← Frameworks / 10 CFR 73.54 / Control Mappings

Machine-readable: JSON API guide

10 CFR 73.54 Protection of Digital Computer and Communication Systems and Networks

US Nuclear Regulatory Commission mandatory cybersecurity regulation for nuclear power plants and fuel cycle facilities. Requires protection of Critical Digital Assets (CDAs) associated with safety, security, and emergency preparedness functions from cyber attacks up to and including the Design Basis Threat. Implements defense-in-depth through a 5-level security architecture per NRC Regulatory Guide 5.71. Covers technical, operational, and management controls with NRC-approved Cyber Security Plans, ongoing assessment, and integration with physical protection programs.

Controls: 116
Total Mappings: 138
Publisher: U.S. Nuclear Regulatory Commission (NRC) Version: 2009 (RG 5.71: 2010)
10 CFR 73.54 → SP 800-53 SP 800-53 → 10 CFR 73.54 Coverage Analysis
AC (7) AT (4) AU (8) CA (6) CM (8) CP (5) IA (4) IR (4) MA (6) MP (4) PE (11) PL (3) PM (10) PS (8) RA (6) SA (2) SC (9) SI (5) SR (6)

AC Access Control

Control Name 10 CFR 73.54 References
AC-02 Account Management
RG5.71-A-AC
AC-03 Access Enforcement
73.54(c)(1)RG5.71-A-AC
AC-04 Information Flow Enforcement
73.54(c)(1)73.54(c)(2)
AC-05 Separation of Duties
RG5.71-A-AC
AC-06 Least Privilege
RG5.71-A-AC
AC-07 Unsuccessful Logon Attempts
RG5.71-A-AC
AC-17 Remote Access
RG5.71-A-AC

AT Awareness and Training

Control Name 10 CFR 73.54 References
AT-01 Policy and Procedures
RG5.71-C-AT
AT-02 Literacy Training and Awareness
RG5.71-C-AT
AT-03 Role-based Training
RG5.71-C-AT
AT-04 Training Records
RG5.71-C-AT

AU Audit and Accountability

Control Name 10 CFR 73.54 References
AU-02 Event Logging
RG5.71-A-AU
AU-03 Content of Audit Records
RG5.71-A-AU
AU-04 Audit Log Storage Capacity
RG5.71-A-AU
AU-05 Response to Audit Logging Process Failures
RG5.71-A-AU
AU-06 Audit Record Review, Analysis, and Reporting
RG5.71-A-AU
AU-08 Time Stamps
RG5.71-A-AU
AU-09 Protection of Audit Information
RG5.71-A-AU
AU-12 Audit Record Generation
RG5.71-A-AU

CA Security Assessment and Authorization

Control Name 10 CFR 73.54 References
CA-01 Policy and Procedures
RG5.71-C-CA
CA-02 Control Assessments
RG5.71-C-CARG5.71-C-PL
CA-05 Plan of Action and Milestones
RG5.71-C-CA
CA-06 Authorization
RG5.71-C-CARG5.71-C-PL
CA-07 Continuous Monitoring
73.54(d)RG5.71-C-CA
CA-08 Penetration Testing
RG5.71-C-CA

CM Configuration Management

Control Name 10 CFR 73.54 References
CM-02 Baseline Configuration
RG5.71-B-CM
CM-03 Configuration Change Control
RG5.71-B-CM
CM-04 Impact Analyses
RG5.71-B-CM
CM-05 Access Restrictions for Change
RG5.71-B-CM
CM-06 Configuration Settings
RG5.71-B-CM
CM-07 Least Functionality
RG5.71-B-CM
CM-08 System Component Inventory
RG5.71-B-CM
CM-14 Signed Components
RG5.71-A-SIRG5.71-C-SR

CP Contingency Planning

Control Name 10 CFR 73.54 References
CP-01 Policy and Procedures
RG5.71-B-CP
CP-02 Contingency Plan
RG5.71-B-CP
CP-04 Contingency Plan Testing
RG5.71-B-CP
CP-09 System Backup
RG5.71-B-CP
CP-10 System Recovery and Reconstitution
RG5.71-B-CP

IA Identification and Authentication

Control Name 10 CFR 73.54 References
IA-02 Identification and Authentication (Organizational Users)
RG5.71-A-AC
IA-03 Device Identification and Authentication
RG5.71-A-AC
IA-05 Authenticator Management
RG5.71-A-AC
IA-08 Identification and Authentication (Non-organizational Users)
RG5.71-A-AC

IR Incident Response

Control Name 10 CFR 73.54 References
IR-01 Policy and Procedures
RG5.71-B-CP
IR-02 Incident Response Training
RG5.71-B-CP
IR-04 Incident Handling
RG5.71-B-CP
IR-06 Incident Reporting
RG5.71-B-CP

MA Maintenance

Control Name 10 CFR 73.54 References
MA-01 Policy and Procedures
RG5.71-B-MA
MA-02 Controlled Maintenance
RG5.71-B-MA
MA-03 Maintenance Tools
RG5.71-B-MA
MA-04 Nonlocal Maintenance
RG5.71-B-MA
MA-05 Maintenance Personnel
RG5.71-B-MA
MA-06 Timely Maintenance
RG5.71-B-MA

MP Media Protection

Control Name 10 CFR 73.54 References
MP-02 Media Access
RG5.71-B-MA
MP-04 Media Storage
RG5.71-B-MA
MP-06 Media Sanitization
RG5.71-B-MA
MP-07 Media Use
RG5.71-B-MA

PE Physical and Environmental Protection

Control Name 10 CFR 73.54 References
PE-01 Policy and Procedures
RG5.71-B-PE
PE-02 Physical Access Authorizations
RG5.71-B-PE
PE-03 Physical Access Control
RG5.71-B-PE
PE-04 Access Control for Transmission
RG5.71-B-PE
PE-06 Monitoring Physical Access
RG5.71-B-PE
PE-08 Visitor Access Records
RG5.71-B-PE
PE-09 Power Equipment and Cabling
RG5.71-B-PE
PE-11 Emergency Power
RG5.71-B-PE
PE-13 Fire Protection
RG5.71-B-PE
PE-14 Environmental Controls
RG5.71-B-PE
PE-15 Water Damage Protection
RG5.71-B-PE

PL Planning

Control Name 10 CFR 73.54 References
PL-01 Policy and Procedures
73.54(b)RG5.71-C-PL
PL-02 System Security and Privacy Plans
73.54(b)RG5.71-C-PL
PL-08 Security and Privacy Architectures
73.54(c)(2)RG5.71-C-PL

PM Program Management

Control Name 10 CFR 73.54 References
PM-01 Information Security Program Plan
73.54(a)73.54(b)
PM-02 Information Security Program Leadership Role
73.54(b)
PM-03 Information Security and Privacy Resources
73.54(b)
PM-06 Measures of Performance
73.54(d)
PM-07 Enterprise Architecture
73.54(a)
PM-09 Risk Management Strategy
73.54(b)
PM-11 Mission and Business Process Definition
73.54(a)
PM-13 Security and Privacy Workforce
RG5.71-C-AT
PM-14 Testing, Training, and Monitoring
73.54(d)RG5.71-C-ATRG5.71-C-CA
PM-15 Security and Privacy Groups and Associations
73.54(d)

PS Personnel Security

Control Name 10 CFR 73.54 References
PS-01 Policy and Procedures
RG5.71-C-PS
PS-02 Position Risk Designation
RG5.71-C-PS
PS-03 Personnel Screening
RG5.71-C-PS
PS-04 Personnel Termination
RG5.71-C-PS
PS-05 Personnel Transfer
RG5.71-C-PS
PS-06 Access Agreements
RG5.71-C-PS
PS-07 External Personnel Security
RG5.71-C-PS
PS-08 Personnel Sanctions
RG5.71-C-PS

RA Risk Assessment

Control Name 10 CFR 73.54 References
RA-01 Policy and Procedures
RG5.71-C-PL
RA-02 Security Categorization
73.54(a)RG5.71-C-PL
RA-03 Risk Assessment
RG5.71-C-PL
RA-05 Vulnerability Monitoring and Scanning
RG5.71-B-CMRG5.71-C-PL
RA-07 Risk Response
73.54(d)RG5.71-C-PL
RA-09 Criticality Analysis
RG5.71-C-PL

SA System and Services Acquisition

Control Name 10 CFR 73.54 References
SA-04 Acquisition Process
RG5.71-C-SR
SA-09 External System Services
RG5.71-C-SR

SC System and Communications Protection

Control Name 10 CFR 73.54 References
SC-07 Boundary Protection
73.54(c)(1)73.54(c)(2)RG5.71-A-SC
SC-08 Transmission Confidentiality and Integrity
RG5.71-A-SC
SC-12 Cryptographic Key Establishment and Management
RG5.71-A-SC
SC-13 Cryptographic Protection
RG5.71-A-SC
SC-23 Session Authenticity
RG5.71-A-SC
SC-28 Protection of Information at Rest
73.54(c)(1)RG5.71-A-SC
SC-32 System Partitioning
73.54(c)(1)73.54(c)(2)RG5.71-A-SC
SC-45 System Time Synchronization
RG5.71-A-SC
SC-46 Cross Domain Policy Enforcement
73.54(c)(2)RG5.71-A-SC

SI System and Information Integrity

Control Name 10 CFR 73.54 References
SI-02 Flaw Remediation
RG5.71-A-SI
SI-03 Malicious Code Protection
RG5.71-A-SI
SI-04 System Monitoring
RG5.71-A-AURG5.71-A-SI
SI-07 Software, Firmware, and Information Integrity
RG5.71-A-SI
SI-16 Memory Protection
RG5.71-A-SI

SR Supply Chain Risk Management

Control Name 10 CFR 73.54 References
SR-01 Policy and Procedures
RG5.71-C-SR
SR-02 Supply Chain Risk Management Plan
RG5.71-C-SR
SR-03 Supply Chain Controls and Processes
RG5.71-C-SR
SR-05 Acquisition Strategies, Tools, and Methods
RG5.71-C-SR
SR-06 Supplier Assessments and Reviews
RG5.71-C-SR
SR-11 Component Authenticity
RG5.71-C-SR