Partners save 15% on every standard

Valid

GB/T 22239-2019Information security technology - Baseline for classified protection of cybersecurity (English PDF)

信息安全技术网络安全等级保护基本要求

Open the GB/T 22239-2019 preview as PDF

Preview — first pages of GB/T 22239-2019 (full document: 87 pages)

This is a limited preview

Buy now to download the full PDF (87 pages)

Issued by

State Administration for Market Regulation; Standardization Administration of China

Level / Type

National · Recommended

Issue date

May 10, 2019

Implementation date

December 1, 2019

Scope

GB/T 22239-2019 is the English-translated version of 信息安全技术网络安全等级保护基本要求.

GB/T 22239-2019 is the Chinese national standard on information security technology - baseline for classified protection of cybersecurity, in the field of information technology. The /T suffix marks it as a recommended standard: it is not compulsory by itself, but it becomes binding as soon as a contract, a tender or a customer specification calls it up - which in practice is how most foreign buyers meet it. It was issued on 10 May 2019 by the State Administration for Market Regulation; Standardization Administration of China, and has been in force since 1 December 2019. Classification: ICS 35.040, CCS L80. This page is published from the official record of the standard held by the Chinese standards administration: the identification, the dates, the classification and the issuing body are taken from there. The clause text, the tables and the numeric limits are in the document itself, which is delivered complete in English translation.

Document preview — GB/T 22239-2019

National Standard of the People's Republic of China

ICS: 35.040
Classification: L80

Issued by: State Administration for Market Regulation; Standardization Administration of China

1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviations
5 Overview of Classified protection of cybersecurity
5.1 Object under classified protection...
5.2 Different classes of security protection ability...
5.3 General security requirements and security extension requirements...
6 Level 1 security requirements
6.1 General security requirements
6.1.1 Security physical environment
6.1.2 Security communication network
6.1.3 Secure area border
6.2 Security extension requirements of cloud computing...
6.3 Security extension requirements of mobile internet...
6.4 Security extension requirements for IoT...
6.5 Security extension requirements for industrial control systems...
7 Level 2 security requirements
7.1 General security requirements
7.1.1 Security physical environment
7.1.2 Security communication network
7.2 Extension requirements for cloud computing security...
7.3 Extension requirements for mobile Internet security...
7.4 Extension requirements for IoT security...
7.5 Security extension requirements for industrial control systems...
8 Level 3 security requirements
8.1 General security requirements
8.1.1 Security physical environment
8.2 Extension requirements for cloud computing security...
8.3 Extension requirements for mobile Internet security...
8.4 Extension requirements for IoT security...
8.5 Security extension requirements for industrial control systems...
9 Level 4 security requirements
9.1 General security requirements
9.1.1 Security physical environment

1 Scope

This standard specifies the general security requirements and security extension requirements for the project under classified protection from level 1 to level 4 of the classified protection of cybersecurity. This standard is applicable to guide the security construction and supervision administration of non-confidential objects in different classes.

Note. The class-5 protection object is a very important supervision and management object. It has special management modes and security requirements, so it is not described in this standard.

2 Normative references

The following documents are essential to the application of this document. For the dated documents, only the versions with the dates indicated are applicable to this document; for the undated documents, only the latest version (including all the amendments) are applicable to this standard.

GB 17859 Classified criteria for security protection of computer information system

GB/T 22240 Information security technology - Classification guide for classified protection of information system security

GB/T 25069 Information security technology glossary

GB/T 31167-2014 Information security technology - Security guide of cloud computing services

GB/T 31168-2014 Information security technology - Security ability requirements of cloud computing services

GB/T 32919-2016 Information security technology - Application guide to industrial control system security control

3 Terms and definitions

The terms and definitions defined in GB 17859, GB/T 22240, GB/T 25069, GB/T 31167-2014, GB/T 31168-2014, GB/T 32919-2016, as well as the following terms and definitions, apply to this document. For ease of use, some of the terms and definitions in GB/T 31167-2014, GB/T 31168-2014, GB/T 32919- 2016 are listed repeatedly.

3.1 Cybersecurity The ability by taking necessary measures to prevent network from attacks, intrusions, interference, destruction and illegal use, as well as accidents, to make the network in a stable and reliable state of operation, and to ensure the integrity, confidentiality and availability of network data.

3.2 Security protection ability The degree to withstand threats, detect security incidents, recover from previous conditions after damage.

3.3 Cloud computing A mode for accessing a scalable, flexible physical or virtual shared resource pool through a network, and self-serving and managing resources on demand.

Note. Examples of resources include servers, operating systems, networks, software, applications, storage devices. [GB/T 31167-2014, definition 3.1]

3.4 Cloud service provider The provider of cloud computing services.

Note. Cloud service providers manage, operate, support computing infrastructure and software for cloud computing; deliver cloud computing resources through the network. [GB/T 31167-2014, definition 3.3]

4 Abbreviations

The following abbreviations apply to this document. AP. Wireless Access Point DCS. Distributed Control System DDoS. Distributed Denial of Service ERP. Enterprise Resource Planning FTP. File Transfer Protocol HMI. Human Machine Interface IaaS. Infrastructure-as-a-Service ICS. Industrial Control System IoT. Internet of Things IP. Internet Protocol

5 Overview of Classified protection of cybersecurity

5.1 Object under classified protection The object under classified protection refers to the objects in the classified protection of cybersecurity. It usually refers to a system consisting of computers or other information terminals and related device that collects, stores, transmits, exchanges, processes information in accordance with certain rules and procedures. It mainly includes basic information networks, cloud computing platforms / systems, big data applications / platforms / resources, Internet of Things (IoT), industrial control systems, systems using mobile internet technologies. The object under classified protection is, based on the degree of harm to national security, economic construction, and social life, and the degree of harm to national security, social order, public interests, the legitimate rights and interests of citizens, legal persons, and other organizations after damage, divided into five protection classes from low to high. See GB/T 22240 for the method of determining the security protection level of the protected object.

5.2 Different classes of security protection ability The basic security protection abilities that different classes of protected objects shall possess are as follows: Level 1 security protection ability. It shall be able to protect against critical resource damage caused by malicious attacks from individuals, threat sources with few resources, general natural disasters, other threats of a considerable degree of harm. After the damage, it may restore some functions. Level 2 security protection ability. It shall be able to protect against important resource damage caused by malicious attacks from small external sources, threat sources with a small amount of resources, general natural disasters, other threats of considerable harm. It may find important security loopholes and handle security incidents, restore some functions within a period of time after they are damaged. Level 3 security protection ability. It shall be able to protect against important resource damage caused by malicious attacks from externally organized groups, threat sources with richer resources, more severe natural disasters, other threats of a considerable degree under a unified security policy. It can timely identify and monitor the attack behavior and deal with security incidents in a timely manner. After being damaged, it can quickly recover most of its functions. Level 4 security protection ability. It shall be able to protect against important resource damage caused by malicious attacks from national-level, hostile organizations, resource-rich threat sources, severe natural disasters, other threats of considerable harm under a unified security policy. It can timely identify and monitor the attack behavior and security incidents in a timely manner. After being damaged, it can quickly recover all of its functions. Level 5 security protection ability. omitted.

6.1.1 Security physical environment

6.1.1.1 Physical access control At the entrance and exit of the computer room, it shall assign a special person on duty or equip with an electronic access control system to control, identify and record the entering personnel.

6.1.1.2 Protection against theft and vandalism Device or main components shall be fixed and identified with obvious signs that are not easy to remove.

6.1.1.3 Lightning protection All kinds of cabinets, facilities and device shall be safely grounded through the grounding system.

6.1.1.4 Fire prevention The computer room shall be equipped with fire extinguishing device.

6.1.1.5 Waterproof and moisture-proof It shall take measures to prevent rainwater from penetrating through the windows, roof and walls of the computer room.

6.1.1.6 Temperature and humidity control It shall set necessary temperature and humidity adjustment facilities, so that the temperature and humidity changes in the computer room are within the range allowed by the device operation.

6.1.1.7 Power supply It shall configure the voltage stabilizer and overvoltage protection device along the power supply lines in the computer room.

6.1.2 Security communication network

6.1.2.1 Communication transmission It shall use the checking techniques to ensure data integrity during communication.

6.1.2.2 Trusted authentication It may, based on the trusted root, carry out the trusted authentication of the system boot program, system program, etc. of the boundary device; issue alarm when detecting the damage of the credibility of the device.

6.1.3 Secure area border

6.1.3.1 Border protection It shall ensure that the access and data flows across borders communicate through controlled interfaces as provided by border devices.

6.1.3.2 Access control This requirement includes.

a) It shall set the access control rules at the network boundary according to the access control policy. By default, the controlled interface denies all communication except for the communication allowed;

b) Remove redundant or invalid access control rules; optimize access control lists; ensure that the number of access control rules is minimized;

c) It shall check the source address, destination address, source port, destination port, protocol, etc., to allow / deny data packets to enter and exit.

6.1.3.3 Trusted authentication It may, based on the trusted root, carry out the trusted authentication of the system boot program, system program, etc. of the boundary device; issue alarm when detecting the damage of the credibility of the device.

7.1.1 Security physical environment

7.1.1.1 Selection of physical location This requirement includes.

a) The site of the computer room shall be selected in a building that has the ability to resist earthquakes, wind and rain;

b) The site of the computer room shall be avoided on the top floor or basement of the building, otherwise it shall strengthen the waterproof and moisture-proof measures.

7.1.1.2 Physical access control For the entrance and exit of the computer room, it shall assign a special person on duty or be equipped with an electronic access control system to control, identify, record the entering personnel.

7.1.1.3 Protection against theft and vandalism This requirement includes.

a) It shall fix the device or main components; set obvious signs that are not easy to remove;

b) It shall lay the communication cables in a hidden and safe place.

7.1.1.4 Lightning protection All kinds of cabinets, facilities and device shall be safely grounded through the grounding system.

7.1.1.5 Fire protection This requirement includes.

a) The computer room shall be equipped with an automatic fire protection system, which can automatically detect fire conditions, automatically alarm, automatically extinguish fires;

b) The computer room and related working rooms and supporting rooms shall use building materials with fire resistance rating.

7.1.1.6 Waterproof and moisture-proof This requirement includes.

a) It shall take measures to prevent rainwater from penetrating through the windows, roof and walls of the computer room;

b) It shall take measures to prevent condensation of water vapor in the computer room and the transfer and penetration of underground water.

7.1.2 Security communication network

7.1.2.1 Network architecture This requirement includes.

a) It shall divide different network areas; allocate addresses to each network area in accordance with the principles of convenient management and control;

b) It shall avoid deploying important network areas at the borders; it shall adopt reliable technical isolation measures between important network areas and other network areas.

7.1.2.2 Communication transmission It shall use the checking techniques to ensure data integrity during communication.

7.1.2.3 Trusted authentication It may, based on the trusted root, carry out trusted authentication for the system boot program, system program, important configuration parameters, and communication application programs of the communication device; issue an alarm after the damage of credibility is detected; form the verification result into audit record and send it to the security management center.

8.1.1 Security physical environment

8.1.1.1 Selection of physical location This requirement includes.

a) The site of the computer room shall be selected in a building that has the ability to resist earthquakes, wind and rain;

b) The site of the computer room shall be avoided on the top floor or basement of the building; otherwise it shall strengthen the waterproof and moisture-proof measures.

8.1.1.2 Physical access control The computer room's entrance and exit shall be equipped with an electronic access control system to control, identify and record the entering personnel.

8.1.1.3 Protection against theft and vandalism This requirement includes.

a) The device or main components shall be fixed and identified with obvious signs that are not easy to remove;

b) The communication cables shall be laid in a hidden and safe place;

c) It shall set up anti-theft alarm system in the computer room or a video surveillance system with a dedicated person on duty.

8.1.1.4 Lightning protection This requirement includes.

a) All kinds of cabinets, facilities and device shall be safely grounded through the grounding system;

b) It shall take measures to prevent induction lightning, such as installing lightning protection devices or overvoltage protection devices.

8.1.1.5 Fire protection This requirement includes.

a) The computer room shall be equipped with an automatic fire protection system, which can automatically detect fire conditions, automatically alarm, automatically extinguish fires;

b) The machine room and related working rooms and auxiliary rooms shall use building materials with fire resistance rating;

9.1.1 Security physical environment

9.1.1.1 Selection of physical location This requirement includes.

a) The site of the computer room shall be selected in a building that has the ability to resist earthquakes, wind and rain;

b) The site of the computer room shall be avoided on the top floor or basement of the building; otherwise it shall strengthen the waterproof and moisture-proof measures.

9.1.1.2 Physical access control This requirement includes.

a) The entrance and exit of the computer room shall be equipped with an electronic access control system to control, identify and record the entering personnel;

b) The important area shall be equipped with a second electronic access control system to control, identify and record the entering personnel.

9.1.1.3 Protection against theft and vandalism This requirement includes.

a) The device or main components shall be fixed and marked with obvious signs that are not easy to remove;

b) The communication cables shall be laid in a hidden and safe place;

c) It shall set up an anti-theft alarm system in the computer room or a video surveillance system with a dedicated person on duty.

9.1.1.4 Lightning protection This requirement includes.

a) All kinds of cabinets, facilities and device shall be safely grounded through the grounding system;

b) It shall take measures to prevent induction lightning, such as installing lightning protection devices or overvoltage protection devices.

9.1.1.5 Fire protection This requirement includes.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 87 pages — is available in the English PDF.

Referenced standards

Normative references

Cited by

Similar standards

GB 42250-2022|GB/Z 24294.1-2018|GB/Z 24294.2-2017|GB/Z 24294.3-2017|GB/Z 24294.4-2017

Editions of GB/T 22239

Edition	Title	Revision	Status
GB/T 22239-2019	Information security technology - Baseline for classified protection of cybersecurity	current edition	Current
GB/T 22239-2008	Information security technology - Baseline for classified protection of information system security	previous edition	Superseded

This page sells the current edition, GB/T 22239-2019. Earlier editions are listed for reference only.

How to Buy GB/T 22239-2019

1Add to cart. Click the "Buy GB/T 22239-2019" button on this page. You can add more standards before checkout.
2Checkout. Enter your email and billing details. Payment is processed securely by Stripe (cards, Apple Pay, Google Pay supported).
3Instant delivery (0–9 sec). Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4Invoice included. A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.