GB/T 22081-2016Information technology -- Security techniques -- Code of practice for information security controls (English PDF)

4.2 Control Category

Each of the major safety control categories includes.

a) a control goal that states what is to be achieved;

b) One or more controls that can be used to achieve this control objective.

The description of the control structure is as follows.

control

To meet the control objectives, give a statement that defines a specific control.

Realize the guide

To support the realization of this control and meet the control objectives, provide more detailed information. This guide may not be entirely applicable or inadequate

In all cases, it may or may not meet the organization's specific control requirements.

other information

Provide further information to consider, such as legal considerations and references to other standards. If there is no other information, this will be

Not given.

5.1 Information Security Management Guidance

Goals. Based on business requirements and relevant laws and regulations, provide management guidance and support for information security.

5.1.1 Information Security Policy

control

Information security policy sets should be defined, approved by the manager, and published, communicated to all employees and external parties.

Realize the guide

At the highest level, the organization should define an "information security policy" that should be approved by management and establish an organization that manages its information

The safety goal of the method.

Information security policy should be concerned about the following requirements.

a) business strategy b) laws, regulations and contracts;

c) The current and expected information security threat environment.

This information security policy should include statements regarding.

a) definition of information security, goals and principles to guide all information security related activities;

b) Assign general and specific responsibilities for information security management to defined roles;

c) Handling deviations and surprises.

At a lower level, this information security strategy should be supported by a thematic-specific strategy that further mandates information

Security controls are implemented and are often structured to emphasize the needs of certain target groups within the organization or to cover certain topics.

For example, such strategic topics include.

a) Access Control (see Chapter 9);

b) Classification (and processing) of information (see 8.2);

c) Physical and Environmental Safety (see Chapter 11);

d) Strategies for end-users, such as.

1) Acceptable use of assets (see 8.1.3);

2) Desktop and screen cleaning (see 11.2.9);

3) Information transmission (see 13.2.1);

4) mobile devices and remote work (see 6.2);

5) software installation and its use restrictions (see 12.6.2);

e) backup (see 12.3);

f) Information transmission (see 13.2);

g) malware prevention (see 12.2);

h) Technical vulnerability management (see 12.6.1);

i) password control (see Chapter 10);

j) Communication security (see chapter 13);

k) Protection of privacy and its personally identifiable information (see 18.1.4);

l) Supplier relationships (see Chapter 15).

These strategies should be communicated to employees and external parties in a form that is accessible, accessible and understandable to the intended reader, for example,

Safety awareness, education and training "(see 7.2.2).

other information

The need for internal information security policies varies by organization. Internal strategies are especially useful for large and complex organizations when these groups

The people in the organization who identify and approve the control of the expected level are separated from those who control it, or when the internal strategy is applied at a different organizational

People or functions, it is also very useful. Information security policies can be published as a single "information security policy" document or as a

Unpredictable but related to a set of documents published in the form.

If information security policies are distributed outside the organization, care should be taken not to disclose confidential information.

Some organizations use other terms for these policy files, such as "standards" or "rules."

5.1.2 Information Security Strategy Review

control

Information security strategy reviews should be conducted at planned intervals or when significant changes occur to ensure their continued suitability, adequacy

And effectiveness.

Realize the guide

Each strategy should have a person responsible for the formulation of his strategy, evaluation and evaluation has been approved management responsibilities. The review should include the evaluation team

Weaving Strategies and Information Security Management Methods Improve opportunities to adapt to changes in the organization's environment, business conditions, laws and regulations or the technology environment.

Information security strategy reviews should consider the results of the management review.

Management should be approved for the revised strategy.

6.1 Internal Organization

Objective. To establish a management framework to initiate and control the implementation and operation of information security within the organization.

6.1.1 Information Security Role and Responsibilities

control

All information security responsibilities should be defined and assigned.

Realize the guide

The allocation of information security responsibilities should be consistent with the information security policy (see 5.1.1). The responsibility to protect each asset and enforce specific security

The responsibility of the process should be clearly identified. It is appropriate to define the responsibility for information security risk management activities, in particular, to accept residual risks. must

Where appropriate, more detailed guidance should be provided on site-specific and information processing facilities responsibilities. It is appropriate to define local asset protection and enforcement specific

Responsibility for the safety process.

Individuals assigned the responsibility for information security can delegate security tasks to other people. In spite of this, they are still responsible and

And they should determine if any of the delegated tasks have been properly implemented.

Should indicate the area of individual responsibility. In particular, the following should be done.

a) identify and define asset and information security processes;

b) the entity responsible for the designation of each asset or safety process and the details of which are to be documented (see 8.1.2);

c) define the level of authority and form a document;

d) Appointed individuals should have the capacity in the area of information security and be given the opportunity to follow up on developments that will enable them to fulfill their information

Safety field responsibility;

e) The monitoring and coordination of information security in supplier relationships should be identified and documented.

other information

In many organizations, an information security manager will be appointed to be fully responsible for secure development and implementation and to support the identification of controls.

However, the responsibility to provide control of resources and to achieve these controls is often attributed to individual managers. A common practice is for each one

Assets Designate a responsible person for the day-to-day protection of the asset.

6.1.2 separation of duties

control

It is appropriate to separate the responsibilities of conflict and their areas of responsibility in order to reduce the chance of unauthorized or unintentional changes or improper use of the assets of the organization.

Realize the guide

It should be noted that no one can access, modify and use the asset without authorization or monitoring. Should put an activity started with

Its authorization phase separated. In designing this control, the possibility of collusion should be considered.

Small organizations may find it difficult to achieve such segregation of duties, but whenever possible and feasible, the principle should be applied as much as possible. in case

Difficult to separate, other controls should be considered, such as monitoring of activities, audit trails and regulatory oversight.

other information

Duties separation is a way to reduce the risk of accidental or deliberate abuse of organizational assets.

6.1.3 Contact with functional agencies

control

Appropriate linkages with relevant functional agencies should be maintained.

Realize the guide

The organization should have procedures that indicate when and which functional agency (eg, law enforcement, regulatory, regulatory authorities) to contact, and

How to report identified information security incidents in a timely manner (eg, identified information security incidents may be in breach of law).

other information

An attacker from the Internet may need a functional agency to take action against the attacker.

Maintaining such links may be in support of Information Security Incident Management (Chapter 16) or Business Continuity and Contingency Planning (Chapter 17)

Request. Contact with the regulatory authorities also helps to anticipate the anticipated changes in laws and regulations that organizations must implement and to make advance ready. Connections to other sectors include utilities, emergency services, power supply, health and safety sectors such as fire stations

Continuity), telecom providers (related to routing and availability), water departments (related to equipment cooling).

6.1.4 Contact with specific stakeholders

control

Appropriate links with specific stakeholders, other professional security forums and professional associations should be maintained.

Realize the guide

Consideration should be given to using the relationship of a particular stakeholder or forum member as a means of.

a) to promote best practice knowledge and to keep abreast of the latest relevant safety information;

b) ensure that an informed information security environment is up-to-date and comprehensive;

c) Obtain previous warnings, bulletins and patches on attacks and vulnerabilities;

d) get advice from information security experts;

e) share and exchange information on new technologies, products, threats or vulnerabilities;

f) Provide appropriate contact points when dealing with information security incidents (Chapter 16).

other information

Information sharing protocols can be established to improve coordination and coordination of security issues. Such an agreement should identify the relevant protection of confidential information

Claim.

6.1.5 Information Security in Project Management

control

Should be concerned about the project management information security issues, no matter what type of project.

Realize the guide

Information security should be integrated into the organization's project management approach as part of a project to ensure that information security is identified and emphasized risk. This generally applies to all projects, regardless of their characteristics, such as core business processes, IT, facilities management and other support processes

And other aspects of the project. The project management method used should require.

a) Information security goals are included in project goals;

b) To identify the necessary controls, an information security risk assessment should be conducted at an early stage of the project;

c) Information Security as part of each phase of the project management methodology used.

Information security issues should be addressed and regularly reviewed in all projects. It is advisable to define information security responsibilities and assign them to project management methods

In the definition of specific roles.

6.2 Mobile devices and remote work

Objective. To ensure the safety of mobile devices workin...

GB/T 22080-2025 | GB/T 22240-2020 | GB/T 22239-2019 | GB/T 22081-2024 | […]