Defenders should inspect the paths into protected systems first: maintenance laptops, vendor remote access, removable media and change records. In US nuclear power plants, 10 CFR 73.54 requires licensees to protect digital systems tied to safety, security and emergency preparedness, and maintenance is where outside software meets those systems.
This is a calm, general overview from public rules. It describes no incidents, and plant operators follow their own approved cyber security plans.
What does the US rule require?
Section 73.54 of Title 10 of the Code of Federal Regulations applies to licensees operating nuclear power plants under part 50. Each had to submit a cyber security plan to the NRC for review and approval. The rule protects safety-related and important-to-safety functions, security functions, emergency preparedness functions including offsite communications, and support systems whose compromise would harm any of those.
The goal it states is high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat. Licensees must identify assets, run a cyber security program that is part of physical protection, apply defense-in-depth, train personnel including contractors, manage risk and evaluate modifications to protected assets before they happen. The cyber plan must also cover incident response and recovery.
Why start with maintenance?
Maintenance is the planned moment when someone brings new software and tools to a protected system. The rule's requirement to evaluate modifications before implementation speaks to exactly this. It also says contractors must be aware of requirements and trained, which matters because outside vendors do much of the work.
Several maintenance paths deserve a first look:
- Service laptops and engineering workstations. They hold configuration tools and credentials, and they move between networks.
- Vendor remote access. Who can connect, from where, with which approval, and how is each session logged?
- Removable media. Where does it come from, and how is it checked before use?
- Software and firmware updates. Who supplies them, how is integrity verified, and where is the evidence kept?
Which supply chain facts should you hold?
For each protected digital asset, keep the model, firmware version, installed software and supplier. A bill of materials per asset turns "are we affected by this flaw?" from a research project into a lookup. NIST SP 800-82 Revision 3, its guide to operational technology security, is a general reference for OT topology, threats and countermeasures, and covers industrial control systems, PLCs, distributed control systems and SCADA.
For hardware, CISA's HBOM framework from September 2023 offers a consistent way for vendors to describe components. It says it stops short of examining firmware provenance, so treat it as an inventory aid, not an assurance.
What about checks you cannot do yourself?
Some evidence has to come from the vendor: how the firmware was built, how it was tested and how fixes are delivered. Put those questions in contracts and in the pre-implementation evaluation. The regulation's own wording, evaluating modifications before implementation, gives you the hook.
What to do
- Confirm the asset list for protected digital systems is current, with firmware and software versions.
- Map every maintenance path into those systems, including vendor remote access.
- Check that each path has an owner, an approval step and a session log.
- Verify integrity evidence for updates before installation.
- Control removable media and service laptops.
- Ask suppliers for component lists and an advisory process, and record the answers.
- Rehearse the response and recovery steps in your approved plan.
Quick check
What does 10 CFR 73.54 protect?
Digital computer and communication systems and networks tied to safety-related and important-to-safety functions, security functions, emergency preparedness functions, and support systems whose compromise would harm those.
Does an SBOM prove a plant system is secure?
No. It lists components so you can find affected assets quickly. Assurance still depends on evaluation, change control and vendor evidence.
Sources
- 10 CFR 73.54: Protection of digital computer and communication systems and networks (Cornell LII)
- NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security
- CISA: A Hardware Bill of Materials (HBOM) Framework for Supply Chain Risk Management (PDF)
Last reviewed: 18 October 2026.
