Delivery of the Cyber Security and Information Assurance Plan Project

a) Development of CS&IA Plans and TAG – Under NISR 2003, nuclear premises are required to have a Site Security Plan (SSP) approved by ONR. SSPs have evolved in line with revisions to ONR guidance. SSPs submitted under SyAPs will require significantly enhanced content with regards to CS&IA. Furthermore, following amendments to legislation, all locations holding sensitive nuclear information (SNI) will be required to have an approved, dedicated CS&IA plan. The contract requires working with selected dutyholders to develop a draft CS&IA SSP content for a premises and a CS&IA plan for an SNI location. These are designed to demonstrate how SyAPs have been achieved for the premises and location, and to assist in a trial assessment of the draft plans. A key element is to capture learning from the production and assessment process and produce a TAG providing guidance on the purpose, scope and content of the CS&IA elements on the SSP and a CS&IA plan, aimed at assisting ONR inspectors in assessment. b) Development of CS&IA SyAPs and TAGs – Whilst a strong draft of SyAPs has been completed, it has to undergo a full consultation process with a wide range of stakeholders before publication in March 2017. The CS&IA specific TAGs have yet to be drafted and will also require consultation. The contract will involve development and consultation for all CS&IA aspects (including publications such as TAGs) of the SyAPs, ensuring delivery of consistent documentation to time and quality expectations. Of particular note is the extensive nature of the consultation required to develop the CS&IA TAGs. Furthermore, the process is likely to be multi-stage, potentially consisting of information and opinion gathering on structure and content; workshops to resolve difficult issues; circulation of drafts for comment and review; and testing prior to publication.