Current cyber security approaches are dominated by protection of an asset through application of recommended cyber security controls.  The modernization of nuclear power plants and the advances in digital technology automation demands the development of an effective and cost-efficient security strategy. This can be achieved by adapting current approaches through prioritization of a limited set of controls that can be effectively delivered by the operator given the limited human resources.  The recommended controls are typically detailed within international or national standards.  This paper provides an analysis of international (i.e. ISO 27002, IEC 62443, IEC 63096) and USA national standards (NEI 08-09 Rev 6) to derive a priority list of cyber security controls for the protection of critical digital assets.

Current national USA regulation is based on NIST sp800-53 \[Ref 1\] and NIST sp800-82 \[Ref 2\], and the required control sets are captured within US NRC Reg. Guide 5.71 \[Ref 3\] and NEI 08-09 Rev 6 \[Ref 4\].  These guides list 140 ‘families’ of controls and over 500 separate clauses for application.  This is a considerable challenge for securing critical digital assets that can number potentially into the 1000s.  This may lead to fatigue in the limited cyber security human resources that must carry out these control activities and corresponding analysis.

International/European standards for adoption within regulation is captured in IEC 62645 Rev 1 and soon to be published IEC 63096.  IEC 63096 is based upon the control methods detailed within ISO/IEC 27002. The large number of controls and an absence of a clear prioritization selection method presents similar problems to those that exist in the USA regulation.

Finally, modernization will result in the use of commercial off the shelf (COTS) technology to replace existing legacy operational technology equipment.  COTS technology relies upon vendors to implement security that needs to be verified and validated to ensure compliance to the aforementioned standards.  The state of practice for vendors is currently IEC 62443 set of standards leading to ISA Secure certification.  However, this standard has marked and significant differences from those standards used within national regulation.

There is a need to develop a consistent and coherent method to determine priority controls that can be efficiently and effectively applied to meet regulatory objectives.  The results detailed within this paper was produced from the following method (1) review of the standards; (2) mapping of similar control sets/methods; (3) identification of the priority list (i.e. methods common to all standards); and (4) Evaluation of priority list against case studies/scenarios to determine whether the controls sufficiently provides protection to avoid or mitigate the associated consequences.

\[1\] J. T. Force and T. Initiative. 2013. Security and privacy controls for federal information systems and organizations. NIST Spec. Publ. 800 (2013), 53.

\[2\] K. McKay and D. Cooper, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations, NIST SP 800-52 Revision 2, NIST, Oct. 2018.

\[3\] U.S. Nuclear Regulatory Commission. Regulatory Guide 5.71. Cyber Security Programs for Nuclear Facilities. Jan. 2010.

\[4\] NEI 08-09, “Cyber Security Plan for Nuclear Power Plants,” Revision 6, dated April 2010.

Sandia National Laboratories is a multimission laboratory managed and operated by National Technology and Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.


Analysis of National and International Standards to Identify Priority Control Methods

Division / Sponsors: 
Power Division & Nuclear Engineering Division (NED)

Power Conference
Paper Proceedings: https://asmedigitalcollection.asme.org/POWER/POWER2020/volume/83747

International Conference on Nuclear Engineering
Paper Proceedings: https://asmedigitalcollection.asme.org/ICONE/ICONE2020/volume/83761

POWER-ICONE - Virtual Conference

Supporting the need among researchers worldwide for additional online and multimedia content, ASME now offers the ASME Conference Video Collection. This platform will collect and provide long-term access to conference presentation videos, encompassing all technology areas within ASME's technical conference and events program. About 30,000-40,000 engineers across all mechanical engineering and related disciplines participate in ASME conferences each year. This includes authors of approximately 6,000 to 8,000 technical papers published by ASME, the majority of whom also submit video presentations for our virtual conferences. The video collection will be available as an add-on to existing product packages or as a separate subscription.