K05 assurance architecture
High-consequence events are identified and bounded
Direct answer
The facility identifies the cyber-enabled physical and mission consequences that must be prevented, their initiating pathways, critical functions, and independent protections.
Evidence boundary. These records describe architecture, control relationships, test requirements, and legal-source status. They do not certify a facility, authorize a mission, prove deployment, or replace current facility-specific engineering and legal review.
Claim
The facility identifies the cyber-enabled physical and mission consequences that must be prevented, their initiating pathways, critical functions, and independent protections.
Argument
Consequence-driven engineering focuses scarce assurance effort on outcomes that can defeat safety, continuity, or mission objectives even after perimeter compromise.
Evidence requirements
- HCE register
- system-of-systems dependency model
- critical-function list
- attack-path abstractions
- independent protection inventory
- hazard acceptance records
Assurance defeaters
- unmodeled dependency
- unknown external service
- new plant configuration
- hidden network bridge
- protection sharing a common failure mode
Hazards
- radiological consequence
- loss of heat removal
- unsafe load rejection
- cooling loss
- loss of essential compute
- corrupted restoration
Recovery objectives
- prevent HCE progression
- reach approved safe state
- retain essential telemetry
- recover critical function within site target
Site-tailoring questions
- reactor design
- electrical one-line
- cooling architecture
- compute mission priorities
- fuel and logistics
Sources and record
Consequence-driven Cyber-informed Engineering · NIST SP 800-82 Revision 3 — Guide to Operational Technology Security