Canadian Experience Conducting Cyber Security Inspections

Abstract of the technical paper/presentation presented at:
International Conference on Computer Security in the Nuclear World: Securing the Future
May 11-15, 2026

Prepared by:
Eman Ibrahim
Chul Hwan Jung
Yubo Lei
John Sladek
Canadian Nuclear Safety Commission

Abstract:

The Canadian Nuclear Safety Commission (CNSC) is responsible for overseeing the safe and secure use of nuclear energy and materials in Canada to ensure the protection of people and the environment. The CNSC established the CSA Group standard, CSA N290.7, Cyber Security for Nuclear Facilities, as compliance verification criteria for cyber security at high-security nuclear facilities such as Nuclear Power Plants (NPPs).

In 2015, CNSC staff required licensees to implement the 2014 version of this standard. Since then, the CSA N290.7 standard has been applied across NPPs and nuclear research and test establishments. Licensees are expected to meet the requirements of this standard using established and effective practices, including those detailed in IAEA guidance documents.

This paper discusses the approaches that the CNSC uses to verify compliance with regulatory requirements. It also discusses the two types of inspections the CNSC conducts:

1. A program inspection: Review a licensee’s program governance documents to ensure it meets the CNSC’s requirements and guidance; and
2. A program implementation inspection: Review licensee activities against their program governance to ensure they are following their program and CNSC requirements and guidance.

Between 2021 and 2023, CNSC staff carried out program inspections to review high-security nuclear facility licensee cyber security programs to verify compliance with the CNSC’s compliance verification criteria (CSA N290.7-14). In 2025, CNSC started cyber security program implementation inspections and completed an inspection at one high-security facility.

This paper describes how the CNSC plans and conducts inspections of cyber security programs at high-security nuclear facilities.

To obtain a copy of the abstract’s document, please contact us at info@cnsc-ccsn.gc.ca, or call 613-995-5894 or 1-800-668-5284 (in Canada). When contacting us, please provide the title and date of the abstract.