GB/T 20274.2-2026Cybersecurity technology — Evaluation framework for information system security assurance — Part 2: Security assurance requirements (English PDF)

3 Terms and definitions

4 Evaluation framework for the information system security assurance

5 Capability levels of the information system security assurance

6 Technical assurance components

7 Management assurance components

Foreword

This document was issued on 25 May 2026 by the State Administration for Market Regulation and the Standardization Administration of the People's Republic of China, and takes effect on 1 December 2026.

It replaces GB/T 20274.2-2008, which remains in force until that date.

The document is under the responsibility of the Standardization Administration of China.

Classification: ICS 35.030, CCS L 80.

3 Classification and status

GB/T 20274.2-2026 is classified under ICS 35.030, in the field of information technology. ICS is the International Classification for Standards, the same scheme used by ISO and by the national bodies of most countries, which is what allows a Chinese standard to be placed beside its foreign counterparts on subject rather than on number.

Its Chinese Standard Classification code is CCS L 80. CCS is the domestic scheme, a letter for the sector and two digits for the subject within it, and it is the code by which the standard is filed and searched in China.

The GB/T prefix marks a recommended national standard. It is not, in itself, law: it becomes binding when a contract names it, when a regulation or a mandatory standard refers to it, or when a producer declares conformity with it. In practice that covers most of the cases in which it will be read — a purchase specification, an inspection agreement or a certification scheme.

The document is under the responsibility of the Standardization Administration of China, which is the body that maintains it and that will answer a formal question about its interpretation.