Nuclear Safety and Security Commission (NSSC) and KINAC review a Cyber Security Plan (CSP) by「ACT ON PHYSICAL PROTECTION AND RADIOLOGICAL EMERGENCY」. The CSP contains cyber security implementation plans for the licensee’s nuclear power plant, and it shall meet the requirements of KINAC/RS-015, a regulatory standard. The KINAC/RS-015 provides more detailed information on the legal requirements, so if licensees implement cyber security under the approved CSP, they can meet the law. To protect nuclear facilities from cyber-attacks, licensees should identify their essential digital assets, so-called “Critical Digital Assets” (CDAs). Then, they apply cyber security controls (countermeasures for cyber-attacks) on CDAs consisting of technical, operational, and management security controls. However, it is hard to apply cyber security controls on CDAs because of the large amounts of CDAs and security controls in contrast to the shortage of human resources. So, licensees in the USA developed a methodology to solve this problem and documented it by NEI 13-10, and US NRC endorsed this document. The main idea of this methodology is, by classifying CDAs according to their importance, applying small amounts of security controls on less important CDAs, so-called non-direct CDAs. In the case of non-direct CDAs, only basic cyber security controls are applied, that is, baseline cyber security controls. The baseline cyber security controls are a minimum set of cyber security controls; they consist of control a) from control g) a total of 7 controls. Although non-direct CDAs are less critical than other CDAs (direct CDAs), they are still essential to protect them from cyber-attacks. This paper aims to suggest a cyber security enhancement method for non-direct CDAs by analyzing the baseline cyber security controls. In this paper, baseline cyber security controls were analyzed respectively and relatively and then concluded how to apply small amounts of cyber security controls on non-direct CDAs rather than direct CDAs without scarifying cyber security.

• In Hyo Lee(Korea Institute of Nuclear Nonproliferation and Control (KINAC))