Regulations on Cybersecurity in Nuclear Facilities
The “Regulation on Cybersecurity in Nuclear Facilities,” prepared by the Nuclear Regulatory Authority (“NDK”), was published in the Official Gazette No. 33244 dated May 5, 2026, and entered into force on the date of publication. The Regulation imposes comprehensive obligations regarding the protection of digital assets in nuclear facilities against cyberattacks.
The Regulation applies to all legal entities that construct, operate, or decommission nuclear facilities—that is, the actors defined as “Organizations.” The primary responsibility for ensuring cybersecurity lies directly with the Organization; the NDK, however, monitors whether this responsibility is being fulfilled through regulatory oversight activities.
1. BASIC CONCEPTS
Digital asset: All hardware, software, and systems used to create, store, process, control, or transmit data and information at a nuclear facility. Software controlling the reactor’s cooling system, radiation measurement networks, personnel access log systems, and operator control panels are concrete examples falling under this scope.
Critical digital asset: Digital assets whose compromise in terms of confidentiality, integrity, or availability could directly or indirectly negatively impact safety, security, or nuclear safeguards. These assets are subject to particularly rigorous regulatory oversight under the regulation.
Cyber incident: A breach of the confidentiality, integrity, or availability of digital assets. Unlike a cyberattack, it does not require an element of intent; breaches resulting from technical failures or human error are also classified as cyber incidents.
2. THE REGULATION’S TWO FUNDAMENTAL PRINCIPLES
All obligations are built upon two fundamental principles:
Graduated approach: Cybersecurity measures are not applied uniformly to all digital assets; they are planned and implemented in a manner proportional to each asset’s impact on safety, security, and nuclear safeguards. An operator’s computer and a reactor control system are not subject to the same set of measures.
Defense in depth: Relying on a single security layer is not sufficient. Physical, technical, and administrative measures are implemented in layers to support one another. If one layer fails, the others continue to function.
3. MAIN OBLIGATIONS AND TIMELINES
Cybersecurity Plan (Article 7)
Each organization must prepare a cybersecurity plan that details how the facility’s cybersecurity will be ensured and submit it to the NDK as part of the relevant authorization application. The plan must be reviewed at least once a year. In cases such as changes in risk, organizational structure, or updates to the threat document (TET Document), the plan must be updated immediately. Approval of the changes by the NDK does not reduce the organization’s responsibilities.
Digital Asset Management and Inventory (Article 8)
It is mandatory to identify all digital assets at the facility, determine their criticality levels, and maintain an up-to-date inventory. The inventory must include, at a minimum, the following information: the asset’s name, type, location, backup information, criticality level, and the asset’s responsible party. An appropriate cybersecurity level must also be determined for each digital asset.
Cybersecurity Risk Management (Article 9)
Facilities containing reactors must conduct a planned risk assessment at least once a year, while other nuclear facilities must do so at least once every three years. In addition, an immediate assessment must be conducted whenever a change is made to a critical digital asset, threat information is updated, or a new vulnerability is identified. The organization is required to continuously monitor and evaluate notifications obtained from software and hardware manufacturers, as well as national and international databases, as part of its vulnerability management activities.
Cybersecurity Incident Reporting and Reporting (Article 13)
Any cyber incident that threatens security or has the potential to do so must be reported immediately to both the NDK and the Cyber Security Directorate. Within five business days of the incident’s detection, an official report covering the causes and effects of the incident, the response activities conducted, lessons learned, and corrective and preventive actions must be submitted to the NDK.
Cyber Incident Drill (Article 13)
At least once a year, a cyber incident drill must be conducted based on a scenario involving critical digital assets. These drills must be conducted as hybrid exercises, combined with security and safety scenarios, at least once every two years. The date, scope, and scenario of the exercise must be notified to the NDK at least ten business days in advance with a “For Official Use Only” classification. A final report must be submitted within fifteen business days following the exercise.
Supply Chain Management (Article 12)
The Regulation covers not only the facility itself but also the supply chain. The organization must establish the cybersecurity requirements that suppliers must comply with, monitor compliance with these requirements, and verify the reliability of all goods and services procured.
Personnel Management and Training (Article 14)
All facility personnel must undergo cybersecurity training and an awareness program at least once a year. In addition to these trainings, specialized technical programs must be organized for the cybersecurity team. Each employee’s authorization must be determined based on their documented level of expertise; access rights must be limited solely to the relevant systems.
Annual Performance Report (Article 15)
Each year, a comprehensive report evaluating the previous calendar year’s cybersecurity practices must be prepared and submitted to the NDK by the end of February of the following year. The report must include the results of security tests and audits, the outcomes of training programs, and the schedule of activities planned for the coming year.
Disaster Recovery (Article 13/8)
To ensure the continuity and recovery capacity of critical digital assets in the event of a disaster, failure, or cyberattack, a disaster recovery center must be established at a location sufficiently distant from the area housing the primary systems to avoid being affected by such events.
4. TRANSITION PERIOD AND KEY DATES
Full compliance is not immediately expected from organizations that were authorized or had applied prior to the effective date of this regulation. However, these organizations must prepare and submit a compliance action plan to the NDK within six months from the effective date of this regulation. If the justification is deemed appropriate by the NDK, this period may be extended by up to one year.
In conclusion, this regulation officially establishes that nuclear security is no longer merely a matter of physical protection; it also incorporates the protection of digital infrastructure into the regulatory framework with the same level of seriousness.
To access the relevant regulation: https://www.resmigazete.gov.tr/eskiler/2026/05/20260505-2.htm