SME - Nuclear Power Plant Technology & Cybersecurity (AI/ML)

### YOUR ROLE

As the NPP technology and cybersecurity SME, you would be the team's authority on how nuclear plant systems work and how NRC cybersecurity requirements apply to them. Specifically, you would help:

• Assess existing literature and technical basis on AI/ML use in the nuclear industry and identify representative use cases. The NRC has clarified it wants deeper analysis of a smaller number of use cases rather than a broad survey.
• Identify unique cybersecurity considerations: new attack vectors, vulnerabilities, and mitigation strategies for AI/ML in critical digital assets.
• Evaluate those considerations against Regulatory Guide 5.71, identifying where controls could be enhanced and where gaps exist.
• Contribute to a draft evaluation framework covering criteria for secure AI/ML use, applicable security controls, and any control tailoring. The framework should account for guidance in RG 5.71 and requirements in 10 CFR 73.110 and RG 5.96
• Contribute to interim letter reports and the final technical letter report.

Scope notes from the NRC's Q&A: AI/ML embedded in COTS digital I&C products is in scope. Lessons from other safety-critical sectors, particularly industrial control systems and critical infrastructure, are encouraged. No hands-on testing or evaluation of AI/ML implementations is expected; this is a literature-based and analytical effort.

### MINIMUM QUALIFICATIONS

• Demonstrated experience performing work related to NPP cybersecurity, including regulation, research, evaluation, or implementation of NPP cybersecurity programs
• Demonstrated knowledge of NPP systems and the application of cybersecurity programs to those systems
• Detailed knowledge of NRC NPP cybersecurity regulations and guidance (10 CFR 73.54, RG 5.71; familiarity with the proposed Part 53 / 73.110 framework is valuable)
• Hands-on experience physically working inside a nuclear power plant, not only classroom or desk-based exposure