GB/T 19668.4-2017Information technology service—Surveillance—Part 4: Information security surveillance specification (English PDF)

Foreword

GB/T 19668 "Information Technology Services Supervision" is divided into six parts.

--- Part 1. General principles;

--- Part 2. Infrastructure project supervision norms;

--- Part 3. O & M supervision specification;

--- Part 4. Information security supervision norms;

--- Part 5. Software Engineering Supervision Specifications;

--- Part 6. Application system. Data center project supervision specification.

This section GB/T 19668 Part 4.

This section drafted in accordance with GB/T 1.1-2009 given rules.

This Part replaces GB/T 19668.6-2007 "Information Engineering Supervision Part 6: Information Engineering Safety Supervision Code,"

Compared with GB/T 19668.6-2007, the main technical changes are as follows.

--- Added "Information Security, Information Security Supervision", "Safety Engineering", "Risk Assessment", "Security Requirements", "Level Protection" A total of 9 definitions of "safety control measures", "compliance" and "safety strategy" (see 3.2 ~ 3.9);

--- Removed the term of information engineering safety supervision;

--- New planning and design section, including goals, content, points (see Chapter 5);

--- The original standard project bidding stage, engineering design phase, project implementation phase and project acceptance phase into the deployment of the implementation of the part (See Chapter 6);

--- Modify the project bidding stage supervision objectives, supervision content, supervision points (see 6.1.1, 6.1.2 and 6.1.3);

--- Modify the engineering design phase of the supervision objectives, supervision content, supervision points (see 6.2.1,6.2.2 and 6.2.3);

--- The original standard engineering design phase supervision points in the "security needs analysis" deleted, the original "engineering design scheme" is divided into "system Structural Design "and" Detailed Design "(see 6.2.3.1 and 6.2.3.2);

--- Modify the project implementation phase supervision objectives, supervision content, supervision points (see 6.3.1, 6.3.2 and 6.3.3);

--- Project Implementation Stage Supervision points in the "project implementation plan and project implementation organization plan" to "project implementation plan" (see 6.3.3.1), addition of "safety control measures" (see 6.3.3.2), modification of "safety equipment acceptance" (see 6.3.3.3), Modify "Engineering Experiment Management" to "Safety Management in Engineering Implementation" (see 6.3.3.4);

--- Modify the project acceptance stage supervision objectives, supervision content, supervision points (see 6.4.1,6.4.2 and 6.4.3);

--- Project acceptance phase of the supervision points deleted the "Information System Security Assessment" to increase the "project acceptance program" (see 6.4.3.2), will be "Project Acceptance" was revised to "Project Acceptance Management" (see 6.4.3.3);

--- Removed the original standard "various types of information technology project safety supervision points";

--- Increased normative appendix Information Systems Engineering safety compliance requirements (see Appendix A);

--- Increased normative appendix information system engineering safety technical requirements (see appendix B);

--- Increased information appendix information system engineering safety supervision work form (see Appendix C).

1 Scope

GB/T 19668 provisions of this part of the information systems engineering, construction, upgrading, transformation of the various stages of information security supervision of the main To the goal, content and points.

This section applies to information systems engineering construction planning and design, bidding, design, implementation and acceptance of the stage of information security Supervision and management.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version applies to this document. For undated references, the latest edition (including all amendments) applies to this document.

Computerized site safety requirements GB/T 9361-2011

Information technology service supervisors Part 1: General principles

Information security technology Information security risk assessment code

3 Terms and definitions

GB/T 19668.1-2014 defined and the following terms and definitions apply to this document.