Review nuclear safety changes for adverse security effects and vice versa

Use this document to connect an official requirement or behavior to observable evidence: Review nuclear safety changes for adverse security effects and vice versa. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official 10 CFR 73.58 – Safety and security interface from U.S. Nuclear Regulatory Commission via eCFR supports the following bounded statements:

• Under 10 CFR 73, the rule requires that the scope of changes to be assessed and managed include planned and emergent activities (such as, but not limited to, physical modifications, procedural changes, changes to operator actions or security assignments, maintenance activities, system reconfiguration, access modification or restrictions, and changes to the security plan and its implementation). The research record locates this support at 10 CFR 73.58(c) (eCFR anchor p-73.58(c)).
• Under 10 CFR 73, the rule requires that the licensee assess and manage the potential for adverse effects on safety and security, including the site emergency plan, before implementing changes to plant configurations, facility conditions, or security. The research record locates this support at 10 CFR 73.58(b) (eCFR anchor p-73.58(b)).

Only the traced statements above are asserted as source facts. Apply the review to access control, video, intrusion detection, communications, supporting facilities, operators, and documented response paths after confirming that the source and deployed context match.

What the source does not establish

NRC regulation for covered reactors; change screening, licensing basis, protected information, configuration control, and NRC guidance require qualified interdisciplinary review. It does not establish a deployment’s current state, authorize a production change, prove compliance, or show that identity, Windows DNS where used, time, networks, power, life-safety systems, vendors, and monitoring personnel are healthy. Documented options are review inputs, not universal mandates.

Applicability questions

• For source statement 1 at 10 CFR 73.58(c) (eCFR anchor p-73.58(c)), which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at 10 CFR 73.58(b) (eCFR anchor p-73.58(b)), which observable configuration, record, or test can confirm applicability here?
• Which owner can attest to the recorded state of access control, video, intrusion detection, communications, supporting facilities, operators, and documented response paths, including exceptions?
• What baseline for identity, Windows DNS where used, time, networks, power, life-safety systems, vendors, and monitoring personnel must accompany the source-specific observation?
• Which success, stop, and escalation criteria are written before testing begins?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Begin by recording scope and current state before deciding whether a change is warranted. Record the source location, examined part of access control, video, intrusion detection, communications, supporting facilities, operators, and documented response paths, observed and expected states, owner, and reason for deviation.

An implementation decision needs an owner, approved window, prechecks, observable outcome, stop authority, and rollback path. Validate identity, Windows DNS where used, time, networks, power, life-safety systems, vendors, and monitoring personnel before and after the test, and store only sanitized operational evidence.

Verification and evidence

Tie each conclusion back to 10 CFR 73.58(c) (eCFR anchor p-73.58(c)); 10 CFR 73.58(b) (eCFR anchor p-73.58(b)) and to observable material such as asset and firmware inventories, configuration exports, event tests, inspections, alarm response records, and maintenance findings. Preserve provenance and stable identifiers without copying secrets into the evidence set.

Preserve both successful and failed observations, along with approval and rollback evidence. Avoid uncontrolled production experiments. Assign an expiry or event-driven recheck so the conclusion is not treated as permanent.

Official references

• 10 CFR 73.58 – Safety and security interface — U.S. Nuclear Regulatory Commission via eCFR