

  • 27011-5.4 Threat intelligence for telecom

ISO/IEC 27400:2022 · 1 control

  • 27400-5.1 IoT Security and Privacy Governance
  • JP-FSA-CYB-Security-Monitoring-SOC-Operations-SIEM-EDR-MDR-XDR-24x7-Detection-Alert-Triage Japan FSA Cybersecurity Security Monitoring + SOC 24x7 Operations + SIEM + EDR + MDR + XDR + Detection + Alert Triage + Threat Hunting + Incident Response Integration + Threat Intelligence Integration + UEBA
  • NATO-NCIRC-4 Cyber Threat Intelligence Sharing and Coordinated Vulnerability Disclosure
  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

OWASP Top 10:2025 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 12 it maps to, and the evidence behind each claim, over MCP and REST.