GA 1277.7-2023Security management requirements for internet interactive service - Part 7: Cloud service (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting:

This document is Part 7 of GA 1277 "Internet Interactive Service Security Management Requirements": GA 1277 has released the following parts:

--- Part 1: Basic requirements;

--- Part 2: Microblog service;

--- Part 3: Audio and video chat room services;

--- Part 4: Instant messaging service;

--- Part 5: Forum services;

--- Part 6: Mobile application software distribution service;

--- Part 7: Cloud services;

--- Part 8: E-commerce services;

--- Part 9: Search service:

Please note that some contents of this document may refer to patents: The issuing agency of this document assumes no responsibility for identifying patents:

This document was proposed by the Cyber Security Bureau of the Ministry of Public Security:

This document is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security:

Introduction

GA 1277 aims to regulate and guide Internet interactive service providers to implement the "Network Security Law of the People's Republic of China" and "Chinese People's According to laws and regulations such as the Data Security Law of the People's Republic of China and the Personal Information Protection Law of the People's Republic of China, the security management system and security Technical measures, etc:, are proposed to be composed of 11 parts:

--- Part 1: Basic requirements: The purpose is to specify the basic requirements for the security management of Internet interactive services:

--- Part 2: Microblogging service: The purpose is to standardize and clarify the microblog service security management requirements:

--- Part 3: Audio and video chat room services: The purpose is to standardize and clarify the security management requirements for audio and video chat room services:

--- Part 4: Instant Messaging Services: The purpose is to standardize and clarify the security management requirements of instant messaging services:

--- Part 5: Forum services: The purpose is to standardize and clarify the safety management requirements of forum services:

--- Part 6: Mobile application software distribution services: The purpose is to standardize and clarify the security management requirements of mobile application software distribution services:

--- Part 7: Cloud services: The purpose is to standardize and clarify cloud computing platform service security management requirements:

--- Part 8: E-commerce services: The purpose is to standardize and clarify e-commerce service security management requirements:

--- Part 9: Search service: The purpose is to standardize and clarify the search service security management requirements:

--- Part 10: Internet car-hailing service: The purpose is to standardize and clarify the safety management requirements for Internet car-hailing services:

--- Part 11: Internet short-term rental housing information service: The purpose is to standardize and clarify the security management of Internet short-term rental housing information services Require:

In order to strengthen the security management of cloud services and strengthen the implementation of the responsibility of the security subject of the cloud computing platform, this document proposes its implementation in combination with the characteristics of cloud services:

Specific requirements for safety protection management system and safety protection technical measures:

Internet interactive service security management requirements Part 7: Cloud Services

1 Scope

This document specifies cloud service security management requirements:

This document applies to Internet interactive service providers implementing cloud service security protection management systems and security protection technical measures:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references for documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GB/T 20985.1 Information Technology Security Technology Information Security Incident Management Part 1: Principles of Incident Management GB/Z 20986 Guidelines for classification and grading of information security technology and information security incidents GB/T 22239-2019 Basic Requirements for Network Security Level Protection of Information Security Technology GB/T 35273 Personal Information Security Specifications for Information Security Technology GA 1277.1-2020 Internet Interactive Service Security Management Requirements Part 1: Basic Requirements GA 1278 Basic Procedures and Requirements for Internet Service Security Assessment of Information Security Technology

3 Terms and Definitions

The following terms and Definitions apply to this document:

cloud computing Access scalable and flexible physical or virtual shared resource pools through the network, and self-service acquisition and management of resources on demand:

Note: Examples of resources include servers, operating systems, networks, software, applications and storage devices, etc:

[Source: GB/T 31168-2014, 3:1] 3.2 the ability to provide one or more resources with the help of cloud computing using defined interfaces:

[Source: GB/T 31168-2014, 3:2] 3.3 cloud service provider Provider of cloud computing services:

Note: The cloud service provider manages, operates, and supports cloud computing infrastructure and software, and pays for cloud computing resources through the network:

[Source: GB/T 31168-2014, 3:3]