Nuclear Plant Cybersecurity Under 10 CFR 73.54: The Engineering Requirements

NRC 10 CFR 73.54 — the rule on protection of digital computer and communication systems and networks — requires nuclear power plant licensees to submit a Cyber Security Plan and implement it under NRC oversight. The rule's core requirement: Critical Digital Assets (CDAs) associated with safety, security, and emergency preparedness functions must be protected from cyber attack, and a defined set of defensive architecture measures must be in place. The separation architecture — requiring that safety systems have no communication pathway to non-safety networks — is not a recommendation. It is a regulatory requirement with no variance process. What the NRC's inspectors examine during periodic assessments is whether the defensive architecture has been maintained as CDAs change, vendors are updated, and systems are modified.

Facing This?