The US Nuclear Regulatory Commission has today published its final rule on cyber security event notifications, adding 10 CFR 73.77 to its security requirements for nuclear power reactor licensees.
Key points
- Cyber attacks that adversely affect safety, security or emergency preparedness functions must be notified within one hour.
- Less severe events must be notified within four or eight hours.
- Certain lower-risk events must be recorded in a site log within 24 hours.
- Written follow-up reports are required for most notifications.
UK suppliers of digital systems and services to US nuclear operators should make sure they can support rapid detection and reporting of cyber events.
Source: NRC Cyber Security Event Notifications final rule (Federal Register)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
