GB/T 20282-2006Information security technology - Information system security engineering management requirements (English PDF)

3.1 Security engineering

The process of system engineering that ensures confidentiality, integrity and availability of information system.

3.2 Security engineering lifecycle

Activities that relate to security engineering throughout the lifecycle of information system, including concept formation, concept development and definition, verification and validation, engineering implementation development and manufacture, production and deployment, operation and support, and termination.

3.3 Security engineering guide

Guiding information that is defined by engineering group on how to select, design and implement engineering system structure.

3.4 Vulnerability

A weakness of an asset or a group of assets, which can be exploited by certain threat.

3.5 Risk

The probability for certain threat that makes an asset or a group of assets lost or damaged by exploiting its or their vulnerability.

4.1 Overview

This Standard defines that security engineering management requirements system consists of specific requirements for different grades of engineering.

4.2 Goal of Security Engineering

Understand security risks of the owner, base reasonable security requirements on the identified security risks, translate security requirements to security guides that can be used for other implementation activities of the project, set up confidence and assurance about information security on the basis of proper and effective security mechanism;

4.3 Fundamental Relation

Security engineering is composed of security level and assurance and implementation, and different levels of security engineering correspond to different requirements of assurance and implementation. The assurance consists of qualification assurance requirements and organizational assurance requirements while the implementation consists of engineering implementation requirements and project implementation requirements.

5.1 System Integration Qualification Requirement

System integration qualifications approved by national authorities.

5.2 Personnel Qualification Requirement

Security service personnel qualifications approved by national authorities.

5.4 Security Product Requirement

Information security products shall have licenses for production, management and marketing in China, and meet corresponding grade;

5.5 Engineering Supervision Requirement

5.6 Requirement for Compliance with Laws, Regulations and Policies

The system shall comply with national laws, regulations and policies.

6.1 Define Organizational Process of System Engineering

6.1.1 Basic requirements

A Standard process with explicit goal shall be defined for system engineering, which can be used to define the process of new engineering project through tailoring.

6.1.2 Set process goal

6.2 Improve Organizational Process of System Engineering

6.2.1 Basic requirements

Measure and improve the process of system engineering, improve the benefit and efficiency of the organizational process of system engineering through the improvements on the basis of the definition of the standard system engineering process.

6.2.2 Assess the process

6.2.3 Plan process improvement

Based on the analysis on the effects of potential improvements, process improvement plan shall be developed to achieve the goal of the process.

6.2.4 Change standard process

Change standard organizational process of system engineering so as to reflect the improvement of the goal.

6.2.5 Communicate about process improvement

Communicate with existing project team and other related teams on process improvement.

6.3 Manage the Evolution of Series of Products

6.3.1 Basic requirements

Services, devices and new technologies shall be introduced to renew products, reduce engineering expense and obtain optimal benefits from engineering progress and implementation.

6.3.6 Insert product technology

6.4.4 Acquire support environment for system engineering

6.4.6 Insert new technology

6.4.7 Maintain the environment

6.5 Host Training

6.5.1 Basic requirements

Establish a complete training system, which can provide employees with effective knowledge and skill trainings meeting organizational needs and applicable to system engineering activities.

6.5.2 Define training requirement

6.5.3 Select the method for acquisition of knowledge or skill

6.5.4 Ensure the availability of skills and knowledge

Ensure that the skills and knowledge are available for system engineering activities.

6.5.5 Prepare training materials

6.5.6 Training personnel

6.5.8 Keep training record

6.5.8.1 Keep a record of the training and experience.

6.5.8.2 Keep training records so as to track the performance, skills and ability of each trainee.

6.5.9 Maintain training materials […]

6.6 Coordinate with Supplier

6.6.1 Basic requirements

Build ties to the supplier according to engineering needs, so as to ensure the supplier can provide the required product or service for system engineering.

6.6.2 Determine system components or services

Determine system components or services that shall be provided by other external organizations.

6.6.3 Determine competent supplier or distributor

6.6.5 Make requests

7.1 Manage Security Control

7.1.1 Basic requirements

Ensure the designed security characteristics of system in operation and the configuration and normal use of security measures.

7.1.2 Establish security responsibility

7.1.3 Manage security configuration

7.1.4 Improve security awareness and popularize training and education

programs

7.1.5 Manage security service and control mechanism

7.2 Assess Impacts

7.2.1 Basic requirements

Make the impacts on the system, and assess the possibility of potential impacts.

7.6 Build Assurance Argument

7.6.1 Basic requirements

Identify and define needs-related assurance evidence, including evidence generation and analysis activities, including additional evidence, document list and process required for supporting needs assurance, and evidences certifying compliance with the security needs that can be clearly provided to the owner.

The Project requires building activation records related to assurance evidence, including management, identifying, plan, packaging and submission of security assurance evidence.

7.6.2 Identify assurance goal

7.6.3 Define assurance strategy

7.6.5 Analyze evidence

Security assurance evidence is analyzed to ensure that engineering products are sound and correct relative to the baseline system.

7.6.6 Provide assurance argument

7.7 Coordinate Security

7.7.1 Basic requirement

Relationship among security organizations, other engineering organizations and exterior organizations related to security engineering shall be coordinated and maintained so as to ensure all the departments have an awareness of participating in security engineering.

7.7.2 Define coordination goal

Define and build relationships of contact and obligation with other organizations that shall be accepted by all the departments involved.

7.7.3 Identify coordination mechanism

Identify security engineering coordination mechanism and define its implementation method.

7.7.4 Promote coordination

8.1 Quality Assurance

8.1.1 Basic requirements

Deviation shall be found out by means of process measurement and monitoring as well as work product measurement; implementation of project quality goal shall be ensured through quality analysis, improvement and quality correction monitoring.

This requirement item is related to 7.6. Assurance can be considered as a special type of security-related quality.

8.1.2 Monitor consistency of the defined process

8.1.3 Measure quality of work product

8.1.3.1 The designed work product measuring method shall be used to assess whether the work product can meet the owner's or engineering requirements or not; product measurement is also in favor of solving the problems appearing in segregated system development process.

8.1.4 Measure process quality

Measure quality of the system engineering process used in the project.

8.1.5 Analyze quality measurement

8.1.6 Participate in quality activities

Relevant employees shall be involved during quality problems determining and reporting process.

8.1.7 Initiate quality improvements

Initiate quality problems or improvements themed activities.

8.1.8 Detect correction requirements

8.2 Manage Configuration

8.2.1 Basic requirements

Data and status of configuration unit determined in the system shall be maintained;

8.2.2 Establish configuration management method

8.2.3 Determine configuration unit

8.2.3.1 Determine the configuration unit constituting baseline.

8.2.5 Control changes

8.3 Manage Project Risk

9.1 Level 1.the User's Discretionary Protection Level

9.1.1 Engineering goal and scope

Goal. in this level, basic requirement items which meet the qualification assurance shall basically reach those for organization assurance, engineering implementation and project implementation. The individual in the organization in this level can recognize that an action shall be executed and agree that it will be executed when required.

9.1.3 Organization assurance requirements

In the process of organization assurance, the process of the following 6 requirements shall be complete and explicit, shall basically reach the goal of each requirement; the individual in the organization in this level can recognize that an action shall be executed and agree that it will be executed when required.

9.1.4 Engineering implementation requirements

In the process of security engineering, the process of 11 requirements shall be complete and explicit, shall basically reach the goal of each requirement; the individual in the organization can recognize that an action shall be executed and agree that it will be executed when required.

9.1.5 Project implementation requirements

In the process of security project implementation, the process of the following 5 requirements shall be complete and explicit, shall basically reach the goal of each requirement; the individual in the organization can recognize that an action shall be executed and agree that it will be executed when required.

9.2 Level 2.System Audit Protection Level

9.2.1 Engineering goal and scope

Goal. in this level, qualification assurance requirements shall be met, and basic requirement items for organization assurance, engineering implementation and project implementation are planned and tracked.

9.2.2 Qualification assurance requirements

Qualification assurance shall meet the following 5 requirement items. […]