Framework for evaluating cyber incident response capabilities of nuclear facility operators through operation-based exercises

Abstract

Cyberattacks on nuclear facilities can cause unauthorized information leakage and critical impacts on nuclear safety, making an effective cyber incident response system essential. The International Atomic Energy Agency (IAEA) emphasizes the protection of computer-based systems for physical security, nuclear safety, and nuclear material control from cyber threats. Nuclear facility operators must possess the capability to detect and respond to cyber incidents, and this capability can be evaluated through cyber incident response exercises. This study proposes a framework for evaluating nuclear operators' incident response capabilities. The framework analyzes and builds upon IAEA's cyber incident response phases, breaking them down into six phases, defines key activities and evaluation requirements for each phase, and incorporates existing cyber response evaluation technologies. It also presents criteria and performance indicators to evaluate whether these requirements are met. To examine the applicability and practical relevance of the framework, a cyberattack scenario tailored for nuclear facilities is applied to a simulator replicating real-world conditions. The findings of this study provide a systematic and objective way to evaluate response exercises, offering a foundation for effective cyber incident management and minimizing impacts on nuclear facilities.