Cyber Security for Direct Critical Digital Assets Life-cycle

Licensees are implementing cyber security measures gradually to establish the system for the operating nuclear facilities, but some of measures are security requirements to be considered from the development phase of CDAs such as logical access control, log function, security design, security test, configuration management, supply chain control, and acceptance test. Applying the above security measures to CDAs that are already in operation can cause not only design changes and operation delay but also conflicts between safety and security such as affecting system reliability and safety functions. This paper suggests cyber security activities during the life-cycle including the development phase of CDAs. The regulatory standards of domestic cyber security and lessons learned from review experiences of constructing facilities are referenced, and the IAEA, IEC international guidelines on cyber security of digital I&C, and U.S. NRC Regulatory Guide are cited. Recently, as the NRC endorsed the NEI 13-10 on the graded approach for cyber security measures, this paper focuses on the cyber security activities for Direct CDAs during life-cycle, which many security measures are considered at the development phase. This paper suggests the cyber security activities during the life-cycle including the development phase of Direct CDAs. The nuclear cyber security should be systematically and effectively applied from the development phase considering the impact on system functions, the limitations on accessing and changing the system and spread of impacts. It is expected that CDAs can be protected through periodic assessments of the monitoring and robustness of implementation these security measures.