ᚲ.com

K05 assurance architecture

Trust-zone microsegmentation

Direct answer

Enforce deny-by-default communications between workloads, management, OT, cooling, grid, and external services using authenticated identities and declared flows.

Stable record
ARC-03
Claim status
PROJECT TECHNICAL PROPOSAL
Last reviewed
Research cutoff
Source type
GOVERNED PROJECT KNOWLEDGE
Currentness
Current for release 2.1.0; external sources require periodic revalidation.
Correction state
No unresolved public correction recorded for this release.
Machine record
Static JSON record
Evidence boundary. These records describe architecture, control relationships, test requirements, and legal-source status. They do not certify a facility, authorize a mission, prove deployment, or replace current facility-specific engineering and legal review.

Objective

Enforce deny-by-default communications between workloads, management, OT, cooling, grid, and external services using authenticated identities and declared flows.

Implementation evidence

  • approved design and scope
  • exact configuration or policy artifact
  • test result
  • defect and exception record
  • operating observation where deployment is claimed
  • last review and evidence owner

Evidence of failure or insufficiency

  • missing or stale artifact
  • control bypass
  • unresolved defect
  • scope mismatch
  • unsupported compliance label
  • unavailable operating evidence

Qualified source mappings

  • NIST SP 800-82 Rev. 3 — INFORMSOT security program, architecture, risk, and control guidance
    Applies as guidance when OT is in scope; Revision 3 remains final while Revision 4 is under development.
    Source record
  • NIST SP 800-207 — INFORMSZero Trust Architecture principles
    Applies to identity- and resource-centric access design; does not replace OT safety analysis.
    Source record
  • INL Consequence-driven Cyber-informed Engineering — INFORMSConsequence prioritization and critical-function assurance
    Useful for high-consequence pathway analysis; not a regulatory certification.
    Source record
  • NRC 10 CFR Part 73 — MAY IMPLEMENT OR SUPPORT73.54/73.55 or 73.100/73.110/73.120 as selected and applicable
    Only for an NRC-regulated facility within the selected licensing and security framework; license basis controls.
    Source record

Assurance claims

AC-K05-C03 · AC-K05-C04

Authority boundary. Control design and mapping do not create mission authority, license approval, certification, or universal applicability.

Machine-readable control