Log Management Compliance - NRC RG 5.71 - Nuclear Regulatory Commission
In the Code of Federal Regulations, Section 73.54, Title 10 it is required that the NRC licensees provide high assurance that digital computer and communication systems and networks are sufficiently protected against…
In the Code of Federal Regulations, Section 73.54, Title 10 it is required that the NRC licensees provide high assurance that digital computer and communication systems and networks are sufficiently protected against cyber-attacks. The NRC developed and published “Regulatory Guide 5.71” to cover many areas surrounding access control, audit and accountability, incident response, and system and information integrity.
LogIT directly meets many of these requirements for collection, management, and analysis of log data that are integral to NRC RG 5.71 guidelines. LogIT makes analysis and reporting easier by categorizing, identifying, and normalizing log data for you. Critical issues will be identified and reported by LogIT’s wide alerting capacity.
Check out Digital Edge’s Log Management Solution: LogIT, where you can learn how our unparalleled solutions can enforce continuous compliance. To assess your Log Management needs and budget your project, visit our Log Management Assessment tool for your instant quote!
For more information on NRC RG 5.71 visit https://scp.nrc.gov/slo/regguide571.pdf and http://www.nrc.gov/reading-rm/doc-collections/cfr/part073/part073-0054.html.
If you feel that you need assistance from the Digital Edge Security team, please contact us at www.digitaledge.net/contact/.
Updated November 2026: the original post is kept above; the sections below add context for readers today.
RG 5.71 today
The NRC issued Revision 1 of Regulatory Guide 5.71 in February 2023. It still supports compliance with 10 CFR 73.54, and its audit and accountability controls expect licensees to log security-relevant events on critical digital assets, protect those records and review them.
- Identify the critical digital assets and the events each must record.
- Keep logs where an attacker on the asset cannot change them.
- Review them on a schedule and keep evidence of the review.
See LogIT log management or estimate your plan with the log management assessment.
Because many critical digital assets sit on isolated networks, log collection must be designed so that it never creates a new path into those systems.
