POWER April 2014 - 45

NUCLEAR POWER
Table 1. System development life cycle phases. Source: Luminant
10 CFR 73.54 10 CFR 50/52 Concept phase
The second appendix shows the practiSafety,
security, and emergency preparedness functions,
external communications, physical locations
determined
Engage cybersecurity subject matter expert (SME) and
obtain review/approval in each phase
Conceptual design document addresses security
requirements
Requirements phase Requirements specified (cyber SME approves security
requirements)
Vendor-specific security requirements
Bid review, approval, and issuance of purchase order
Design phase
Review of vendor security program and implementation
Review of design to ensure security requirements are
satisfied
Preliminary cybersecurity assessment
Implementation,
integration, and test
phase
Site installation and
site acceptance test
phase
Review/approval of security test plans and procedures
Satisfactory performance of factory acceptance testing,
including security validations
Cybersecurity assessment approved (pre-installation)
Review/approve test plans and procedures
Satisfactory performance of site acceptance test
(security control validation)
Cybersecurity assessment finalized (validation documentation)
Operations
and
maintenance phase
Ongoing monitoring and assessment
Revalidation of security controls
Monitor and address new vulnerabilities
Retirement phase Sanitize old equipment
Disposition documentation per retention requirements
ter expert (SME) on required functions and
cybersecurity features for the modification
(Figure 1). Once the functions are defined,
the design engineer and cybersecurity SME
can determine the regulatory scope and treatment
for the modification.
Once the regulatory scope is determined for
NRC-regulated critical digital assets, the procedure
contains instructions for completing a
cybersecurity controls checklist to facilitate
addressing the cybersecurity controls provided
in Nuclear Energy Institute (NEI) 08-09 Revision
6, Appendix D (Technical Controls) and
Appendix E (Operational and Management
Controls) for the system development life
cycle. (Note that NEI 08-09, Cyber Security
Plan for Nuclear Power Reactors, is the U.S.
nuclear industry document developed to assist
licensees in constructing and implementing
their Cyber Security Plan license submittal
as required by 10 CFR 73.54.) The checklist
provides entry cells for various pieces of data,
including:
■ Life-cycle guidance for the requirements,
design, and post-design phases: This
column contains specific guidance for
April 2014 | POWER
addressing cybersecurity control for certain
life-cycle phases. For example, some
cybersecurity controls, such as network
scanning, cannot be implemented directly
into the design but take place in the operation
and maintenance (O&M) phase.
■ Requirements/specification references: A
brief summary of the analysis addressing
the cybersecurity control in the requirements
life-cycle phase would be recorded
in this column by the digital design engineer,
along with requirements document
references supporting the summary.
■ Design references: A brief summary of
the analysis addressing the cybersecurity
control in the design life-cycle phase is recorded
in this column by the digital design
engineer, along with design document references
supporting the summary.
■ Test references: A brief summary of the
analysis addressing the cybersecurity control
in the testing or post-design life-cycle
phases is recorded in this column by the
digital design engineer, along with testing
(factory acceptance test, site acceptance
test, and so on) document references supporting
the summary.
www.powermag.com
cal application of the procedures, using four
examples drawn directly from actual plant
modifications and reflecting real-life techniques
that plant personnel would use on
their equipment. The examples encompass
a digital protective motor relay, a safetyrelated
digital sequencer, a digital radiation
monitoring system, and a turbine-generator
digital controls system. The online version of
this article includes a downloadable file that
provides a portion of the completed cybersecurity
controls checklist that Luminant completed
for the digital protective motor relay.
EPRI also has developed a computerbased
training module to train engineers
working on modifications involving digital
upgrades. Comanche Peak and several other
nuclear plants have used this module to support
cybersecurity training.
Improving Clarity
EPRI Report 1019187 also simplifies
implementation of the security controls
contained in NEI 08-09, Revision 6. Previously,
there had been no guidance to help
interpret the 600-plus requirements mentioned
in the document, which cover areas
such as procurement, contracts, vendor design,
and in-house environments. Lacking
guidance, some licensees had even postponed
digital upgrades.
The EPRI guidance provides clear, specific
requirements for critical digital assets
so nuclear plant owners can target only those
that pertain to them and the specific plant
change they are making. It also helps vendors
understand what each requirement stipulates.
The clarity will help avoid technical misunderstandings
and associated costs during subsequent
design life-cycle phases.
For example, the requirements phase of the
system development life cycle includes the
following specific guidance for cybersecurity
review activities as part of the design engineer
review of vendor/contractor proposals/
response to the procurement specification:
■ Cybersecurity attributes for the digital
modification provided in the procurement
specification shall be addressed and documented
by the design engineer.
■ The cybersecurity SME (cybersecurity
specialist) reviews and signs off on the
vendor response to the procurement specification.
■
The design engineer shall ensure that all
vendor deviations/exceptions to requirements
are addressed for security impact.
The cybersecurity SME reviews and approves
all vendor-proposed alternate controls.
The cybersecurity SME shall identify
where alternate controls will be used for
45
http://www.powermag.com

POWER April 2014

Table of Contents for the Digital Edition of POWER April 2014

Contents
POWER April 2014 - Cover1
POWER April 2014 - Cover2
POWER April 2014 - Contents
POWER April 2014 - 2
POWER April 2014 - 3
POWER April 2014 - 4
POWER April 2014 - 5
POWER April 2014 - 6
POWER April 2014 - 7
POWER April 2014 - 8
POWER April 2014 - 9
POWER April 2014 - 10
POWER April 2014 - 11
POWER April 2014 - 12
POWER April 2014 - 13
POWER April 2014 - 14
POWER April 2014 - 15
POWER April 2014 - 16
POWER April 2014 - 17
POWER April 2014 - 18
POWER April 2014 - 19
POWER April 2014 - 20
POWER April 2014 - 21
POWER April 2014 - 22
POWER April 2014 - 23
POWER April 2014 - 24
POWER April 2014 - 25
POWER April 2014 - 26
POWER April 2014 - 27
POWER April 2014 - 28
POWER April 2014 - 29
POWER April 2014 - 30
POWER April 2014 - 31
POWER April 2014 - 32
POWER April 2014 - 33
POWER April 2014 - 34
POWER April 2014 - 35
POWER April 2014 - 36
POWER April 2014 - 37
POWER April 2014 - 38
POWER April 2014 - 39
POWER April 2014 - 40
POWER April 2014 - 41
POWER April 2014 - 42
POWER April 2014 - 43
POWER April 2014 - 44
POWER April 2014 - 45
POWER April 2014 - 46
POWER April 2014 - 47
POWER April 2014 - 48
POWER April 2014 - 49
POWER April 2014 - 50
POWER April 2014 - 51
POWER April 2014 - 52
POWER April 2014 - 53
POWER April 2014 - 54
POWER April 2014 - 55
POWER April 2014 - 56
POWER April 2014 - 57
POWER April 2014 - 58
POWER April 2014 - 59
POWER April 2014 - 60
POWER April 2014 - 61
POWER April 2014 - 62
POWER April 2014 - 63
POWER April 2014 - 64
POWER April 2014 - 65
POWER April 2014 - 66
POWER April 2014 - 67
POWER April 2014 - 68
POWER April 2014 - 69
POWER April 2014 - 70
POWER April 2014 - 71
POWER April 2014 - 72
POWER April 2014 - 73
POWER April 2014 - 74
POWER April 2014 - 75
POWER April 2014 - 76
POWER April 2014 - 77
POWER April 2014 - 78
POWER April 2014 - 79
POWER April 2014 - 80
POWER April 2014 - 81
POWER April 2014 - 82
POWER April 2014 - 83
POWER April 2014 - 84
POWER April 2014 - 85
POWER April 2014 - 86
POWER April 2014 - 87
POWER April 2014 - 88
POWER April 2014 - 89
POWER April 2014 - 90
POWER April 2014 - 91
POWER April 2014 - 92
POWER April 2014 - Cover3
POWER April 2014 - Cover4
https://www.nxtbook.com/accessintelligence/POWER/pwr_march-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_february-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_january-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_december-2023
https://www.nxtbook.com/accessintelligence/POWER/pwr_november-2023
https://www.nxtbook.com/accessintelligence/POWER/power-october-2023
https://www.nxtbook.com/accessintelligence/POWER/re-tech-supp-to-power-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-and-re-tech-supp-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-august-2023
https://www.nxtbook.com/accessintelligence/POWER/power-july-2023
https://www.nxtbook.com/accessintelligence/POWER/power-june-2023
https://www.nxtbook.com/accessintelligence/POWER/power-may-2023
https://www.nxtbook.com/accessintelligence/POWER/power-april-2023
https://www.nxtbook.com/accessintelligence/POWER/power-march-2023
https://www.nxtbook.com/accessintelligence/POWER/power-february-2023
https://www.nxtbook.com/accessintelligence/POWER/power-january-2023
https://www.nxtbook.com/accessintelligence/POWER/power-december-2022
https://www.nxtbook.com/accessintelligence/POWER/power-november-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-October-2022-140th-Anniversary-Supp
https://www.nxtbook.com/accessintelligence/POWER/Power-October-2022-and-Anniversary-Supp
https://www.nxtbook.com/accessintelligence/POWER/power-and-re-tech-supp-september-2022
https://www.nxtbook.com/accessintelligence/POWER/power-september-2022
https://www.nxtbook.com/accessintelligence/POWER/power-august-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-July-2022-Intl
https://www.nxtbook.com/accessintelligence/POWER/power-july-2022
https://www.nxtbook.com/accessintelligence/POWER/power-june-2022-intl
https://www.nxtbook.com/accessintelligence/POWER/power-june-2022
https://www.nxtbook.com/accessintelligence/POWER/power-may-2022
https://www.nxtbook.com/accessintelligence/POWER/power-may-2022-intl
https://www.nxtbook.com/accessintelligence/POWER/power-april-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-April-2022-Intl
https://www.nxtbook.com/accessintelligence/POWER/power-march-2022
https://www.nxtbook.com/accessintelligence/POWER/power-february-2022
https://www.nxtbook.com/accessintelligence/POWER/power-january-2022
https://www.nxtbook.com/accessintelligence/POWER/power-december-2021
https://www.nxtbook.com/accessintelligence/POWER/power-top-plants-supp-december-2021
https://www.nxtbook.com/accessintelligence/POWER/power-november-2021
https://www.nxtbook.com/accessintelligence/POWER/power-october-2021
https://www.nxtbook.com/accessintelligence/POWER/power-september-2021
https://www.nxtbook.com/accessintelligence/POWER/power-august-2021
https://www.nxtbook.com/accessintelligence/POWER/power-july-2021
https://www.nxtbook.com/accessintelligence/POWER/power-june-2021
https://www.nxtbook.com/accessintelligence/POWER/power-may-2021
https://www.nxtbook.com/accessintelligence/POWER/power-april-2021
https://www.nxtbook.com/accessintelligence/POWER/power-march-2021
https://www.nxtbook.com/accessintelligence/POWER/power-february-2021
https://www.nxtbook.com/accessintelligence/POWER/power-january-2021
https://www.nxtbook.com/accessintelligence/POWER/power-december-2020
https://www.nxtbook.com/accessintelligence/POWER/power-november-2020
https://www.nxtbook.com/accessintelligence/POWER/power-october-2020
https://www.nxtbook.com/accessintelligence/POWER/power-september-2020
https://www.nxtbook.com/accessintelligence/POWER/power-august-2020
https://www.nxtbook.com/accessintelligence/POWER/power-july-2020
https://www.nxtbook.com/accessintelligence/POWER/power-june-2020
https://www.nxtbook.com/accessintelligence/POWER/power-may-2020
https://www.nxtbook.com/accessintelligence/POWER/power-april-2020
https://www.nxtbook.com/accessintelligence/POWER/power-march-2020
https://www.nxtbook.com/accessintelligence/POWER/power-february-2020
https://www.nxtbook.com/accessintelligence/POWER/power-january-2020
https://www.nxtbook.com/accessintelligence/POWER/power-december-2019
https://www.nxtbook.com/accessintelligence/POWER/power-november-2019
https://www.nxtbook.com/accessintelligence/POWER/power-october-2019
https://www.nxtbook.com/accessintelligence/POWER/power-september-2019
https://www.nxtbook.com/accessintelligence/POWER/power-august-2019
https://www.nxtbook.com/accessintelligence/POWER/power-july-2019
https://www.nxtbook.com/accessintelligence/POWER/power-june-2019
https://www.nxtbook.com/accessintelligence/POWER/power-may-2019
https://www.nxtbook.com/accessintelligence/POWER/power-april-2019
https://www.nxtbook.com/accessintelligence/POWER/power-march-2019
https://www.nxtbook.com/accessintelligence/POWER/power-february-2019
https://www.nxtbook.com/accessintelligence/POWER/power-january-2019
https://www.nxtbook.com/accessintelligence/POWER/power-december-2018
https://www.nxtbook.com/accessintelligence/POWER/power-november-2018
https://www.nxtbook.com/accessintelligence/POWER/power-october-2018
https://www.nxtbook.com/accessintelligence/POWER/power-september-2018
https://www.nxtbook.com/accessintelligence/POWER/power-august-2018
https://www.nxtbook.com/accessintelligence/POWER/power-july-2018
https://www.nxtbook.com/accessintelligence/POWER/power-june-2018
https://www.nxtbook.com/accessintelligence/POWER/power-may-2018
https://www.nxtbook.com/accessintelligence/POWER/power-april-2018
https://www.nxtbook.com/accessintelligence/POWER/power-march-2018
https://www.nxtbook.com/accessintelligence/POWER/power-february-2018
https://www.nxtbook.com/accessintelligence/POWER/power-january-2018
https://www.nxtbook.com/accessintelligence/POWER/power-december-2017
https://www.nxtbook.com/accessintelligence/POWER/power-november-2017
https://www.nxtbook.com/accessintelligence/POWER/power-october-2017
https://www.nxtbook.com/accessintelligence/POWER/power-september-2017
https://www.nxtbook.com/accessintelligence/POWER/power-august-2017
https://www.nxtbook.com/accessintelligence/POWER/power-july-2017
https://www.nxtbook.com/accessintelligence/POWER/power-june-2017
https://www.nxtbook.com/accessintelligence/POWER/power-may-2017
https://www.nxtbook.com/accessintelligence/POWER/power-april-2017
https://www.nxtbook.com/accessintelligence/POWER/power-march-2017
https://www.nxtbook.com/accessintelligence/POWER/power-february-2017
https://www.nxtbook.com/accessintelligence/POWER/power-january-2017
https://www.nxtbook.com/accessintelligence/POWER/power-december-2016
https://www.nxtbook.com/accessintelligence/POWER/power-november-2016
https://www.nxtbook.com/accessintelligence/POWER/power-october-2016
https://www.nxtbook.com/accessintelligence/POWER/power-september-2016
https://www.nxtbook.com/accessintelligence/POWER/power-august-2016
https://www.nxtbook.com/accessintelligence/POWER/power-july-2016
https://www.nxtbook.com/accessintelligence/POWER/power-june-2016
https://www.nxtbook.com/accessintelligence/POWER/power-may-2016
https://www.nxtbook.com/accessintelligence/POWER/power-april-2016
https://www.nxtbook.com/accessintelligence/POWER/power-march-2016
https://www.nxtbook.com/accessintelligence/POWER/power-february-2016
https://www.nxtbook.com/accessintelligence/POWER/power-january-2016
https://www.nxtbook.com/accessintelligence/POWER/power-december-2015
https://www.nxtbook.com/accessintelligence/POWER/power-november-2015
https://www.nxtbook.com/accessintelligence/POWER/power-october-2015
https://www.nxtbook.com/accessintelligence/POWER/power-september-2015
https://www.nxtbook.com/accessintelligence/POWER/power-august-2015
https://www.nxtbook.com/accessintelligence/POWER/power-july-2015
https://www.nxtbook.com/accessintelligence/POWER/power-june-2015
https://www.nxtbook.com/accessintelligence/POWER/power-may-2015
https://www.nxtbook.com/accessintelligence/POWER/power-april-2015
https://www.nxtbook.com/accessintelligence/POWER/power-march-2015
https://www.nxtbook.com/accessintelligence/POWER/power-february-2015
https://www.nxtbook.com/accessintelligence/POWER/power-january-2015
https://www.nxtbook.com/accessintelligence/POWER/power-december-2014
https://www.nxtbook.com/accessintelligence/POWER/power-november-2014
https://www.nxtbook.com/accessintelligence/POWER/power-october-2014
https://www.nxtbook.com/accessintelligence/POWER/power-september-2014
https://www.nxtbook.com/accessintelligence/POWER/power-august-2014
https://www.nxtbook.com/accessintelligence/POWER/power-july-2014
https://www.nxtbook.com/accessintelligence/POWER/power-june-2014
https://www.nxtbook.com/accessintelligence/POWER/power-may-2014
https://www.nxtbook.com/accessintelligence/POWER/power-april-2014
https://www.nxtbook.com/accessintelligence/POWER/power-march-2014
https://www.nxtbook.com/accessintelligence/POWER/power-february-2014
https://www.nxtbook.com/accessintelligence/POWER/power-january-2014
https://www.nxtbook.com/accessintelligence/POWER/power-december-2013
https://www.nxtbook.com/accessintelligence/POWER/power-november-2013
https://www.nxtbook.com/accessintelligence/POWER/power-october-2013
https://www.nxtbook.com/accessintelligence/POWER/power-september-2013
https://www.nxtbook.com/accessintelligence/POWER/power-august-2013
https://www.nxtbook.com/accessintelligence/POWER/power-july-2013
https://www.nxtbook.com/accessintelligence/POWER/power-june-2013
https://www.nxtbook.com/accessintelligence/POWER/power-may-2013
https://www.nxtbook.com/accessintelligence/POWER/power-april-2013
https://www.nxtbook.com/accessintelligence/POWER/power-march-2013
https://www.nxtbook.com/accessintelligence/POWER/power-february-2013
https://www.nxtbook.com/accessintelligence/POWER/power-january-2013
https://www.nxtbook.com/accessintelligence/POWER/power-december-2012
https://www.nxtbook.com/accessintelligence/POWER/power-november-2012
https://www.nxtbook.com/accessintelligence/POWER/power-october-2012
https://www.nxtbook.com/accessintelligence/POWER/power-september-2012
https://www.nxtbook.com/accessintelligence/POWER/power-august-2012
https://www.nxtbook.com/accessintelligence/POWER/power-july-2012
https://www.nxtbook.com/accessintelligence/POWER/power-june-2012
https://www.nxtbook.com/accessintelligence/POWER/power-may-2012
https://www.nxtbook.com/accessintelligence/POWER/power-april-2012
https://www.nxtbook.com/accessintelligence/POWER/power-march-2012
https://www.nxtbook.com/accessintelligence/POWER/power-february-2012
https://www.nxtbook.com/accessintelligence/POWER/power-january-2012
https://www.nxtbook.com/accessintelligence/POWER/power-november-2011
https://www.nxtbook.com/accessintelligence/POWER/power-october-2011
https://www.nxtbook.com/accessintelligence/POWER/power-september-2011
https://www.nxtbook.com/accessintelligence/POWER/power-august-2011
https://www.nxtbook.com/accessintelligence/POWER/power-july-2011
https://www.nxtbook.com/accessintelligence/POWER/power-june-2011
https://www.nxtbook.com/accessintelligence/POWER/power-may-2011
https://www.nxtbook.com/accessintelligence/POWER/power-april-2011
https://www.nxtbook.com/accessintelligence/POWER/power-march-2011
https://www.nxtbook.com/accessintelligence/POWER/power-february-2011
https://www.nxtbook.com/accessintelligence/POWER/power-january-2011
https://www.nxtbook.com/accessintelligence/POWER/power-december-2010
https://www.nxtbook.com/accessintelligence/POWER/power-november-2010
https://www.nxtbook.com/accessintelligence/POWER/power-october-2010
https://www.nxtbook.com/accessintelligence/POWER/power-september-2010
https://www.nxtbook.com/accessintelligence/POWER/power-august-2010
https://www.nxtbook.com/accessintelligence/POWER/power-july-2010
https://www.nxtbook.com/accessintelligence/POWER/power-june-2010
https://www.nxtbook.com/accessintelligence/POWER/power-may-2010
https://www.nxtbookmedia.com