GA 1277.8-2023Security management requirements for internet interactive service - Part 8: E-commerce service (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting:

This document is part 8 of GA 1277 "Internet Interactive Service Security Management Requirements": GA 1277 has released the following parts:

--- Part 1: Basic requirements;

--- Part 2: Microblog service;

--- Part 3: Audio and video chat room services;

--- Part 4: Instant messaging service;

--- Part 5: Forum services;

--- Part 6: Mobile application software distribution service;

--- Part 7: Cloud services;

--- Part 8: E-commerce services;

--- Part 9: Search service:

Please note that some contents of this document may refer to patents: The issuing agency of this document assumes no responsibility for identifying patents:

This document was proposed by the Cyber Security Bureau of the Ministry of Public Security:

This document is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security:

Introduction

GA 1277 aims to regulate and guide Internet interactive service providers to implement the "Network Security Law of the People's Republic of China" and "Chinese People's According to laws and regulations such as the Data Security Law of the People's Republic of China and the Personal Information Protection Law of the People's Republic of China, the security management system and security Technical measures, etc:, are proposed to be composed of 11 parts:

--- Part 1: Basic requirements: The purpose is to specify the basic requirements for the security management of Internet interactive services:

--- Part 2: Microblogging service: The purpose is to standardize and clarify the microblog service security management requirements:

--- Part 3: Audio and video chat room services: The purpose is to standardize and clarify the security management requirements for audio and video chat room services:

--- Part 4: Instant Messaging Services: The purpose is to standardize and clarify the security management requirements of instant messaging services:

--- Part 5: Forum services: The purpose is to standardize and clarify the safety management requirements of forum services:

--- Part 6: Mobile application software distribution services: The purpose is to standardize and clarify the security management of mobile application software distribution services Require:

--- Part 7: Cloud services: The purpose is to standardize and clarify cloud computing platform service security management requirements:

--- Part 8: E-commerce services: The purpose is to standardize and clarify e-commerce service security management requirements:

--- Part 9: Search service: The purpose is to standardize and clarify the search service security management requirements:

--- Part 10: Internet car-hailing service: The purpose is to standardize and clarify the safety management requirements for Internet car-hailing services:

--- Part 11: Internet short-term rental housing information service: The purpose is to standardize and clarify the security management of Internet short-term rental housing information services Require:

In order to strengthen the security management of e-commerce services and strengthen the implementation of e-commerce service security subject responsibilities, this document combines e-commerce service features specific requirements for the implementation of the safety protection management system and safety protection technical measures:

Internet interactive service security management requirements Part 8: E-Commerce Services

1 Scope

This document specifies the security management requirements for e-commerce services:

This document applies to Internet interactive service providers implementing e-commerce service security protection management systems and security protection technologies measure:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references for documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document:

GA 1277.1-2020 Internet Interactive Service Security Management Requirements Part 1: Basic Requirements

3 Terms and Definitions

GA 1277.1-2020 and the following terms and definitions apply to this document:

E-commerce service E-commerceservice in commodity trading activities on the Internet, it provides webpage space, virtual business place, trading rules, and transaction matching for both parties or multiple parties:

Cooperation, information release and other services:

E-commerce platform E-commerceplatform an information network system built for e-commerce services for two or more parties to conduct transactions independently:

E-commerce customer

Organizations and individuals who have identity registration information on the e-commerce platform and use the e-commerce platform:

Organizations and individuals that provide e-commerce services based on e-commerce platforms:

4 Safety Management System

E-commerce service providers should formulate and maintain a safety management system in accordance with the requirements of Chapter 4 of GA 1277.1-2020: