GB/T 24364-2023Information security technology—Implementation guide for information security risk management (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB /Z 24364-2009 "Information Security Technology Information Security Risk Management Guidelines", and GB /Z 24364-2009 In comparison, except for structural adjustments and editorial changes, the main technical changes are as follows:

a) The standard object and scope are changed from information system-oriented to risk management object (see Chapter 1);

b) The terms and definitions of "availability", "confidentiality", "integrity", "risk" and "risk treatment" are deleted (see 3.1, 3.2, 2009 edition 3.4, 3.5, 3.7);

c) The information security risk management framework has been added, including risk management principles, safeguard mechanisms, safeguard measures, management capabilities, etc. (see Chapter 4);

d) Changed the content and process of information security risk management (see 9.1, 4.2 of the 2009 edition);

e) Changed the context establishment process, introduced basic criteria to determine content, etc. (see 9.2, Chapter 5 of the 2009 edition);

f) Changes related to risk assessment (see 9.3, Chapter 6 of the 2009 edition);

g) Change monitoring and review to monitoring and review, and change related content (see 9.6, Chapter 9 of the 2009 edition);

h) Changes related to communication and consultation (see 9.7, Chapter 10 of the 2009 edition);

i) Deleted the content of risk management in each life cycle stage (see Chapter 11, Chapter 12, Chapter 13, Chapter 14, Chapter 15 of the 2009 edition chapter);

j) Changes related to risk treatment (see 9.2, 9.4, Chapter 7 of the 2009 edition).

Introduction

Currently, information security risk management standards mainly include.

---GB/T 26333-2010 "Industrial Control Network Security Risk Assessment Specification";

---GB/T 31722-2015 "Information Technology Security Technology Information Security Risk Management" (ISO /IEC 27005:2008, IDT);

---GB/T 31509-2015 "Guidelines for the Implementation of Information Security Technology Information Security Risk Assessment";

---GB/T 33132-2016 "Information Security Technology Information Security Risk Management Implementation Guide";

---GB/T 36637-2018 "Information Security Technology ICT Supply Chain Security Risk Management Guidelines";

---GB/T 20984-2022 "Information Security Technology Information Security Risk Assessment Method";

---ISO 31000:2018 "Risk Management Guidelines";

---ISO /IEC 27005:2018 "Information Technology Security Technology Information Security Risk Management".

As one of the information security risk management standards, this document was revised in accordance with national information security risk management related policies and Refer to GB/T 31722-2015, ISO 31000:2018, ISO /IEC 27005:2018 and other standards to provide information security risk management for the organization Implementation provides more specific guidance, including information security risk management objectives, principles, safeguard mechanisms, safeguard measures, capabilities and processes, etc.

Table 1 shows the risk management standards of this document and ISO 31000:2018, GB/T 31722-2015, ISO /IEC 27005:2018 The corresponding relationship of the process.

However, this document does not specify the specific implementation details of information security risk management, the organization can according to its own risk management scope, risk management The context or industry in which it operates determines the details of its risk management implementation. Its existing methods can also be used within the framework described in this document to meet the requirements for risk management.

Note: In Chapter 9 of this document, the concept and work content of the implementation process of information security risk management are elaborated.

1 Scope

This document establishes the implementation framework of information security risk management, describes the principles, guarantee mechanisms and safeguard measures of information security risk management implementation, capability and process, providing the implementation points and work forms of each management process.

This document is applicable to all types of organizations carrying out information security risk management.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 20984-2022 Information Security Technology Information Security Risk Assessment Method

GB/T 24363-2009 Information Security Technology Information Security Emergency Response Plan Specification

GB/T 25069-2022 Information Security Technical Terminology

GB/T 29246-2017 Information Technology Security Technical Information Security Management System Overview and Vocabulary

GB/T 31509 Information Security Technology Information Security Risk Assessment Implementation Guide

GB/T 31722-2015 Information Technology Security Technology Information Security Risk Management

GB/T 38645-2020 Information Security Technology Network Security Incident Emergency Drill Guide

3 Terms and definitions, abbreviations