Securing cloud-enabled radiation detection systems: a risk-informed cybersecurity framework for nuclear sensor networks

1 Introduction

As the use of nuclear technology grows, the risks associated with the movement and control of radioactive materials are a growing concern for organizations globally (Rahandini, 2023). The expansion of nuclear power generation, including the deployment of Small Modular Reactors (SMRs), will increase the volume and frequency of radioactive material transport. By using sensors distributed over a wide area, nuclear data can be collected and analyzed at a central location. This technology is known as a Radiation Detection System (RDS) and can monitor large areas for abnormal levels of radiation and help make decisions on this information in real time. A similar example of a distributed network of sensors is the Real-Time Flood Monitoring System, which uses Wireless Sensor Networks (WSNs) to forecast floods threats (Lee et al., 2008). However, Wireless Sensor Networks (WSNs) face significant limitations in practical deployments, particularly in constrained or security-sensitive environments (Talmale et al., 2017). Sensor network devices have limited storage capacity, processing power, and energy supply. Managing the sensor data locally at a fixed datacenter means the RDS will always be fixed in the same place. It also raises challenges related to the computing and storage requirements for processing and data mining huge volumes of sensor data locally (Raut and Khandait, 2015).

As technology evolves and advances, new opportunities for innovation will allow industries to move forward. One such industry that has emerged in recent times is the world of cloud computing which has been adopted in several domains. By offering services and resources on demand, cloud computing provides the opportunity for businesses to decrease operational costs while increasing the availability, scalability and reliability of resources. Adopting cloud-based services will enable the nuclear industry to evolve and adapt to the future of computing (Sylvester, 2026). Taking advantage of cloud technologies for a RDS will allow for usage over a wide area and increase mobility and scalability. By integrating this technology with cloud-based infrastructure, the WSN can use the cloud for storage and computing (Dwivedi and Kumar, 2026). Protocols such as LoRaWAN (De Carvalho Silva et al., 2017), and nuclear sensor networks like the REWARD project (Fernandez et al., 2014) will help support the RDS infrastructure.

However, every organization that wants to benefit from cloud computing must do that carefully, as without proper security measures in the cloud, organizations risk exposing their data and introducing a new attack surface. Potential cyber-security attacks in the cloud are much the same as the risks associated with traditional on-premises architecture (Haber et al., 2022). As concern over potential cyber-nuclear attacks grows, the need to protect nuclear control systems and data will only grow (Perlroth and Say, 2017). Working with a Cloud Service Provider (CSP) means giving up some control over both security and configuration of devices. Even so, the adoption of cloud-based solutions for nuclear data processing is gaining increasing support due to its potential to carry and compute large workloads at a lower cost than hosting on-site infrastructure. Rather than dedicated devices, locations, and software for hosting nuclear data computing tasks, users only need internet access (Nuclear Data Group, 2026). Both the customer and the service provider have different responsibilities. Cloud Service Providers’ compliance with the International Atomic Energy Agency (IAEA) computer security requirements for working with a third party organization will be outlined in this report. In order to ensure security in the cloud, there are certain actions an organization must take to protect their resources. Data must always be protected, including when in transit, when at rest, and when accessed. When used appropriately, the technology opportunities that cloud architecture provides are invaluable to an organization. Cloud computing presents a viable platform for hosting components of Radiation Detection Systems, provided that appropriate cybersecurity and governance controls are implemented.

The proposed framework Figure 1 is structured to address the unique cybersecurity requirements of nuclear sensor networks deployed in cloud environments. At the top level, the governance layer establishes policies, compliance requirements, and regulatory alignment, particularly with IAEA guidance on computer security for nuclear facilities (International Atomic Energy Agency, 2026a). Beneath this, the infrastructure security layer focuses on securing cloud configurations and network architecture, ensuring protection against external intrusion and misconfiguration risks.

The application security layer ensures that interfaces such as APIs are protected through authentication, validation, and secure coding practices, which is critical given the reliance on distributed sensor data ingestion. The data security layer enforces encryption, integrity verification, and access control mechanisms across all data states, consistent with best practices in nuclear information protection (International Atomic Energy Agency, 2015). Finally, the monitoring and incident response layer provides continuous visibility through logging, Security Information and Event Management (SIEM), and threat detection systems, enabling rapid identification and mitigation of cyber threats.

This layered approach ensures that vulnerabilities in one layer do not compromise the entire system, thereby enhancing resilience in high-consequence nuclear environments.

This study contributes to the field by developing a risk-informed cybersecurity framework specifically tailored for cloud-enabled radiation detection systems, bridging the gap between nuclear security guidance and modern cloud computing practices. Unlike existing studies that treat cloud security and nuclear systems independently, this work integrates both domains within a unified analytical and operational framework.

It is important to be precise about the nature of this contribution. The proposed framework does not introduce new cryptographic primitives, detection algorithms, or technical control mechanisms; existing cloud, nuclear, and OT/ICS security literature already documents the individual controls referenced throughout this paper. The contribution lies instead in the domain-specific synthesis and prioritization of those controls, drawn from IAEA Nuclear Security Series guidance, the NIST Cybersecurity Framework, NIST Zero Trust Architecture guidance, and NIST cyber-resiliency engineering guidance, against threat pathways that are specific to cloud-enabled radiation sensing rather than to cloud computing or industrial control systems in general. Generic cloud-security and OT/ICS frameworks address attack surfaces in IT and operational-technology environments broadly, but they do not address the consequence chain that is distinctive to an RDS: the integrity of a single radiation measurement reaching a decision-maker in time for that measurement to inform a real-world response. This paper’s contribution is therefore best understood as a conceptual, risk-informed mapping exercise that positions a known set of controls against an underexamined deployment context, rather than as a novel technical mechanism or an empirically validated solution. This scope, and its limits, are revisited explicitly in the Limitations subsection.

2 Literature review

2.1 Radiation detection systems and sensor networks

Radiation Detection Systems (RDS) are essential components of modern nuclear security architectures, enabling real-time monitoring of radiological conditions across distributed environments. These systems typically rely on Wireless Sensor Networks (WSNs), which provide continuous data acquisition but are constrained by limited computational capacity, energy resources, and storage capabilities (Lee et al., 2008) (Talmale et al., 2017).

Previous studies have highlighted the challenges associated with scaling WSN-based systems, particularly in high-data environments where centralized processing is required for anomaly detection and decision-making (Raut and Khandait, 2015). As nuclear monitoring systems expand geographically, the limitations of traditional architectures become increasingly pronounced.

2.2 Cloud computing in critical infrastructure

Cloud computing has emerged as a transformative technology for critical infrastructure systems, offering scalability, elasticity, and cost efficiency through on-demand resource provisioning (Sylvester, 2026). Models such as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) provide flexible deployment options for data-intensive applications.

The integration of cloud computing with sensor networks, often referred to as the Sensor Cloud paradigm, enables distributed data collection with centralized processing capabilities (Dwivedi and Kumar). While this paradigm has been extensively explored in domains such as environmental monitoring and smart cities, its application within nuclear security systems remains limited and insufficiently studied.

2.3 Cybersecurity risks in cloud environments

Despite its advantages, cloud computing introduces new cybersecurity risks, including multi-tenancy vulnerabilities, insider threats within cloud service providers, supply chain attacks, and loss of direct control over infrastructure (ENISA, 2019; National Cyber Security Centre, 2020). High-profile incidents such as Operation Cloud Hopper demonstrate how attackers exploit managed service providers to infiltrate multiple organizations, while the Triton malware attack highlights the potential for cyber-physical disruption of industrial control systems (Haber et al., 2022) (PwC and BAE Systems, 2017).

2.4 Nuclear security and digital systems

The International Atomic Energy Agency (IAEA) emphasizes the importance of cybersecurity in nuclear systems, particularly through guidance such as NSS No. 33-T (Computer Security for Nuclear Facilities), NSS No. 17 (Security of Nuclear Information), and NSS No. 14 (Nuclear Security Recommendations on Radioactive Material and Associated Facilities) (International Atomic Energy Agency, 2026b). These frameworks stress the need for defense-in-depth, risk-informed security, and integration of cyber and physical protection systems. Despite these developments, there remains a significant gap in applying these principles to cloud-based nuclear systems, particularly for distributed radiation detection networks. This study addresses this gap by proposing a tailored cybersecurity framework for cloud-enabled RDS.

2.5 Emerging approaches: zero trust, digital twins, cyber resilience engineering, and AI-Driven threat detection

Beyond the foundational cloud-security and nuclear-governance literature reviewed above, several rapidly developing approaches are directly relevant to cloud-enabled RDS but have not yet been integrated into nuclear-specific cybersecurity guidance. Zero Trust Architecture (ZTA), formalized in NIST SP 800–207, replaces implicit network-location-based trust with continuous, identity- and context-based verification of every access request (Rose et al., 2020). Recent CISA and NIST guidance frames ZTA adoption for operational technology (OT) and industrial control system (ICS) environments specifically, acknowledging that legacy OT constraints require a phased, risk-based application of zero-trust principles rather than a direct port of enterprise IT models. For cloud-enabled RDS, ZTA principles are relevant wherever sensor-to-cloud and cloud-to-application connections cross trust boundaries, yet the literature has not examined how continuous verification should be reconciled with the latency and availability requirements of real-time radiological alerting.

Digital twin technology is being explored for nuclear facility safeguards, security, and anomaly detection, including proposals to mirror plant or sensor-network behavior for live comparison against expected states (Yadav et al., 2023). Recent work on digital-twin-based remote monitoring for nuclear safeguards has highlighted concrete cyber-informed engineering choices, such as one-way data diodes between sensors and historian servers, that reduce attack surface by design rather than relying solely on layered controls added after the fact. This suggests that architectural choices made early in RDS design may do more to constrain attack pathways than governance or monitoring controls layered on afterward, a possibility the layered framework presented in this paper does not explicitly capture.

Cyber resilience engineering, formalized in NIST SP 800–160 Volume 2, shifts the design objective from preventing breach to ensuring a system can anticipate, withstand, recover from, and adapt to compromise (Ross et al., 2021). This is a materially different framing from the defense-in-depth and perimeter-control language used in most nuclear cybersecurity guidance to date, and it raises a question this paper’s framework does not fully resolve: what does “recovery” mean for an RDS, where a missed or falsified reading during an outage cannot simply be retried later? Finally, AI-driven and machine-learning-based intrusion and anomaly detection methods have matured substantially for ICS and critical-infrastructure network traffic, with recent surveys cataloguing supervised, unsupervised, and reinforcement-learning approaches and their respective data and deployment constraints (Pinto et al., 2023). These methods are a natural complement to the monitoring layer described in Section 3.2, but their reliance on labeled attack data and their documented brittleness against novel or adversarial inputs are reasons for caution rather than immediate adoption in a high-consequence RDS context.

Taken together, this body of work indicates that the individual building blocks relevant to securing cloud-enabled RDS, namely, zero trust, digital twins, resilience engineering, and AI-based detection, are progressing rapidly in adjacent domains, but none of the surveyed sources address how these approaches interact with the consequence pathway that is distinctive to a radiation detection system: a falsified, delayed, or suppressed reading that affects a real-time public-safety or regulatory decision. This is the gap the present framework attempts to narrow, while stopping short of claiming to resolve it empirically.

3 Methodology

This study adopts qualitative analytical and framework development methodology, integrating system architecture modelling, structured threat modelling, and standards-based evaluation. The approach enables triangulation across technical, operational, and regulatory domains, ensuring robustness and reproducibility of the analytical outcomes.

3.1 Research design

The study is structured around three analytical components: system architecture analysis, threat modeling and risk assessment, and standards and compliance evaluation.

• System Architecture Analysis
• ○ Examination of traditional RDS vs. cloud-enabled RDS
• ○ Identification of data flows, processing points, and system dependencies
• Threat Modeling and Risk Assessment
• ○ Identification of cyber threats using real-world case studies
• ○ Mapping attack vectors to cloud components
• Standards and Compliance Evaluation
• ○ Alignment with:
• ▪ IAEA Nuclear Security Series (NSS 33-T, NSS 17, NSS 14)
• ▪ NIST Cybersecurity Framework
• ▪ CISA and NCSC cloud security guidelines

This approach enables triangulation of technical, operational, and regulatory perspectives, ensuring robustness in framework development.

3.2 Cloud architecture modeling for RDS

A conceptual architecture for a cloud-enabled RDS was developed based on.

• Sensor Layer (Edge Devices): Radiation detectors and IoT devices
• Communication Layer: Wireless protocols (LoRaWAN, LTE, TCP/IP)
• Cloud Layer: Storage, processing, analytics
• Application Layer: Visualization dashboards and decision systems

This layered approach enables structured analysis of vulnerabilities and control points (Figure 2).

3.3 Threat modeling approach

Threat modeling was conducted using a hybrid of:

• STRIDE Model (Spoofing, Tampering, Repudiation, etc.)
• Attack Surface Analysis
• Case Study Mapping (Figure 3)

The following real-world incidents were used.

• Operation Cloud Hopper → supply chain compromise
• Triton Malware Attack → industrial control system targeting
• General cloud breach patterns (data exfiltration, privilege escalation)

Each threat was mapped to.

• Entry point
• Vulnerability exploited
• Impact on RDS

3.3.1 STRIDE threat-to-layer mapping

To move from the case-study narratives described above to a structured, reproducible mapping, each of the four architectural layers defined in Section 3.2 (Sensor, Communication, Cloud, Application) was assessed against the six STRIDE threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege). A layer-threat pair was included in Table 1 only where a concrete, literature-documented mechanism exists, drawn either from the case studies above (Operation Cloud Hopper, Triton) or from established cloud and IoT/ICS threat taxonomies (Haber et al., 2022) (PwC and BAE Systems, 2017). This produces a smaller, more defensible set of layer-threat pairs than an exhaustive STRIDE enumeration would, at the cost of not capturing every theoretically possible threat path; this trade-off is revisited in the Limitations subsection.

TABLE 1. STRIDE threat-to-layer mapping for cloud-enabled RDS.

3.3.2 Qualitative risk scoring

Each threat identified in Table 1 was scored using a qualitative likelihood-impact matrix, a method consistent with IAEA and NIST risk-informed guidance for contexts where empirical incident-frequency data are unavailable (International Atomic Energy Agency, 2026a) (National Institute of Standards and Technology, 2018). Likelihood was rated Low, Medium, or High depending on whether a directly comparable real-world precedent exists (High), whether the mechanism is a documented variant of a precedent (Medium), or whether it is plausible but not yet observed in a comparable system (Low). Impact was rated Low, Medium, or High based on the potential consequence to RDS integrity or availability, with High reserved for threats capable of producing an undetected false radiation reading or a sustained loss of monitoring coverage. This scoring is an explicit, literature-grounded judgment exercise, not a statistically derived probability estimate, and should be read accordingly.

Ranking threats by risk level rather than by category alone shifts the prioritization implied by the threat-to-layer mapping in Table 1: supply-chain compromise and sensor-data falsification emerge as the two highest-priority risks, ahead of the API- and, IAM-related risks that conventional cloud security guidance tends to foreground. This reordering is the principal analytical output of the threat-modeling exercise and is carried forward into the Analysis and Findings and Discussion sections below.

3.4 Security control evaluation

Evaluation criteria were derived from:

• IAEA computer security guidance
• NIST SP 800-series controls (National Institute of Standards and Techno logy SP 800-53 Rev. 5, 2020)
• Industry cloud security best practices

3.5 Framework development

Based on the analysis, a multi-layered cybersecurity framework was developed, integrating.

• Governance controls
• Technical safeguards
• Operational procedures

The framework emphasizes.

• Defense-in-depth
• Least privilege
• Risk-informed security

4 Analysis and findings

4.1 Enhancement of system performance through cloud integration

The integration of cloud computing into RDS significantly improves system performance across several operational dimensions.

First, scalability is enhanced through elastic cloud resources, allowing the system to dynamically adjust to increasing volumes of radiation data generated by distributed sensors. Traditional on-premises systems are constrained by fixed infrastructure, whereas cloud systems support near-unlimited horizontal scaling.

Second, mobility and accessibility are improved. Cloud-based RDS enables remote monitoring and centralized analysis, allowing decision-makers to access real-time data from geographically dispersed locations. This is particularly beneficial for national radiation monitoring systems and border security operations.

Third, data processing capabilities are significantly improved. Cloud platforms provide high-performance computing resources that enable advanced analytics, including anomaly detection and predictive modeling, which are difficult to implement in resource-constrained sensor networks.

4.2 Strengthening of data protection mechanisms

This analysis indicates that cloud platforms can support robust data protection mechanisms when properly configured, consistent with the control categories reviewed in Section 3.4 (Table 2).

TABLE 2. Security controls were assessed across three critical states of data.

For data in transit, encryption protocols such as TLS ensure that communication between sensors and cloud servers is protected against interception and tampering. Secure communication channels reduce the risk of man-in-the-middle attacks.

For data at rest, cloud storage systems offer encryption and redundancy. Data replication across multiple geographic regions enhances resilience against data loss and improves disaster recovery capabilities.

For data in use, access control mechanisms such as Identity and Access Management (IAM) enforce strict authentication and authorization policies. Role-based access control ensures that only authorized users can access sensitive radiation data.

4.3 Risk prioritization findings

Applying the qualitative risk scoring described in Section 3.3.2 to the threats mapped in Table 1 produces a prioritization that departs from the order in which these threats are typically discussed in general cloud-security literature. Managed-service-provider and supply-chain compromise, following the Operation Cloud Hopper pattern, and sensor-layer data tampering or falsification rank as Critical and High risk respectively, ahead of API exploitation and IAM misconfiguration at the cloud and application layers, both rated Medium, and communication-layer interception and wireless jamming, rated Low to Medium. This ordering indicates that, for a cloud-enabled RDS specifically, the highest-priority controls are those governing third-party/vendor assurance and sensor-data integrity verification, rather than the API-hardening and access-control measures that conventional cloud security guidance most often foregrounds. Section 4.7 revisits this ordering when assessing how the proposed framework’s control layers align with it.

4.4 Cyber-physical consequences specific to radiation detection

Unlike many cyber-physical critical-infrastructure systems, an RDS produces a single class of output, a radiation-level reading, whose integrity failure modes map onto two distinct and asymmetric consequences. A falsified or suppressed low reading (a false negative) means an actual elevation in radiological risk goes undetected; in a border-monitoring or facility-perimeter context this is the more severe failure mode, since it can permit movement of radioactive material, or a release event, to proceed without triggering containment, evacuation, or interdiction responses, and because no alarm is raised, the failure may not be discovered until a downstream consequence makes it apparent.

A falsified or fabricated high reading (a false positive) does not by itself create a radiological hazard, but it can trigger disproportionate operational responses, including evacuation orders, transport interdictions, or diplomatic incidents at border crossings, at a cost that scales with the frequency and visibility of the false alarms. Repeated false positives also create an incentive for operators to discount genuine alerts over time, a normalization-of-deviance risk that is itself a security-relevant outcome rather than a purely operational inconvenience.

Because cloud integration concentrates more of the RDS data path, aggregation, analytics, and visualization, into infrastructure outside the operator’s direct control, the attack surface for inducing either failure mode shifts toward the cloud and communication layers identified in Table 1, rather than residing solely at the sensor. This is the central cyber-physical implication of cloud adoption for RDS specifically: a successful compromise need not touch the physical sensor at all to produce a false reading at the decision-maker’s dashboard, which is a materially different threat model from the field-level manipulation exemplified by Triton.

4.5 Emergence of new cybersecurity risks

Despite these advantages, cloud adoption introduces several new risks.

One major challenge is reduced system visibility and control. Unlike traditional systems, where organizations have full control over infrastructure, cloud environments require reliance on third-party providers. This reduces transparency into system configurations and security controls.

Another critical risk is the expanded attack surface. Cloud-based systems are inherently connected to the internet, making them accessible to a broader range of threat actors. This increases exposure to attacks such as distributed denial-of-service (DDoS), credential theft, and remote exploitation.

The study also identifies supply chain vulnerabilities, particularly in scenarios where attackers compromise cloud service providers or managed service providers. Operation Cloud Hopper is a notable example of how attackers exploited trusted relationships to gain access to sensitive systems.

4.6 Insider and privilege-based threats

Cloud environments introduce heightened risks related to insider threats. Personnel within cloud service providers may have privileged access to infrastructure, creating potential vulnerabilities.

Additionally, misconfigured access controls within the organization can lead to privilege escalation, where unauthorized users gain access to critical systems or data.

4.7 Framework-to-risk alignment

The developed framework addresses the risks identified in Table 3 through a layered approach, with priority given to the Critical- and High-risk items (managed-service-provider/supply-chain compromise and sensor-data tampering) identified in Section 4.3.

• Governance ensures accountability and compliance
• Infrastructure controls protect cloud resources
• Application-level controls secure interfaces
• Data-centric controls protect information
• Monitoring enables real-time threat detection

TABLE 3. Qualitative risk scoring matrix (likelihood × impact) for identified threats.

This integrated approach ensures that cloud-enabled RDS can operate securely while maintaining operational efficiency. The Critical- and High-risk items identified in Section 4.3, supply-chain compromise and sensor-data tampering, are addressed primarily through the governance/infrastructure and data-centric layers respectively, which this paper treats as the framework’s highest-priority controls rather than as one option among five equally weighted layers.

4.8 Comparative alignment assessment

This subsection assesses how the proposed framework aligns with existing guidance, namely, the NIST Cybersecurity Framework, NIST SP 800–207 Zero Trust Architecture, and IAEA Nuclear Security Series guidance, and with the risk-control mapping in Table 4, by comparing the threats and control layers each addresses. This is a desk-based, analytical alignment exercise; it does not constitute empirical testing, simulation, or independent verification of control effectiveness, a distinction discussed further in the Limitations subsection.

TABLE 4. Risk–control mapping for cloud-based RDS.

For example:

• Supply chain attacks are mitigated through governance and infrastructure controls
• API exploitation is addressed at the application security layer
• Data manipulation risks are mitigated through encryption and integrity controls

This mapping indicates conceptual alignment between the threats identified in Tables 1, 3 and the control layers proposed in Section 3.5; it does not by itself demonstrate that this coverage is comprehensive or that the controls would perform as expected if implemented, since no implementation or testing has been undertaken. Comparing this mapping against NIST SP 800–207 suggests that the framework’s governance and infrastructure layers would benefit from an explicit zero-trust, continuous-verification posture at the cloud-to-application boundary, an extension this paper does not implement but identifies as a concrete direction for future work.

5 Discussion

This analysis indicates that cloud computing provides a transformative pathway for modernizing Radiation Detection Systems by enabling scalable, distributed, and data-driven monitoring capabilities. However, this transformation fundamentally alters the cybersecurity posture of nuclear systems by shifting from a fully controlled on-premises model to a shared responsibility paradigm involving third-party cloud service providers. This shift introduces new governance, technical, and operational risks that must be carefully managed within the context of high-consequence nuclear security environments (International Atomic Energy Agency, 2026a) (National Institute of Standards and Technology, 2018).

A key issue emerging from the study is the trade-off between scalability and control. While cloud environments provide unmatched flexibility, they inherently reduce the visibility and control that nuclear organizations traditionally maintain over critical systems. This creates new dependencies on cloud service providers, which must be carefully managed through contractual, technical, and regulatory mechanisms.

The concept of shared responsibility is particularly significant in nuclear contexts. Unlike conventional IT systems, nuclear applications involve high-consequence risks, meaning that failures in cybersecurity can translate into physical security threats. Therefore, the delineation of responsibilities between cloud providers and nuclear operators must be explicitly defined and rigorously enforced.

Another important observation is the expansion of the attack surface. Cloud-enabled systems are inherently internet-connected, exposing them to a broader range of cyber threats, including advanced persistent threats (APTs). Incidents such as Operation Cloud Hopper illustrate how attackers can exploit trusted service providers to gain access to sensitive systems. In a nuclear context, such breaches could compromise radiation monitoring data, disrupt detection capabilities, or enable malicious manipulation of sensor outputs.

The asymmetry between false-negative and false-positive consequences identified in Section 4.4 has a direct bearing on how cloud-adoption risk should be discussed for RDS specifically: because a compromise of cloud or communication-layer infrastructure can produce a false reading without touching the physical sensor, the risk discussion cannot be reduced to “is the sensor secure,” but must also ask whether the path from sensor to decision-maker preserves data integrity end to end. None of the emerging approaches reviewed in Section 2.5, Zero Trust Architecture, digital twins, cyber resilience engineering, or AI-driven detection, were designed with this consequence pathway in mind, which is why this paper treats them as future directions rather than components already incorporated into the proposed framework.

The study also highlights the importance of data-centric security approaches. Traditional perimeter-based security models are insufficient in cloud environments. Instead, security must focus on protecting data throughout its lifecycle during transmission, storage, and processing. This aligns with IAEA recommendations emphasizing defense-in-depth and protection of sensitive nuclear information.

Furthermore, the integration of cybersecurity with nuclear security principles is essential. Cloud-based RDS should not be treated solely as IT systems but as components of a broader nuclear security architecture. This requires alignment with international frameworks such as the IAEA Nuclear Security Series and adoption of risk-informed approaches.

Finally, the findings underscore the need for capacity building and regulatory evolution. Many nuclear regulatory bodies are still developing expertise in cloud security. Effective adoption of cloud technologies will require.

• Training of personnel
• Development of regulatory guidance
• Collaboration with cybersecurity experts

6 Limitations

This study is conceptual and desk-based. It does not include empirical testing, simulation, penetration testing, or expert/Delphi validation of the proposed framework, and the risk scores in Table 3 reflect a structured but qualitative literature-grounded judgment rather than measured incident probabilities or quantified impact data. The threat-to-layer mapping in Table 1 is deliberately scoped to mechanisms with a documented precedent or a clearly articulated taxonomy entry, which means it should be read as a defensible subset of plausible threats rather than an exhaustive enumeration of every STRIDE-derivable threat path.

The framework itself has not been deployed, prototyped, or benchmarked against alternative architectures, and its comparative positioning against the NIST Cybersecurity Framework, NIST Zero Trust Architecture guidance, and IAEA Nuclear Security Series guidance (Section 4.8) is an analytical alignment exercise rather than a demonstrated performance comparison. The nuclear-specific consequence analysis in Section 4.4 is reasoned from general principles and documented precedent rather than from incident data specific to radiation detection networks, and should be treated as a hypothesis for future testing rather than an established finding.

Future work should prioritize, in order of feasibility: (i) expert or Delphi-panel validation of the Table 3 risk scoring with nuclear security and cloud security practitioners; (ii) a tabletop or simulation-based exercise modeling the false-positive/false-negative consequence pathways identified in Section 4.4; and (iii) a prototype or pilot implementation of at least the highest-priority controls identified in Table 3, to move the framework from conceptual alignment toward operational evidence.

7 Conclusion

This study evaluated the integration of cloud computing technologies into Radiation Detection Systems and examined the associated cybersecurity implications. This analysis suggests that cloud-enabled RDS offers significant advantages in scalability, flexibility, and operational efficiency.

However, these benefits are accompanied by new security challenges, including reduced infrastructure control, increased attack surfaces, and dependency on third-party providers. Addressing these challenges requires a comprehensive cybersecurity framework that integrates technical controls, governance mechanisms, and regulatory alignment.

The proposed framework provides a structured approach to securing cloud-based nuclear sensor networks, emphasizing data protection, access control, monitoring, and compliance with international standards. The study highlights that successful adoption of cloud technologies in nuclear environments depends on a balanced approach that combines innovation with robust security practices. This framework and its supporting risk analysis are conceptual and desk-based, as detailed in the Limitations subsection, and should inform rather than substitute for the expert validation, simulation, and pilot testing needed before operational adoption.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. The author(s) verify and take full responsibility for the use of generative AI in the preparation of this manuscript. Generative AI was used for language editing, grammar improvement, readability enhancement, and figure ideation during manuscript preparation. The authors critically reviewed, validated, and finalized all content, interpretations, conclusions, references, and figures, and take full responsibility for the accuracy and integrity of the manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Nadja Zeleznik, Milan Vidmar Electric Power Research Institute, Slovenia

Reviewed by: Alankrita Aggarwal, Chandigarh University, India