Data Diode

Isolate ICS networks from any untrusted networks, especially the Internet; lock down all unused ports and turn off all unused services. Allow real-time external connectivity only where there is a defined business or control requirement;

Group every CBS in scope into security zones with defined policies and capabilities, each either air-gapped or connected only through means that control the data crossing (for example firewalls, routers, one-way serial links, data diodes or dry contacts), with...

NSS-17 + NSS-42-G require facility computer security architecture organised by Computer Security Zones (CSZs) implementing IAEA zone model.

Design and operate OT network architecture per NIST SP 800-82 Rev 3 Chapter 6 (OT Security Architecture). Apply the Purdue Enterprise Reference Architecture as the foundational structure: Level 0 Physical Process + Level 1 Basic Control + Level 2 Area Supervis...

Implement Defensive Architecture per 10 CFR 73.54(c) using a defense-in-depth approach with multiple layers of protection. NRC RG 5.71 Appendix B describes the recommended Defensive Architecture with five Security Levels (Levels 4 + 3 + 2 + 1 + 0 with 4 highes...

Agencies that intend to classify media lower than the system it is connected to must ensure one of the following: the media itself is read-only; the media is placed in a device that only permits reading;