10 CFR 73.54 is a United States nuclear security regulation that requires cyber security programmes for the protection of digital computer and communication systems and networks associated with safety, security, and emergency preparedness functions. It sets a regulatory baseline for identifying critical systems, controlling access, monitoring activity, and managing cyber risk to nuclear facility operations.
What 10 CFR 73.54 Requires in Practice
10 CFR 73.54 is not just a documentation rule, it is a regulatory baseline for protecting the digital systems that support nuclear safety, security, and emergency preparedness functions. The practical focus is on identifying which systems matter, reducing unnecessary exposure, and proving that cyber risk is actively governed rather than assumed away.
For nuclear operators, the significance of the rule is that cyber security becomes part of facility assurance, not a standalone IT concern. The control objective is to keep digital assets that could affect plant operations, response functions, or protective systems from being compromised in ways that could alter behavior, delay action, or mask an event.
Systems, Boundaries, and Critical Digital Assets
The first operational question is always scope: which systems are in the regulatory boundary, and which of them are truly critical to safety, security, or emergency preparedness. That scoping exercise is where many programmes succeed or fail, because an incomplete asset inventory can leave important pathways unmanaged while creating a false sense of coverage.
In practice, this means separating business IT from operational and plant-connected environments, then identifying where data, commands, monitoring, or supporting services cross between them. The Nuclear Facility Cybersecurity Guide is useful here because it connects 10 CFR 73.54 scope to critical digital asset identification and defensive architecture concepts.
Access Control, Monitoring, and Defensive Architecture
73.54 is fundamentally about reducing the chance that an unauthorized or malicious change can reach a protected function. That is why access control, segmentation, one-way or tightly constrained data flows, and activity monitoring are central to compliance, especially where a system supports alarm, actuation, communication, or response.
Good architecture does more than block obvious intrusion paths. It also limits the blast radius of maintenance tools, remote support channels, shared administrative access, and management interfaces that could otherwise become a bridge into a regulated environment. The rule therefore rewards designs that can be explained, tested, and defended under stress, not just documented on paper.
Evidence, Oversight, and Ongoing Cyber Risk Management
Compliance with 73.54 is sustained through recurring review, testing, and change control. Organisations need evidence that the cyber programme still matches the facility configuration, because equipment refreshes, network changes, vendor support paths, and new interfaces can quietly invalidate earlier assumptions.
That makes oversight continuous rather than episodic. Detection, logging, and incident handling must be strong enough to reveal misuse, misconfiguration, or attempted tampering, and to support prompt investigation when something abnormal appears. Nuclear cyber security is therefore as much about proving resilience over time as it is about setting a baseline at design time.
Risk and Threat Considerations
When systems covered by 10 CFR 73.54 are exposed, the risk is not limited to data theft. A successful compromise can affect plant visibility, disrupt trusted communications, delay protective actions, or create unsafe operational uncertainty in functions that operators rely on during abnormal conditions.
Failure mechanism: Attackers, malicious insiders, or compromised third parties can exploit weak segmentation, poor access control, or unmonitored pathways to alter commands, suppress alarms, or interfere with supporting systems without immediately triggering obvious operational alarms.
Impact: The result can be loss of integrity in safety-adjacent digital systems, degraded response capability, extended outage conditions, and a more difficult recovery process because operators may not know which functions or records can still be trusted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | 10 CFR 73.54 depends on identifying in-scope systems and critical digital assets. |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | The rule relies on controlling who can access regulated systems and functions. | |
| DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | Continuous monitoring is central to detecting abnormal activity in regulated environments. | |
| Recommendation — Maintain an accurate inventory of regulated systems and supporting assets. Tighten identity and credential governance around regulated plant systems. Monitor regulated networks for suspicious activity and control failures. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access to nuclear-associated systems must be limited to necessary functions and users. |
| IA-2 — Identification and Authentication (Organizational Users) | Regulated systems require strong user identification and authentication controls. | |
| AU-2 — Event Logging | Monitoring and recordkeeping are necessary to detect and investigate cyber events. | |
| Recommendation — Restrict privileges to the minimum needed for plant operations and support. Enforce strong authentication for personnel who access regulated systems. Log relevant events on regulated systems and review them routinely. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The subject requires enforced access control over regulated digital systems. |
| A.8.16 — Monitoring activities | Ongoing monitoring supports detection of abnormal or unsafe activity. | |
| Recommendation — Define and enforce access rules for systems covered by the regulation. Monitor regulated systems and alert on abnormal behaviour. | ||
Practitioner Guidance
Why practitioners should care: 73.54 is a governance obligation as much as a technical one, so accountability has to sit with the teams that own the plant systems, the cyber controls, and the change decisions that affect both. If those responsibilities are split too loosely, gaps usually appear at the boundaries between operations, engineering, and security.
What to watch for: The most common warning signs are stale system inventories, undocumented interconnections, broad administrative access, and monitoring that cannot distinguish routine maintenance from suspicious activity. Those conditions usually indicate that the programme is drifting away from the actual plant configuration.
Practitioner takeaway: Treat the regulation as an ongoing control system, not a periodic compliance exercise, and keep the asset boundary, access model, and monitoring evidence aligned as the environment changes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org