K06 assurance and procurement architecture
Part 53 advanced-reactor campus
Direct answer
Use security-by-design, technology-inclusive licensing evidence, consequence analysis, and selected Part 73 pathways from the beginning; never infer election, applicability, or approval from the existence of the final rule.
Authority and evidence boundary. K06 publishes reference architecture, source review, machine-checkable dependencies, procurement scope, and test-evidence formats. These records do not certify a facility, award a contract, authorize an operation, prove deployment, establish current operation, or transfer regulatory or command authority.
Operating context
A new advanced reactor under a Part 53 licensing path supplies a high-consequence compute campus.
Required assumptions
- The final Part 53 framework exists, but facility elections and license-specific requirements are not assumed.
- Passive safety can reduce some consequences but does not eliminate sabotage, cyber, insider, supply-chain, or grid hazards.
- Digital design decisions can become licensing-basis evidence and must be controlled from concept through operation.
Priority hazards
- security claims unsupported by design evidence
- digital I&C common-cause failure
- remote fleet-management compromise
- supply-chain and firmware substitution
- authority drift between applicant, licensee, vendor, and datacenter operator
Required evidence
- licensing-path and election record
- security-by-design traceability
- high-consequence event analysis
- digital asset and support-system inventory
- independent verification plan and change control
Site-tailoring questions
- Which Part 73 provisions are elected or imposed?
- Which claims depend on passive safety and what defeats them?
- How are vendor, fleet, and remote-service privileges bounded?
- What evidence is required at each licensing and deployment milestone?
Priority control trace
- GOV-01 — Authority and mission register
- GOV-03 — Hazard and assurance-defeater register
- ARC-01 — Critical-function decomposition
- ARC-03 — Trust-zone microsegmentation
- ID-01 — Non-human workload identity
- SUP-01 — SBOM and component provenance
- SUP-02 — Signed update and rollback
- OT-01 — Passive OT asset and dependency discovery
- AUT-01 — Bounded autonomous action tiering
- EVD-02 — Independent verification and replay
Recommended work packages
- WP-K06-01 — Mission and authority analysis
- WP-K06-02 — Consequence-driven Cyber-informed Engineering workshop
- WP-K06-03 — Cyber-physical architecture assessment
- WP-K06-04 — Control tailoring and applicability determination
- WP-K06-06 — Model and autonomous-agent assurance
- WP-K06-08 — Assurance evidence package
- WP-K06-09 — Independent verification
Explicit non-claims
- Not a Part 53 application
- Not an NRC approval
- Not a conclusion that armed responders or other safeguards may be removed