GA/T 2182-2024Information security technology - Evaluation requirements for cybersecurity for critical information infrastructure (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

This document is consistent with GB/T 22239 "Basic requirements for information security technology network security level protection" and GB/T 28448 "Information security technology network security level protection basic requirements" "Network Security Level Protection Assessment Requirements" and GB/T 39204 "Information Security Technology Key Information Infrastructure Security Protection Requirements" Constitutes a series of standards for the security protection of critical information infrastructure.

Introduction

In order to cooperate with the implementation of the Cybersecurity Law of the People's Republic of China and the Regulations on the Security Protection of Critical Information Infrastructure, Based on the security level protection system, we fully draw on the relevant departments of our country to carry out network security review, network security inspection and other key areas.

We should fully absorb the measures taken by foreign countries in the security protection of key information infrastructure and combine them with the existing network security testing and Based on the evaluation and assessment results, requirements and standards for security assessment of critical information infrastructure are proposed.

Information security technology Critical information infrastructure security Assessment requirements

1 Scope

This document specifies the requirements and methods for conducting cybersecurity assessments on critical information infrastructure.

This document is applicable to the security testing and assessment of critical information infrastructure carried out by operators of critical information infrastructure and security testing and assessment service agencies.

Review work.

2 Normative references

The contents of the following documents constitute essential clauses of this document through normative references in this document.

For referenced documents without a date, only the version corresponding to that date applies to this document; for referenced documents without a date, the latest version (including all amendments) applies to this document.

GB/T 20984-2022 Information security technology Information security risk assessment method GB/T 22239-2019 Information security technology - Basic requirements for cybersecurity level protection GB/T 25069-2022 Information Security Technical Terminology GB/T 28448-2019 Information security technology network security level protection assessment requirements GB/T 39204-2022 Information security technology - Security protection requirements for critical information infrastructure

3 Terms and definitions

GB/T 22239-2019, GB/T 25069-2022, GB/T 28448-2019 and GB/T 39204-2022 and the following terms and definitions apply to this document.

Public communications and information services, energy, transportation, water conservancy, finance, public services, e-government, national defense science and technology industry and other important industries and fields domains, and other important information that, if destroyed, loses function, or has its data leaked, may seriously endanger national security, national economy and people's livelihood, and public interests.

Requires network facilities, information systems, etc.

[Source. GB/T 39204-2022, 3.1] 3.2 Supply Chain A set of organizations that links multiple resources and processes together to establish a continuous supply relationship based on a service agreement or other purchasing agreement.

NOTE Each of these organizations may act as a demander, a supplier, or both.

[Source. GB/T 39204-2022, 3.2] 3.3 an organization's key business processes comprise one or more interrelated businesses.

[Source. GB/T 39204-2022, 3.3]