10 CFR 73.54 requires nuclear power plant licensees to provide high assurance that digital computer and communication systems tied to safety, security and emergency preparedness are protected against cyber attack up to the design basis threat. They do it through a cyber security plan the NRC reviews and approves.
Who it applies to
Licensees operating a nuclear power plant under part 50, and applicants for operating or combined licenses, who must include a compliant plan in their application.
What systems are in scope
Licensees analyze their systems and networks to decide which assets need protection. The rule names digital systems tied to:
- safety-related and important-to-safety functions,
- security functions,
- emergency preparedness functions, including offsite communications,
- and support systems whose compromise would affect those functions.
The rule says attacks of concern would compromise data or software, deny access, or disrupt operation.
What the program must include
From the regulation text:
- Security controls for identified assets.
- Defense in depth strategies to detect, respond to and recover from attacks.
- Measures to mitigate attack effects.
- Training for facility personnel, including contractors.
- Ongoing cyber risk evaluation and management.
- Evaluation of modifications to protected assets before implementation.
- Cyber security event notifications under 10 CFR 73.77.
The plan must also cover timely detection and response, consequence mitigation, correction of exploited vulnerabilities and restoration of affected systems.
Records and oversight
Written implementing policies and procedures are maintained and subject to periodic NRC inspection. Records are kept until the Commission terminates the license, with superseded portions kept for at least three years.
What stands out
Two features are worth noting for anyone used to commercial frameworks. First, scope comes from function: what the system does for safety, security and emergency response decides whether it is in. Second, changes to protected assets are evaluated before they are made, which is an unusually direct link between change control and cyber risk.
For suppliers
If you sell digital components to a licensee, expect questions about change, testing and training of your contractors. Safeguard's SBOM and dependency scanning supports the inventory for software you ship, and compliance evidence automation helps collect proof. Safeguard does not hold any nuclear certification.
Reading it as a general lesson
The rule is specific to nuclear plants, but a few of its ideas travel. Define scope by function rather than by device type. Write a plan that a regulator can inspect and keep records that survive staff turnover. Bake incident response and recovery into the same plan as prevention, so they are not separate documents written by different people.
None of this makes a plant safe by itself. The text is a requirement to have a program, and the quality of the program depends on the people who run it. Treat the regulation as a floor.
Quick check
Does the rule apply to every digital system at a plant?
No. It applies to systems tied to safety, security and emergency preparedness functions, plus support systems that affect them.
Who approves the plan?
The NRC reviews and approves the licensee's cyber security plan.
Sources
Last reviewed: 19 October 2026.
