Technical Control

When using remote-access technologies, technical controls prevent copy and relocation of PAN for all personnel except those with documented, explicit authorization.

Per 10 CFR 73.54 + NRC Regulatory Guide 5.71: defense-in-depth + access control + monitoring + boundary controls + integrity protection.

Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

Deploy risk-derived technical controls that promptly detect and respond to irregular inbound or outbound traffic patterns and distributed denial of service attacks, feeding their output into a SIEM so correlated events can trigger countermeasures.

Harden host and guest operating systems, hypervisors and the infrastructure control plane to a documented security baseline enforced by technical controls.

Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;