GB/T 20269-2006Information security technology Information system security management requirements (English PDF)

3.1 Integrity

It includes data security and system security. Data security represents all the characteristics of data, i.e.

3.2 Availability

Security attribute that represents the extent of being accessed or used upon the request of authorized entity.

3.3 Access control

Security mechanism that controls access activities between entities based on a specific rule and can prevent unauthorized use of resources.

3.4 Security audit

Security mechanism that audits security-related event, records necessary information in the form of log, and properly processes according to the requirements of determined rules.

3.5 Authentication information

Information that is used to confirm the authenticity of identity information.

3.6 Sensitivity

Characteristics that represent resource value or importance and may also contain the vulnerability of these resources.

4.2 Information system security management principles

5.1 Policy and system

5.1.1 Information security management policy

5.1.1.1 Security management objectives and scope

5.1.2 Security management rules and regulations

5.1.2.1 Contents of security management rules and regulations

Develop rules and systems on information system security management based on overall security policy of organization and business application requirement; contents of security management rules and regulations for different security levels shall selectively meet one of the following requirements. […]

5.1.3 Policy and system document management

5.1.3.1 Review and revision of policy and system document

For review and revision of policy and system document, different security levels shall selectively meet one of following requirements.

5.2.1.2 Information security leading group

Information system security leading group is responsible for information system security work of the organization; exercise at least one of following management functions.

5.2.1.3 Information security functional department

Information security functional department is responsible for specific work of information system security of the organization under the guidance of information system security leading group and shall exercise at least one of following management functions.

5.2.2 Security mechanism centralized management organization

5.2.2.1 Setting centralized management organization

Security mechanism centralized management organization of information system (hereinafter referred to as centralized management organization) is not only a technical entity but also a management entity and shall be set based on following mode.

5.2.2.2 Functions of centralized management agency

5.2.3 Personnel management

5.2.3.1 Allocation of security management personnel

For management of security management personnel allocation, different security levels shall selectively meet one of following requirements.

5.2.3.2 Management of personnel at key posts

For the management of personnel at key posts in information system, different security levels shall meet one or more of following requirements.

5.2.3.3 Personnel appointment management

For personnel appointment management, different security levels shall selectively meet one of following requirements.

5.2.3.4 Personnel off-post

For personnel off-post management, different security levels shall selectively meet one of following requirements.

5.2.3.5 Staff assessment and review

For staff assessment and review management, different levels of security shall selectively meet one of following requirements.

5.2.3.6 Third-party personnel management

For third-party personnel management, different security levels shall selectively meet one of following requirements.

5.2.4 Education and training

5.4 Environment and resource management

5.4.1 Environment security management

5.4.1.1 Environment security management requirements

For environment security management, different security levels shall selectively meets one of following requirements.

5.8 Life cycle management

5.8.1 Plan and project approval management

5.8.1.1 System planning requirements

For system planning requirements, different security shall at least meet one or more of the following requirements. […]

6.1 Level-one. User discretionary protection level

6.1.1 Management objective and scope

It is the level of user discretionary protection where basic management and discretionary protection is executed. It applies to general information and information system whose destruction may have a certain impact on the interests of citizens, legal persons and other organizations but will not endanger state security, social order, economic construction or public interests.

6.1.2 Policy and system requirements

Requirements of this level are as follows. […]

6.1.3 Organization and personnel management requirements

Requirements of this level are as follows. […]

6.1.4 Risk management requirements

Requirement of this level are as follows. […]

6.1.5 Environment and resource management requirements

Requirements of this level are as follows. […]

6.5 Level-five. Access verification protection level

6.5.1 Management objectives and scope

This level is access verification protection level, implementing continuous improvement management and carrying out exclusive control protection, which is suitable for important information related to national security, social order, economic construction and public interests and core subsystems of information systems.

6.5.2 Policy and system requirements

The requirements of this level are as follows based on that the management requirements of level-four are met. […]