GA 1277.1-2020Security management requirements for internet interactive service - Part 1: Basic requirements (English PDF)

Foreword

GA 1277 "Internet Interactive Service Security Management Requirements" is planned to be divided into multiple parts, including basic requirements and specific service types.

Claim. The following parts are currently planned to be released.

---Part 1: Basic requirements;

---Part 2: Microblogging service;

---Part 3: Audio and video chat room service;

---Part 4: Instant messaging service;

---Part 5: Forum services;

---Part 6: Mobile application software publishing platform;

---Part 7: Cloud services;

---Part 8: E-commerce platform;

---Part 9: Search Service;

---Part 10: Internet car-hailing service;

---Part 11: Internet short-term housing services;

This part is part 1 of GA 1277.

This section was drafted in accordance with the rules given in GB/T 1.1-2009.

This part replaces GA 1277-2015 "Information Security Technology Internet Interactive Service Security Protection Requirements", and GA 1277-the main technical changes compared to 2015 are as follows.

---Modified the standard name, from "Information Security Technology Internet Interactive Service Security Protection Requirements" to "Internet Interactive Service Security Management Requirements, and divided into multiple parts, this part is ``Part 1: Basic Requirements'' (see cover, cover of the 2015 edition);

---Modified the definition of "interactive Internet service" in "3 terms and definitions", and added "personal information" and "personnel in key positions" the definition of "personal information security incident" (see 3.1, 3.4, 3.5, 3.6, 3.1 in the 2015 edition);

--- Revised "4.1 System and Regulations", added a safety responsibility system, information inspection system, safety incident monitoring, early warning, notification and Emergency response system, etc., and at the same time complete the content of "8.1 Operating Procedures" and place it in 4.1.1 (see 4.1, 4.1.3, and 4.1.1, 4.1.3, 8.1 of the 2015 edition);

--- Modify "5 Institutional Requirements" to "5 Organizational Institutions", and "5.1 Legal Liability" to "5.1 Institutional Requirements" (see Chapter 5, 5.1, Chapter 5, 5.1 of the 2015 edition);

---Added the content of "5.2 Filing" (see 5.2);

--- Modified "8 Network and Operation Security" to "8 Security Technical Measures", the original "8.2 Network and Host System Security" was modified to "8.1 Network and system operation security" and its content has been added (see Chapter 8, 8.1, Chapter 8, 8.2 of the 2015 edition);

---Modified "8.3 backup" to "8.2 data security and backup", and added its content (see 8.2, 8.3 in the 2015 edition);

---Modified "8.4 Security Audit" to "8.3 Log and User Data Record", and modified its content, such as combining the log and notes Separation of information in the booklet (see 8.3, 8.4 in the 2015 edition);

--- Modified "9 application security" to "9 business security" (see Chapter 9, Chapter 9 of the 2015 edition);

---Added the effective verification method of user's real identity information based on biometrics [see 9.2.2a)];

---Added technical measures for filtering illegal and harmful information [see 9.3.4)];

---Modified the relevant content of "10.2 Technical Measures" (see 10.2, 10.2 of the 2015 edition);

--- Modify "10.3 Handling of Personal Information Leakage Incidents" to "10.3 Handling of Personal Information Security Incidents", and modify the specific Content (see 10.3, 10.3 of the 2015 edition).

This part was proposed by the Cyber Security Bureau of the Ministry of Public Security.

This part is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.

This section was drafted. Cyber Security Bureau of the Ministry of Public Security, the Third Research Institute of the Ministry of Public Security.

1 Scope

This part of GA 1277 specifies the security management requirements for Internet interactive services.

This section applies to Internet interactive service providers to implement Internet security management systems and security technical measures.

2 Normative references

The following documents are indispensable for the application of this document. For dated reference documents, only the dated version applies to this article Pieces. For undated references, the latest version (including all amendments) applies to this document.

GB/T 20985.1-2017 Information Technology Security Technology Information Security Incident Management Part 1: Principles of Incident Management GB/Z 20986-2007 Information Security Technology Information Security Incident Classification and Classification Guidelines GB/T 22239 Information Security Technology Network Security Level Protection Basic Requirements GB/T 35273-2020 Information Security Technology Personal Information Security Specification GA 1278-2015 Information Security Technology Internet Service Security Assessment Basic Procedures and Requirements

3 Terms and definitions

GB/T 22239, GB/T 20985.1-2017, GB/Z 20986-2007, GB/T 35273-2020 and GA 1278-2015 the defined and the following terms and definitions apply to this document. For ease of use, some terms and definitions in GB/T 35273-2020 are listed repeatedly below.

Internet interactive service Through the Internet, provide users with information to the public and related services based on information interaction.

Note 1.Interactive forms include text, pictures, audio and video, etc.

Note 2.Including but not limited to forums, communities, post bars, text or audio and video chat rooms, microblogs, blogs, instant messaging, e-commerce platforms, search, Internet appointments Internet information services such as cars, Internet short-term rentals, mobile downloads, shared storage, third-party payment, and cloud services.

Illegal and harmful information Violating national laws and regulations, endangering national security, honor and interests, public safety, social ethics, public order and good customs, and the personal and property security of citizens Information about legal rights and interests.

Destructive program

Have the functions of computer information system or the unauthorized acquisition, deletion, addition, modification, interference, storage, processing and transmission of data Destruction and other functions of the program.