GB/T 20274.1-2023Information security technology—Evaluation framework for information systems security assurance—Part 1:Introduction and general model (English PDF)

3.1 Information system

Information system refers to a combination of applications, services, information technology assets or other information processing components.

3.2 Information system security assurance

Information system security assurance refers to a series of appropriate behaviors or processes that guarantee the security attributes, functions and efficiency of information system.

5.1 Concept of Assurance

Information system operates in a specific real environment. It belongs to a certain organization, and is constrained by the internal and external environment of the organization. Hence, in addition to putting forward corresponding requirements on the basis of thoroughly analyzing the technology, business and management characteristics of the information system itself, the security assurance of information system must also consider the requirements arising from these constraint conditions.

5.3 Assurance Capability Level

The information system security assurance capability level includes elements of two dimensions. The first dimension is information system security assurance elements (including technical assurance requirements, management assurance requirements and engineering assurance requirements) selected based on risk evaluation. The identification of these security assurance elements, which is carried out throughout the life cycle process, can reduce the risk to an acceptable level (that is, the adequacy of assurance countermeasures).

6.1 Structure of Information System Security Assurance Elements

In accordance with the differences of the fields of security techniques, security management and security engineering, the security assurance elements are divided into security technical assurance requirements, security management assurance requirements and security engineering assurance requirements. The security assurance elements adopt a hierarchical structure of "class - subclass - component". Users shall select specific security assurance requirements based on the results of risk evaluation. The relations between different structures of the security assurance elements are shown in Figure 3.

6.2 Generation of Information System Security Assurance Elements

6.2.1 Generation process of security assurance elements

Figure 4 provides an example of a method for confirming the information system security assurance elements, through which, security assurance elements can be derived. The example provided does not limit the specific analysis process, development method and evaluation system of generating the information system security assurance elements.

6.2.5 Confirmation of security assurance elements

The security assurance elements of the information system are to subdivide the security assurance goals into a series of security assurance requirements of the information system and its environment. Once these requirements are satisfied, it can be guaranteed that the information system can achieve its security assurance goals.

7.1 Concept and Relations of Evaluation of Information System Security Assurance

The evaluation of information system security assurance is to conduct an objective evaluation of the specific work and activities of information system security assurance in the operating environment where the information system is located.

7.2 Evaluation Content of Information System Security Assurance

In the information system security assurance model, the life cycle level and the security assurance element level of the information system are not isolated from each other, but interrelated and inseparable. Their relations are shown in Figure 6. […]