GB/T 22240-2020Information security technology—Classification guide for classified protection of cybersecurity (English PDF)

3.1 Cybersecurity

The capability of preventing attacks, intrusions, interference, destruction, illegal use of the network and accidents, to make the network be in a stable and reliable state of operation, meanwhile, to ensure the integrity, confidentiality and availability of network data, by taking necessary measures. [GB/T 22239-2019, definition 3.1]

3.2 Target of classified protection

The object on which the classified protection work of cybersecurity is performed.

Note: It mainly includes information systems, network infrastructure and data resources.

3.3 Information system

Applications, services, information technology assets or other information processing components. [GB/T 29246-2017, definition 2.39]

Note 1. The information system is usually composed of computers or other information terminals and related equipment, meanwhile performs information processing or process control according to certain application goals and rules.

Note 2. Typical information systems include office automation systems, cloud computing platforms/systems, Internet of Things, industrial control systems, systems that use mobile internet technology.

3.4 Network infrastructure

Network equipment and facilities that provide a basic support for information circulation and network operation.

Note: It mainly includes telecommunication networks, radio and television transmission networks, special communication networks for industries or organizations.

3.5 Data resources

A collection of data that has or is expected to have value.

Note: Most data resources exist in electronic form.

3.6 Object of infringement

Social relations as protected by the law that are infringed when the object of classified protection is damaged.

Note: Referred to as "object" in this standard.

4.1 Security protection level

According to the importance of the classified protection object in the national security, economic construction, social life, as well as such factors as the degree of infringement to the national security, social order, public interests, legal rights of citizens, legal persons and other organizations once it is damaged, loses function or the data is tempered with, disclosed, lost, destructed, the security protection level of the object of security protection is divided into the following five levels.

4.2 Rating elements

4.2.1 Overview of rating elements

The rating elements of the classified protection objects include.

a) Infringed objects;

b) The degree of infringement on the object.

4.2.2 Infringed objects

The infringed objects when the classified protection object is damaged include the following three aspects.

4.2.3 Degree of infringement on the object

The degree of infringement on the object is comprehensively determined by the different external manifestations of objective. Since the infringement on the object is achieved by destroying the object of classified protection, the external manifestation of the infringement on the object is the damage to the object of classified protection, which is described by the method of infringement, the consequences of the infringement, the degree of infringement.

The degree of infringement on the object after the object of classified protection are damaged can be divided to the following three types.

4.3 Relationship between rating elements and security protection level

The relationship between rating elements and security protection levels is as shown in Table 1.

4.4 Rating process

The general flow of the rating work of classified protection objects is as shown in Figure 1.

5.1 Information system

5.1.1 Basic characteristics of rating objects

The information system as a rating object shall have the following basic characteristics.

5.1.2 Cloud computing platform/system

In a cloud computing environment, the classified protection objects on the cloud service client side and the cloud computing platform/system on the cloud service provider side must be rated as separate rating objects, meanwhile the cloud computing platform/system is divided into different rating objects according to different service models.

5.1.3 Internet of Things

The Internet of Things mainly includes characteristic elements such as perception, network transmission, processing applications. The above elements need to be rated as a whole object; each element is not rated individually.

5.1.4 Industrial control system

The industrial control system mainly includes characteristic elements such as field acquisition/execution, field control, process control, production management. Among them, field acquisition/execution, field control, process control and other elements need to be rated as a whole object; each element is not rated separately; production management elements should be rated separately.

5.1.5 System using mobile internet technology

The system adopting mobile internet technology mainly includes mobile terminals, mobile applications, wireless networks and other characteristic elements, which can be rated independently as a whole or together with related business systems. Each element is not rated separately.

5.2 Network infrastructure

For network infrastructure such as telecommunication networks, radio and television transmission networks, etc., it should be divided into different rating objects according to factors such as the subject of security responsibility, service type or service area.

5.3 Data resources

Data resources can be rated independently.

When the security responsibility subjects are the same, big data and big data platforms/systems should be rated as a whole object; when the security responsibility subjects are different, big data shall be rated independently.

6.1 Overview of rating methods

The rating method for rating objects is as follows. For network infrastructure, cloud computing platforms/systems, and other rating objects and data resources having support functions, refer to 6.6.

The security of rating objects mainly includes business information security and system service security. The related infringed objects and the degree of infringement on the objects may be different. Therefore, the security protection level is determined by both business information security and system service security. The security protection level of rating object as reflected from the perspective of business information security is called the business information's security protection level; the security protection level of rating object as reflected from the perspective of system service security is called the system service's security protection level.

The schematic diagram of the rating method flow is as shown in Figure 2.

6.2 Determine the infringed object

The infringed objects when the rating object is damaged include national security, social order, public interest, as well as the legitimate rights and interests of citizens, legal persons and other organizations. Matters that infringes national security include the following.

Infringement on the legitimate rights and interests of citizens, legal persons and other organizations refers to the damage to the social rights and interests enjoyed by citizens, legal persons and other organizations protected by law.

When determining the infringed object, first determine whether it infringes national security, then determine whether it infringes social order or public interest, finally determine whether it infringes the legitimate rights and interests of citizens, legal persons and other organizations.

6.3 Determine the degree of infringement on the object

6.3.1 Objective aspects of infringement

From an objective perspective, the infringement of the object is externally manifested as destruction of the rating object; its infringement is manifested as the destruction of business information security and the destruction of system service security.

6.3.2 Comprehensively determine the degree of infringement

The degree of infringement is a comprehensive manifestation of the different external manifestations of objective aspects. Therefore, first of all, based on different infringed object and different infringement consequence, respectively determine the degree of infringement. For different consequence of infringement, the method and angle of consideration for determining the degree of infringement may be different. For example, the degree of reduction of business capability as caused by the damage of the system service security may be determined from different aspects such as the area as covered by the rating object service, the number of users or the business volume; whilst the loss of property caused by the destruction of business information security may be determined in terms of direct capital loss and indirect information recovery costs, etc.

6.4 Preliminary determining level

According to the infringed object when the business information security is damaged and the degree of infringement on the corresponding object, it may obtain the security protection level of the business information according to Table 2.