GB/T 20985.2-2026Cybersecurity technology - Cybersecurity incident management - Part 2: Guidelines to plan and prepare for incident response (English PDF)

Foreword

This document conforms to GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting is scheduled.

This document is Part 2 of GB/T 20985 "Network Security Technology - Network Security Incident Management". GB/T 20985 has been published.

The following parts were included.

--Part 1: Principles and Processes;

--Part 2: Incident Response Planning and Preparation Guidelines this document replaces GB/T 20985.2-2020 "Information Technology Security Technology - Information Security Incident Management - Part 2: Incidents" the "Response Planning and Preparation Guidelines" differs from GB/T 20985.2-2020 in that, aside from structural adjustments and editorial changes, the main technical changes are as follows.

as follows.

b) Added content related to the organization's recommendation process (see 6.7);

c) Changes have been made to content related to vulnerability management (see Chapter 6, Chapter 6 in the 2020 edition);

d) New roles and responsibilities have been added, including the incident management team and incident coordinator (see 7.2, 7.3).

This document is equivalent to ISO/IEC 27035-2:2023 "Information technology, information security, incident management – Part 2: Incident response".

Planning and Preparation Guide.

The following minimal editorial changes have been made to this document.

--Change the standard title to "Network Security Technology. Network Security Incident Management Part 2: Incident Response Planning and Preparation" guide";

--The abbreviations "ICT" and "IT" have been added;

--Table numbers have been added to the tables in Appendix B.

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC 260).

Introduction

GB/T 20985 "Network Security Technology - Network Security Incident Management" provides guidance for incident management control in GB/T 22081.

The guidelines instruct organizations to implement the controls outlined in GB/T 22081 based on the cybersecurity risks they face. GB/T 20985 is proposed to consist of four parts.

--Part 1: Principles and Processes. The purpose is to present the principles and processes of cybersecurity incident management.

--Part 2: Incident Response Planning and Preparation Guidelines. The purpose is to provide incident response planning and preparation, as well as incident response experience.

A summary guide.

--Part 3: ICT Incident Response Operations Guide. The purpose is to provide guidelines for handling cybersecurity incidents in ICT security operations.

guide.

--Part 4: Collaboration. The aim is to provide guidance on how multiple organizations can collaborate in handling cybersecurity incidents.

Cybersecurity strategies or controls alone cannot guarantee complete protection of information, systems, services, or networks. Even with controls in place...

Measures may still have residual vulnerabilities, reducing the effectiveness of cybersecurity, making cybersecurity incidents more likely, and impacting the organization's business operations.

Direct and indirect potential negative impacts. Furthermore, previously unidentified new threats will inevitably arise if the organization is not prepared to handle such incidents.

Being poorly prepared will diminish the effectiveness of any response, thereby increasing the potential negative impact on the business. Therefore, for any expectation of...

To strengthen the organization of a cybersecurity program, it is essential to adopt a structured and planned approach to conduct the following activities.

--Planning and preparing for cybersecurity incident management, including strategy, organization, planning, technical support, awareness and skills training, etc.;

--Responding to cybersecurity incidents includes initiating appropriate controls to prevent and mitigate their impact and recover from them;

--Appropriately address reported cybersecurity vulnerabilities related to the incidents;

--Learn lessons from cybersecurity incidents and vulnerabilities, implement and validate preventative controls, and improve overall cybersecurity.

Methods for managing files.

GB/T 20985 (all parts) aims to supplement other standards and documents that provide guidelines for cybersecurity incident investigation and preparation.

GB/T 20985 (all parts) is not entirely a guide, but rather a reference for certain fundamental principles and defined processes, designed to ensure the selection of...

Appropriate tools, techniques and methods, and their application to the desired purpose.

GB/T 20985 (all parts) covers not only cybersecurity incident management but also certain aspects of cybersecurity vulnerabilities.

ISO/IEC 29147 and ISO/IEC 30111 provide guidance on vulnerability disclosure and supplier handling of vulnerabilities, respectively.

GB/T 20985 (all parts) can also provide guidance for decision-makers who need to determine the reliability of digital evidence presented to them.

It is suitable for organizations that need to protect, analyze, and present potential digital evidence. It relates to strategies for procedures involved in creating and evaluating digital evidence.

This relates to decision-making bodies, which are often part of larger evidence bodies.

Network security technology and network security incident management Part 2: Incident Response Planning and Preparation Guide

1 Scope

This document is based on the "Planning and..." model of the "Network Security Incident Management Phase" given in sections 5.2 and 5.6 of GB/T 20985.1-2026.

The "Preparation" and "Experience Summary" phases provide guidelines for incident response planning and preparation, as well as for summarizing incident response experiences.

Key points in the planning and preparation phase include.

--Cybersecurity incident management policies and senior management commitments;

renew;

--Network security incident management plan;

--The formation of the Incident Management Team (IMT);

--Establish cooperative relationships and communication channels with internal and external organizations;

--Technical and other support (including organizational and operational support);

--Promoting and training on cybersecurity incident management awareness.

Key points in the experience summary phase include.

--Identify areas for improvement;

--Identify and implement necessary improvement measures;

--Performance evaluation of Incident Response Teams (IRTs).

The principles presented in this document are universal and applicable to organizations of any type, size, or nature. Organizations may adapt these principles to their business type, scale, or other specific requirements.

The scope and nature of the network security risks should be considered, and the guidelines provided in this document should be adjusted accordingly. This document also applies to providing network security incident management.

External organizations providing services.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are listed below.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 20985.1-2026 Network Security Technology - Network Security Incident Management - Part 1: Principles and Procedures (ISO/IEC) 27035-1.2023, IDT) ogy-Security techniques-Information security management systems-Overview and vocabulary) Note. GB/T 29246-2023 Information Security Technology - Overview and Glossary of Information Security Management Systems (ISO/IEC 27000:2018, IDT)

3 Terms, Definitions and Abbreviations