SME - Nuclear Power Plant Technology & Cybersecurity (AI/ML)

YOUR ROLE

As the NPP technology and cybersecurity SME, you would be the team’s authority on how nuclear plant systems work and how NRC cybersecurity requirements apply to them. Specifically, you would help:

• Assess existing literature and technical basis on AI/ML use in the nuclear industry and identify representative use cases. The NRC has clarified it wants deeper analysis of a smaller number of use cases rather than a broad survey.
• Identify unique cybersecurity considerations: new attack vectors, vulnerabilities, and mitigation strategies for AI/ML in critical digital assets.
• Evaluate those considerations against Regulatory Guide 5.71, identifying where controls could be enhanced and where gaps exist.
• Contribute to a draft evaluation framework covering criteria for secure AI/ML use, applicable security controls, and any control tailoring. The framework should account for guidance in RG 5.71 and requirements in 10 CFR 73.110 and RG 5.96
• Contribute to interim letter reports and the final technical letter report.

Scope notes from the NRC’s Q&A: AI/ML embedded in COTS digital I&C products is in scope. Lessons from other safety-critical sectors, particularly industrial control systems and critical infrastructure, are encouraged. No hands-on testing or evaluation of AI/ML implementations is expected; this is a literature-based and analytical effort.

MINIMUM QUALIFICATIONS

• Demonstrated experience performing work related to NPP cybersecurity, including regulation, research, evaluation, or implementation of NPP cybersecurity programs
• Demonstrated knowledge of NPP systems and the application of cybersecurity programs to those systems
• Detailed knowledge of NRC NPP cybersecurity regulations and guidance (10 CFR 73.54, RG 5.71; familiarity with the proposed Part 53 / 73.110 framework is valuable)
• Hands-on experience physically working inside a nuclear power plant, not only classroom or desk-based exposure
• Direct experience identifying digital assets subject to 10 CFR 73.54
• Direct experience mapping those assets against RG 5.71 appendix controls
• A track record of producing findings packages delivered to regulatory staff
• This experience can come from a consulting firm, a utility, or a lab — what matters is having actually applied these controls in a real plant

TIME COMMITMENT & LOGISTICS

• Period of performance: immediately through 26 August 2027
• Level of effort: Part-time
• Location: Remote with one (1) possible travel to customer site
• Clearance/access: No clearance or plant site access is required

ABOUT THE PROJECT

Client: U.S. Nuclear Regulatory Commission (NRC), Office of Nuclear Regulatory Research

The NRC is funding research to establish a technical basis for addressing cybersecurity concerns raised by AI/ML technologies in commercial nuclear power plants, both currently operating reactors and new/advanced designs. The findings are intended to inform regulatory guidance that is risk-informed, technology-inclusive, and performance-based.