Why CDA Identification Matters
Critical Digital Assets are the backbone of regulated infrastructure—systems whose compromise could adversely impact the safety, security, or functionality of critical processes. Misidentifying, overlooking, or improperly documenting CDAs introduces risk, regulatory gaps, and potential noncompliance with:
- 10 CFR 73.54 (NRC cybersecurity rule)
- NEI 08-09 Rev 6
- NIST 800-82 and CSF
- Site-specific cyber security plans (CSPs)
InfraShield’s CDAs services are designed to be defensible, auditable, and grounded in operational reality.
Our Breakdown
Our end-to-end methodology includes both technical validation and physical verification of digital assets, pathways, and interconnections—ensuring your list of CDAs is both complete and compliant.
CDA Identification & Classification:
- Review of plant system design, network architecture, and digital safety logic
- Identification of assets whose compromise could impact safety, security, or critical function
- Use of defensible logic trees and functional impact analysis
Field-Based Walkdowns:
- On-site inspections to confirm physical connections, data pathways, and cable routing
- Verification of equipment labels, rack locations, and signal sources
- Documentation of real-world configurations vs. documented architecture
System Mapping & Documentation:
- As-found asset maps and CDA diagrams
- Logical and physical pathway validation
- Annotated CDA register for inspection and remediation tracking
Regulatory Readiness Support:
- Alignment with NEI 08-09 CDA determination guidance
- Evidence collection and rationales for inspections and audits
- Integration into existing CSP or cyber risk management frameworks
