 |
中标分类
行业分类
ICS分类
最新标准
|
登录注册 |
| 您的位置: 标准明细 |
Codeofchina.com is in charge of this English translation. In case of any doubt about the English translation, the Chinese original shall be considered authoritative. This standard is developed in accordance with the rules given in GB/T 1.1-2009. This standard replaces GB/T 25058-2010 Information security technology — Implementation guide for classified protection of information system and has the following main changes with respect to GB/T 25058-2010: ——The standard name is changed to Information security technology — Implementation guide for classified protection of cybersecurity. ——In the full text, "information system" has been adjusted to "classified protection object" or "classified object", and in the national standard, "basic requirements for classified protection of information system" has been adjusted to "basic requirements for classified protection of cybersecurity". ——Considering the special treatment of new technologies and applications such as cloud computing in the implementation process, cloud computing, mobile internet, big data and other related content have been added to relevant clauses as needed (see 5.3.2, 6.3.2, 7.2.1 and 7.3.2). ——The existing content of each part has been further refined so as to guide the classified protection of the newly-built classified protection objects for units (see 6.3.2 and 7.4.3). ——In the classification stage of classified protection objects, the working process of industry/field competent units has been added (see 5.2); special concerns of classification the cloud computing, mobile internet, Internet of Things, industrial control and big data have been added (see 5.3; 5.2 in 2010 edition). ——In the overall security planning stage, the relevant content of industry classified protection management norms and technical standards have been added, that is, to define the basic security requirements include both the requirements put forward by national classified protection management norms and technical standards as well as the requirements put forward by industry classified protection management norms and technical standards (see 6.2.1; 6.2.1 in 2010 edition). ——In the overall security planning stage, the content of "design of the security technology architecture of classified protection objects" has been added, and it is required that the security technology architecture shall be designed according to the overall security policy file of the organization, GB/T 22239 and the security requirements of the organization, with the security technology architecture diagram provided. In addition, technical measures for security protection of new technologies such as cloud computing and mobile internet have been added (see 6.3.2; 6.3.2 in 2010 edition). ——In the overall security planning stage, the content of "design of the security management system framework for classified protection objects" has been added, and it is required that the security management system framework shall be designed according to GB/T 22239, security requirement analysis report, etc., with the security management system framework provided (see 6.3.3; 6.3.3 in 2010 edition). ——In the stage of security design and implementation, the order of "technical measures realization" and "management measures realization" has been switched (see 7.3 and 7.4; 7.3 and 7.4 in 2010 edition); "personnel security skills training" has been merged into "security management organization and personnel setting" (see 7.4.2; 7.3.1 and 7.3.3 in 2010 edition); and the order of "construction and revision of security management system" and "setting of security management organizations and personnel" has been switched (see 7.4.1 and 7.4.2; 7.4.1 and 7.4.2 in 2010 edition). ——In the stage of security design and implementation, the requirements for risk analysis of new technologies such as cloud computing and mobile internet as well as the realization of technical protection measures have been added for the realization of technical measures (see 7.2.1; 7.2.1 in 2010 edition); in the testing process, more emphasis has been placed on security testing content such as security vulnerability scanning and penetration testing (see 7.3.2; 7.3.2 in 2010 edition). ——In the stage of security design and implementation, on the basis of the original information security product suppliers, the evaluation and selection requirements of cybersecurity service organizations has been added (see 7.3.1); in the integration of security control, the integration of security measures such as security situational awareness, monitoring, notification and early warning, and emergency response tracing has been added (see 7.3.3); in the requirements for the construction and revision of the security management system, the consistency of the four-tier system files of the overall security policy, security management system, security operation procedures, security operation and maintenance records and forms is added (see 7.4.1); and in the security implementation process management, the activity content description of the overall management process has been added (see 7.4.3). ——In the security operation and maintenance stage, "service provider management and monitoring" has been added (see 8.6); "security incident handling and emergency plan" has been deleted (8.5 of 2010 edition); "system filing" has been deleted (8.8 of 2010 edition); the content of "supervision and inspection" has been revised (8.8; 8.9 in 2012 edition) has been revised; and "emergency response and assurance" (see 8.9) has been added. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. The issuing body of this document shall not be held responsible for identifying any or all such patent rights. This standard was proposed by and is under the jurisdiction of the National Technical Committee on Information Security of Standardization Administration of China (SAC/TC 260). The previous edition of this standard is as follows: ——GB/T 25058-2010. Information security technology — Implementation guide for classified protection of cybersecurity 1 Scope This standard specifies the process of implementing classified protection of cybersecurity for classified protection objects. This standard is applicable to guide the implementation of classified protection of cybersecurity. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition (including any amendments) applies. GB 17859 Classified criteria for security protection of computer information system GB/T 22239 Information security technology — Baseline for classified protection of information system security GB/T 22240 Information security technology — Classification guide for classified protection of information system security GB/T 25069 Information security technology — Glossary GB/T 28448 Information security technology — Evaluation requirement for classified protection of cybersecurity 3 Terms and definitions For the purpose of this document, the terms and definitions given in GB 17859, GB/T 22239, GB/T 25069 and GB/T 28448 apply. 4 Overview on classified protection implementation 4.1 Basic principles The core of security classified protection is to classify the classified protection objects, and to carry out construction, management and supervision according to standards. The following basic principles shall be followed in the implementation of security classified protection: a) Autonomous protection The operation and use units of classified protection objects and their competent departments shall independently determine the security protection level of classified protection objects and organize the implementation of security protection by themselves in accordance with relevant national laws and standards. b) Priority protection According to the importance and business characteristics of classified protection objects, different security protection intensities are realized by dividing classified protection objects with different security protection levels, and resources are centralized to give priority to protecting classified protection objects involving core business or key information assets. c) Simultaneous construction For classified protection objects in new construction, reconstruction and expansion, security schemes shall be simultaneously planed and designed, and a certain proportion of funds shall be invested to build cybersecurity facilities, so as to ensure that cybersecurity is compatible with informatization construction. d) Dynamic adjustment The security protection measures shall be adjusted by tracking the changes of classified objected. If the security protection level is required to be changed due to changes in the application type, scope and other conditions of the classified object as well as other reasons, the security protection level of the classified object shall be re-determined according to the requirements of the management specifications and technical standards for information security protection, and the security protection shall be re-implemented according to the adjustment of the security protection level of classified object. 4.2 Participants and their responsibilities The various participants and their responsibilities involved in the implementation of classified protection of cybersecurity for classified protection objects are as follows: a) Classified protection management departments The classified protection management departments shall be responsible for cybersecurity protection, supervision and management within the scope of their respective duties in accordance with the provisions of relevant laws and administrative regulations on classified protection. b) Competent departments They shall be responsible for supervising, inspecting and guiding the classified protection of cybersecurity of the industry, department or local classified protection object operation and use units in accordance with the management norms and technical standards for national classified protection of cybersecurity. c) Operation and use units They shall be responsible for 1) determining the security protection level of their classified protection objects in accordance with the national classified protection of cybersecurity management norms and technical standards, and if a competent department is available for a certain operation and use unit, the security protection level shall be reported to this competent department for examination and approval; 2) going through the filing formalities with the public security organ according to the determined security protection level; 3) planning and designing the security protection of classified protection objects according to the national classified protection of cybersecurity management norms and technical standards; 4) using information technology products and cybersecurity products that meet the relevant provisions of the state and meet the security protection level requirements of classified protection objects to carry out security construction or reconstruction work; 5) formulating and implementing various security management systems, regularly conducting self-examination on the security status of classified protection objects, the implementation of security protection systems and measures, selecting level evaluation organizations that meet relevant national regulations, and conducting regular level evaluation; and 6) formulating response and disposal schemes for different levels of cybersecurity incidents, and carry out emergency disposal for cybersecurity incidents at different levels. d) Cybersecurity services According to the entrustment of the operation and use units and in accordance with the national classified protection of cybersecurity management norms and technical standards, they shall be responsible for assisting operation and use units to complete the related work of classified protection, including determining the security level of their classified protection objects, conducting security requirement analysis and overall security planning, implementing security construction and security transformation, and providing service support platform. e) Evaluation organization of classified cybersecurity protection They shall be responsible for assisting the operation and use units or the classified protection management departments according to the entrustment of the operation and use units or the authorization of the classified protection management departments, and evaluating the classified protection objects that have completed the classified protection construction according to the national classified protection of cybersecurity management norms and technical standards; and evaluating the security of cybersecurity products provided by cybersecurity product suppliers. f) Cybersecurity product suppliers They shall be responsible for developing cybersecurity products that meet the relevant requirements of classified protection in accordance with the management norms and technical standards of national classified protection of cybersecurity, and accepting security evaluation; and selling cybersecurity products and providing related services according to the relevant requirements of classified protection. 4.3 Implemented basic process The basic process of implementing classified protection for classified protection objects includes classification and filing stage for classified protection objects, overall security planning stage, security design and implementation stage, security operation and maintenance stage and classified object closure stage, as shown in Figure 1. Figure 1 Basic flow of implementing security classified protection In the stage of security operation and maintenance, the classified protection object is partially adjusted due to changes in demand and other reasons, without changing its security protection level. It shall enter the stage of security design and implementation from the stage of security operation and maintenance, and it shall be redesigned, adjusted and subjected to security measures to ensure that the requirements of classified protection are met; if there is a major change in the classified protection objects, which leads to the change of the security protection level, it is necessary to enter the classification and filing stage for classified protection objects from the stage of security operation and maintenance, and the implementation process of classified protection of cybersecurity shall be restarted. In the process of operation and maintenance of the classified protection objects, a security incident may trigger the emergency response and assurance. The main processes, activities, inputs and outputs of each stage in the basic process of implementing classified protection for classified protection objects are shown in Annex A. Foreword i 1 Scope 2 Normative references 3 Terms and definitions 4 Overview on classified protection implementation 4.1 Basic principles 4.2 Participants and their responsibilities 4.3 Implemented basic process 5 Classification and filing for classified protection objects 5.1 Workflow in classification and filing stage 5.2 Industry/field classification 5.3 Analysis of classified protection objects 5.3.1 Importance analysis for objects 5.3.2 Determination of classified objects 5.4 Determination of security protection level 5.4.1 Classification, audit and approval 5.4.2 Formation of classification report 5.5 Filing of classification results 6 Overall security planning 6.1 Workflow in overall security planning stage 6.2 Analysis on security requirements 6.2.1 Identification of basic security requirements 6.2.2 Determination of special security requirements 6.2.3 Forming of security requirements analysis report 6.3 Overall security design 6.3.1 Overall security policy design 6.3.2 Design of security technology architecture 6.3.3 Design of overall security management system architecture 6.3.4 Documentation of design results 6.4 Security construction project planning 6.4.1 Determination of security construction objectives 6.4.2 Security construction content planning 6.4.3 Forming of security construction project planning 7 Security design and implementation 7.1 Workflow in the stage of security design and implementation 7.2 Detailed design of security scheme 7.2.1 Design of technical measure implementations 7.2.2 Design of management measure implementation content 7.2.3 Documentation of design results 7.3 Implementation of technical measures 7.3.1 Procurement of cybersecurity products or services 7.3.2 Development of security control 7.3.3 Security control integration 7.3.4 System acceptance 7.4 Implementation of management measures 7.4.1 Establishment and revision of security management system 7.4.2 Setting of security management organization and personnel 7.4.3 Management during security implementation 8 Security operation and maintenance 8.1 Workflow in the stage of security operation and maintenance 8.2 Operation management and control 8.2.1 Determination of operation management responsibility 8.2.2 Operation management process control 8.3 Change management and control 8.3.1 Change demands and impact analysis 8.3.2 Change process control 8.4 Secure state monitoring 8.4.1 Determination of monitored object 8.4.2 Monitored object state collection 8.4.3 Monitoring state analysis and report 8.5 Security self-inspection and continuous improvement 8.5.1 Secure state self-inspection 8.5.2 Development of improvement scheme 8.5.3 Security improvement implementation 8.6 Service provider management and monitoring 8.6.1 Selection of service provider 8.6.2 Service provider management 8.6.3 Service provider monitoring 8.7 Testing and evaluation for classified cybersecurity protection 8.8 Supervision and inspection 8.9 Emergency response and security 8.9.1 Emergency preparation 8.9.2 Emergency monitoring and response 8.9.3 Post-evaluation and improvement 8.9.4 Emergency security 9 Closure of classified object 9.1 Workflow in the closure stage of classified object 9.2 Information transfer, temporary storage and clearing 9.3 Equipment migration or abandonment 9.4 Storage media removal or destruction Annex A (Normative) Main process and its activities, input and output 信息安全技术 网络安全等级保护实施指南 1 范围 本标准规定了等级保护对象实施网络安全等级保护工作的过程。 本标准适用于指导网络安全等级保护工作的实施。 2 规范性引用文件 下列文件对于本文件的应用是必不可少的。凡是注日期的引用文件，仅注日期的版本适用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改单)适用于本文件。 GB 17859 计算机信息系统 安全保护等级划分准则 GB/T 22239 信息安全技术 网络安全等级保护基本要求 GB/T 22240 信息安全技术 信息系统安全等级保护定级指南 GB/T 25069 信息安全技术 术语 GB/T 28448 信息安全技术 网络安全等级保护测评要求 3 术语和定义 GB 17859、GB/T 22239、GB/T 25069和GB/T 28448界定的术语和定义适用于本文件。 4 等级保护实施概述 4.1 基本原则 安全等级保护的核心是将等级保护对象划分等级，按标准进行建设、管理和监督。安全等级保护实施过程中应遵循以下基本原则： a) 自主保护原则 等级保护对象运营、使用单位及其主管部门按照国家相关法规和标准，自主确定等级保护对象的安全保护等级，自行组织实施安全保护。 b) 重点保护原则 根据等级保护对象的重要程度、业务特点，通过划分不同安全保护等级的等级保护对象，实现不同强度的安全保护，集中资源优先保护涉及核心业务或关键信息资产的等级保护对象。 c) 同步建设原则 等级保护对象在新建、改建、扩建时应同步规划和设计安全方案，投入一定比例的资金建设网络安全设施，保障网络安全与信息化建设相适应。 d) 动态调整原则 应跟踪定级对象的变化情况，调整安全保护措施。由于定级对象的应用类型、范围等条件的变化及其他原因，安全保护等级需要变更的，应根据等级保护的管理规范和技术标准的要求，重新确定定级对象的安全保护等级，根据其安全保护等级的调整情况，重新实施安全保护。 4.2 角色和职责 等级保护对象实施网络安全等级保护过程中涉及的各类角色和职责如下： a) 等级保护管理部门 等级保护管理部门依照等级保护相关法律、行政法规的规定，在各自职责范围内负责网络安全保护和监督管理工作。 b) 主管部门 负责依照国家网络安全等级保护的管理规范和技术标准，督促、检查和指导本行业、本部门或者本地区等级保护对象运营、使用单位的网络安全等级保护工作。 c) 运营、使用单位 负责依照国家网络安全等级保护的管理规范和技术标准，确定其等级保护对象的安全保护等级，有主管部门的，应报其主管部门审核批准；根据已经确定的安全保护等级，到公安机关办理备案手续；按照国家网络安全等级保护管理规范和技术标准，进行等级保护对象安全保护的规划设计；使用符合国家有关规定，满足等级保护对象安全保护等级需求的信息技术产品和网络安全产品，开展安全建设或者改建工作；制定、落实各项安全管理制度，定期对等级保护对象的安全状况、安全保护制度及措施的落实情况进行自查，选择符合国家相关规定的等级测评机构，定期进行等级测评；制定不同等级网络安全事件的响应、处置预案，对网络安全事件分等级进行应急处置。 d) 网络安全服务机构 负责根据运营、使用单位的委托，依照国家网络安全等级保护的管理规范和技术标准，协助运营、使用单位完成等级保护的相关工作，包括确定其等级保护对象的安全保护等级、进行安全需求分析、安全总体规划、实施安全建设和安全改造、提供服务支撑平台等。 e) 网络安全等级测评机构 负责根据运营、使用单位的委托或根据等级保护管理部门的授权，协助运营、使用单位或等级保护管理部门，按照国家网络安全等级保护的管理规范和技术标准，对已经完成等级保护建设的等级保护对象进行等级测评；对网络安全产品供应商提供的网络安全产品进行安全测评。 f) 网络安全产品供应商 负责按照国家网络安全等级保护的管理规范和技术标准，开发符合等级保护相关要求的网络安全产品，接受安全测评；按照等级保护相关要求销售网络安全产品并提供相关服务。 4.3 实施的基本流程 对等级保护对象实施等级保护的基本流程包括等级保护对象定级与备案阶段、总体安全规划阶段、安全设计与实施阶段、安全运行与维护阶段和定级对象终止阶段，见图1。 等级保护对象定级与备案 定级 评审 备案 总体安全规划 需求分析 总体设计 建设规划 安全设计与实施 详细设计 技术实现 管理实现 等级变更 局部调整 安全运行与维护 正常状态 异常状态 运行管控 变更管控 状态监控 应急准备 应急预案 监测响应 服务商管控 等级测评 检查改进 评估改进 应急保障 定级对象终止 信息处理 设备处置 存储介质处理 图1 安全等级保护工作实施的基本流程 在安全运行与维护阶段，等级保护对象因需求变化等原因导致局部调整，而其安全保护等级并未改变，应从安全运行与维护阶段进入安全设计与实施阶段，重新设计、调整和实施安全措施，确保满足等级保护的要求；当等级保护对象发生重大变更导致安全保护等级变化时，应从安全运行与维护阶段进入等级保护对象定级与备案阶段，重新开始一轮网络安全等级保护的实施过程。等级保护对象在运行与维护过程中，发生安全事件时可能会发生应急响应与保障。 等级保护对象安全等级保护实施的基本流程中各个阶段的主要过程、活动、输入和输出见附录A。 5 等级保护对象定级与备案 5.1 定级与备案阶段的工作流程 等级保护对象定级阶段的目标是运营、使用单位按照国家有关管理规范和定级标准，确定等级保护对象及其安全保护等级，并经过专家评审。运营、使用单位有主管部门的，应经主管部门审核、批准，并报公安机关备案审查。 等级保护对象定级与备案阶段的工作流程见图2。 输入 行业介绍文档 GB/T 22240 行业/领域定级指导意见 行业/领域定级工作部署文件 单位情况说明文档 等级保护对象的立项、建设和管理文档 GB/T 22240 行业/领域定级指导意见 等级保护对象总体描述文件 定级对象详细描述文件 安全保护等级定级报告 主管部门审核意见 等级保护对象安全总体方案 安全详细设计方案 安全等级测评报告 主要过程 行业/领域定级工作 等级保护对象分析 安全保护等级确定 定级结果备案 输出 行业/领域的业务总体描述文件 行业/领域定级指导意见 行业/领域定级工作部署文件 等级保护对象总体描述文件 定级对象详细描述文件 主管部门审核意见 安全保护等级定级报告 备案材料 备案证明 图2 定级与备案阶段工作流程 5.2 行业/领域定级工作 活动目标： 行业/领域主管部门在必要时可组织梳理行业/领域的主要社会功能/职能及作用，分析履行主要社会功能/职能所依赖的主要业务及服务范围，最后依据分析和整理的内容形成行业/领域的业务总体描述性文档。 参与角色：主管部门，网络安全服务机构。 活动输入：行业介绍文档，GB/T 22240。 活动描述： 本活动主要包括以下子活动内容： a) 识别、分析行业/领域重要性 主管部门可组织梳理本行业/领域的行业特征、业务范围、主要社会功能/职能和生产产值等信息，分析主要社会功能/职能在保障国家安全、经济发展、社会秩序、公共服务等方面发挥的重要作用。 b) 识别行业/领域的主要业务 主管部门可组织梳理本行业/领域内主要依靠信息化处理的业务情况，并按照业务承载的社会功能/职能的重要程度、其他行业对其的依赖程度等方面确定本行业/领域内的主要业务。 c) 定级指导 主管部门可组织分析本行业/领域内的主要业务，并根据业务信息重要性和业务服务重要性分析各主要业务的安全保护要求，结合行业/领域自身情况，形成针对主要业务的行业/领域定级指导意见。跨省或者全国统一联网运行的等级保护对象可以由主管部门统一确定安全保护等级。 d) 定级工作部署 主管部门可制定本行业/领域的定级指导意见，并统一部署全行业/领域的定级工作。行业/领域主管部门应对下属单位的定级结果进行审核、批准。 活动输出：行业/领域的业务总体描述文件，行业/领域定级指导意见，行业/领域定级工作部署文件。 5.3 等级保护对象分析 5.3.1 对象重要性分析 活动目标： 通过收集了解有关等级保护对象的信息，并对信息进行综合分析和整理，分析单位的主要社会功能/职能及作用，确定履行主要社会功能/职能所依赖的等级保护对象，整理等级保护对象处理的业务及服务范围，最后依据分析和整理的内容，有行业/领域定级指导意见的还应依据行业/领域定级指导意见，形成单位内等级保护对象的总体描述性文档。 参与角色：运营、使用单位，网络安全服务机构。 活动输入：单位情况说明文档，等级保护对象的立项、建设和管理文档，行业/领域定级指导意见。 活动描述： 本活动主要包括以下子活动内容： a) 识别单位的基本信息 调查了解等级保护对象所属单位的业务范围、主要社会功能/职能和生产产值等信息，分析主要社会功能/职能在保障国家安全、经济发展、社会秩序、公共服务等方面发挥的重要作用。 b) 识别单位的等级保护对象基本信息 了解单位内主要依靠信息化处理的业务情况，这些业务各自的社会属性和业务内容，确定单位的等级保护对象。并确定等级保护对象的业务范围、地理位置以及其他基本情况，获得等级保护对象的背景信息和联络方式。 c) 识别等级保护对象的管理框架 了解等级保护对象的组织管理结构、管理策略、部门设置和部门在业务运行中的作用、岗位职责，获得支撑等级保护对象业务运营的管理特征和管理框架方面的信息，从而明确等级保护对象的安全责任主体。 d) 识别等级保护对象的网络及设备部署 了解等级保护对象的物理环境、网络拓扑结构和硬件设备的部署情况，在此基础上明确等级保护对象的边界，即确定等级保护对象及其范围。 e) 识别等级保护对象的业务特性 了解单位内主要依靠信息化处理的各种业务及业务流程，从中明确支撑单位业务运营的等级保护对象的业务特性。 f) 识别等级保护对象处理的信息资产 了解等级保护对象处理的信息资产的类型，这些信息资产在保密性、完整性和可用性等性程度。 g) 识别用户范围和用户类型 根据用户或用户群的分布范围了解等级保护对象的服务范围、作用以及业务连续性方面的要求等。 h) 等级保护对象描述 对收集的信息进行整理、分析，形成对等级保护对象的总体描述文件。一个典型的等级保护对象的总体描述文件应包含以下内容： 1) 等级保护对象概述； 2) 等级保护对象重要性分析； 3) 等级保护对象边界描述； 4) 网络拓扑； 5) 设备部署； 6) 支撑的业务应用的种类和特性； 7) 处理的信息资产； 8) 用户的范围和用户类型； 9) 等级保护对象的管理框架。 活动输出：等级保护对象总体描述文件。 5.3.2 定级对象确定 活动目标： 依据单位的等级保护对象总体描述文件(有行业/领域定级指导意见的还应依据行业/领域定级指导意见)，在综合分析的基础上将单位内运行的等级保护对象进行合理分解，确定所包含的定级对象及其个数。 参与角色：运营、使用单位，网络安全服务机构。 活动输入：行业/领域定级指导意见，行业/领域定级工作部署文件，等级保护对象总体描述文件，GB/T 22240。 活动描述： 本活动主要包括以下子活动内容： a) 划分方法的选择 为了突出重点保护的等级保护原则，运营、使用单位应对大型等级保护对象进行划分，划分的方法可以有多种，可以考虑管理机构、业务类型、物理位置等因素，运营、使用单位应根据本单位的具体情况确定等级保护对象的分解原则。 b) 等级保护对象划分 依据选择的等级保护对象划分原则，参考行业/领域定级指导意见(若有行业/领域定级指导意见)，运营、使用单位应将大型等级保护对象进行划分，划分出相对独立的对象作为定级对象，应保证每个相对独立的对象具备定级对象的基本特征。在等级保护对象划分的过程中，应首先考虑组织管理的要素，然后考虑业务类型、物理区域等要素。承载比较单一的业务应用或者承载相对独立的业务应用的对象应作为单独的定级对象。 对于电信网、广播电视传输网等通信网络设施，应分别依据安全责任主体、服务类型或服务地域等因素将其划分为不同的定级对象。跨省的行业或单位的专用通信网可作为一个整体对象定级，或分区域划分为若干个定级对象。 在云计算环境中，应将云服务客户侧的等级保护对象和云服务商侧的云计算平台/系统分别作为单独的定级对象定级，并根据不同服务模式将云计算平台/系统划分为不同的定级对象。对于大型云计算平台，宜将云计算基础设施和有关辅助服务系统划分为不同的定级对象。 物联网主要包括感知、网络传输和处理应用等特征要素，应将以上要素作为一个整体对象定级，各要素不单独定级。 对于工业控制系统，其一般包含现场采集/执行、现场控制、过程控制和生产管理等特征要素。其中，现场采集/执行、现场控制、过程控制等要素应作为一个整体对象定级，各要素不单独定级；生产管理要素宜单独定级。对于大型工业控制系统，可以根据系统功能、责任主体、控制对象和生产厂商等因素划分为多个定级对象。 采用移动互联技术的等级保护对象主要包括移动终端、移动应用和无线网络等特征要素，可作为一个整体独立定级或与相关联业务系统一起定级，各要素不单独定级。 c) 定级对象详细描述 在对等级保护对象进行划分并确定定级对象后，应在等级保护对象总体描述文件的基础上，进一步增加定级对象的描述，准确描述一个大型等级保护对象中包括的定级对象的个数。 进一步的定级对象详细描述文件应包含以下内容： 1) 相对独立的定级对象列表； 2) 每个定级对象的概述； 3) 每个定级对象的边界； 4) 每个定级对象的设备部署； 5) 每个定级对象支撑的业务应用及其处理的信息资产类型； 6) 每个定级对象的服务范围和用户类型； 7) 其他内容。 活动输出：定级对象详细描述文件。 5.4 安全保护等级确定 |
联系我们
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
微信联系客服
|
| 关于我们 | 联系我们 | 收费付款 |
| 服务热线：400-001-5431 | 电话：010-8572 5110 | 传真：010-8581 9515 | Email: bz@bzfyw.com | |
版权所有： 北京悦尔信息技术有限公司 2008-2020 京ICP备17065875号-1
|
| 本页关键词： |
| GB/T 25058-2019, GB 25058-2019, GBT 25058-2019, GB/T25058-2019, GB/T 25058, GB/T25058, GB25058-2019, GB 25058, GB25058, GBT25058-2019, GBT 25058, GBT25058 |