GB/T 25058-2019Information security technology—Implementation guide for classified protection of cybersecurity (English PDF)

4.1 Fundamental Principles

The core of classified security protection is to classify classified protection objects, and carry out construction, management and supervision in accordance with the standards.

During the implementation process of classified security protection, the following fundamental principles shall be followed.

4.2 Roles and Responsibilities

The various roles and responsibilities involved in the implementation of classified cybersecurity protection to classified protection objects are as follows. […]

4.3 Basic Procedure of Implementation

The basic procedure of implementing classified protection to classified protection objects includes. classified protection object rating and filing stage, overall security planning stage, security design and implementation stage, security operation and maintenance stage, and rating object termination stage, as it is shown in Figure 1.

5.1 Workflow of Rating and Filing Stage

The objective of the classified protection object rating stage is. the operating and using organization determines classified protection object and its security protection level in accordance with relevant national management specifications and rating standards and passes the expert review. If there is a competent department in the operating and using organization, the competent department shall review and approve it, and report to the public security organ for recording review.

5.3 Analysis of Classified Protection Object

5.3.1 Analysis of object importance

Activity objective.

Through the collection and understanding of information regarding classified protection object, and comprehensive analysis and sorting of the information, analyze organization's main social functions / functions and effects; determine classified protection object, on which, the main social functions / functions are performed.

5.4 Determination of Security Protection Level

5.4.1 Rating, Review and Approval

In accordance with relevant national management specifications and rating standards, determine the security protection level of rating object; review, examine and approve the rating result; guarantee the accuracy of the rating result.

5.4.2 Form rating report

Organize documents generated during the rating process; form a report of rating result of classified protection object. Participating roles. competent department; operating and using organization. Activity input. detailed descriptive files of rating objects; rating result.

5.5 Filing of Rating Result

Activity objective.

In accordance with classified protection management department's requirements for filing, organize relevant filing materials and submit them to the institution that accepts filing.

Participating roles. competent department; operating and using organization; classified protection management department.

6.1 Workflow of Overall Security Planning Stage

The objective of the overall security planning stage is. in accordance with the classification of classified protection objects, the rating of classified protection objects and the operations undertaken by classified protection objects, through the analysis, identify the security demands of classified protection objects; design reasonable overall security scheme that satisfies the requirements of classified protection; formulate security implementation scheme, so as to guide the implementation of the subsequent security construction of classified protection objects.

6.2 Analysis of Security Demands

6.2.1 Determination of basic security demands

In accordance with the security protection level of classified protection object, put forward the basic security protection demands for security protection object. Participating roles. operating and using organization; cybersecurity service institution.

Activity input. detailed descriptive files of classified protection objects; security protection level rating report; other relevant documents of classified protection objects;

GB/T 22239; basic industrial requirements.

6.2.2 Determination of special security demands

Through the analysis of special protection demands of important assets, adopt the method of demand analysis or risk analysis, determine possible security risks; judge the necessity of implementing special security measures; put forward special security protection demands for classified protection objects.

6.3 Overall Security Design

6.3.1 Overall security policy design

Activity objective.

Form institutional programmatic security policy files, including the determination of security guide and formulation of security policy, so as to combine the series standard of basic requirements for classified protection, basic industrial requirements and special security protection requirements, construct security technology architecture and security management architecture for institution's classified protection objects. In terms of newly established classified protection objects, the security protection level shall be clarified in the approval; in accordance with the requirements of corresponding protection level, conduct the overall security policy design.

6.3.2 Security technology architecture design

Activity objective.

In accordance with GB/T 22239, basic industrial requirements, security demand analysis report, institution's overall security policy file, put forward security technological measures that classified protection objects need to implement; form a specific security technology architecture for institution's classified protection objects, so as to guide the specific implementation of classified protection for classified protection objects.

6.3.4 Documentation of design result

Activity objective.

Document the results of the overall security design work. Finally, form a set of guidance documents that guide cybersecurity work. Participating roles. operating and using organization; cybersecurity service institution.

Activity input. security demand analysis report; security technology architecture of classified protection objects; security management architecture of classified protection objects.

6.4 Security Construction Project Planning

6.4.1 Determination of security construction objective

Activity objective.

In accordance with overall security scheme (constituted of one or multiple files) of classified protection objects, long and mid-term development planning of organization's informatization construction, and institution's security construction funds, determine security construction objectives of different stages.

7.1 Workflow of Security Design and Implementation Stage

The objective of the security design and implementation stage is. in accordance with the requirements of the overall scheme of classified protection objects, combine security construction project planning of classified protection objects, implement security measures in stages and in steps.

7.2 Detailed Design of Security Scheme

7.2.1 Design of technological measure implementation content

Activity objective.

In accordance with the objectives and the content of construction, implement security policy, security technology architecture, security measures and requirements that are required to be implemented in the overall security scheme of classified protection objects onto product functions or physical form; put forward products or components that can be implemented, and their specific specifications. In addition, organize product functional characteristics into documents, so that there can be basis for the procurement of cybersecurity products and the development of security control.

7.3 Implementation of Technological Measures

7.3.1 Procurement of cybersecurity products or services

Activity objective.

In accordance with the specific indicators of products or services in the detailed security design scheme, purchase products or services. In accordance with products, product combinations or service implementation functions, performance and security's compliance with security design requirements, purchase the required cybersecurity products or services.

7.3.2 Development of security control

Activity objective.

In terms of some security measures and security functions that cannot be implemented through the procurement of existing cybersecurity products, they shall be implemented through exclusive design and development. The development of security control shall be synchronously designed and implemented with application development of the system.

7.4 Implementation of Management Measures

7.4.1 Construction and revision of security management system

Activity objective.

In accordance with relevant national policies, standards and specifications on cybersecurity, formulate and revise, and implement behavioral codes and operational procedures of the various stages and links of the construction, development, operation, maintenance, upgrade and transformation of classified protection objects that are matching with the security management of classified protection objects.

8.1 Workflow of Security Operation and Maintenance Stage

Security operation and maintenance is a necessary link that ensures the normal operation of classified protection objects during the implementation of classified protection. It involves a lot of content, including the establishment of security operation and maintenance institution, and security operation and maintenance institution; the management of environment, assets, equipment and media; the management of networks and systems; the management of passwords and keys; the management of operation and alterations; security status monitoring and security incident handling; security auditing and security inspection, etc.

8.2 Operation Management and Control

8.2.1 Determination of operation management responsibilities

Activity objective.

Through the role division of operation management activities or tasks, and the granting of corresponding management authority, determine the specific personnel and responsibilities of security operation management. Roles shall at least be divided into system administrators, security administrators and security auditors. Participating role. operating and using organization.

8.3 Alteration Management and Control

8.3.1 Alteration demand and influence analysis

Through the analysis of alteration demands and alteration influence during the operation and operation maintenance process, determine the category of alteration; plan the subsequent activity content.

8.3.2 Alteration process control

Ensure that the alteration implementation process is under control during the operation and maintenance. The various alteration content shall be recorded, so as to guarantee that the influence of the alterations on the operation is the minimum.

8.4.1 Determination of monitoring objects

Determine factors that might affect the security of classified protection objects, namely, determine the objects of security status monitoring.

8.5 Security Self-inspection and Continuous Improvement

8.5.1 Self-inspection of security status

Activity objective.

Through self-inspection of the security status of classified protection objects, provide basis and suggestions to the continuous improvement process of classified protection objects; ensure that the security protection capability of classified protection objects satisfies the security requirements of corresponding level.

8.6 Management and Monitoring of Service Provider

8.6.1 Selection of service provider

Activity objective.

Determine service providers with nationally or industrially stipulated design, evaluation and construction qualifications; lay a foundation for the subsequent management and monitoring.

8.9 Emergency Response and Guarantee

8.9.1 Emergency preparation

Activity objective.

Establish a perfect emergency organizational system; ensure rapid and well-coordinated emergency rescue work. Through the analysis of the level of security incidents, under a uniform emergency plan, formulate different emergency plans for different security incidents. Through the organization of emergency drill for classified protection objects, the cybersecurity emergency capability can be effectively inspected.

9.1 Workflow of Rating Object Termination Stage

The rating object termination stage is the final link of the implementation process of classified protection. When rating objects are transferred, terminated or abolished, correct handling of sensitive information is critical to ensuring the security of an institution's information assets.

9.2 Information Transfer, Temporary Storage and Removal

Activity objective.

In the rating object termination processing process, adopt appropriate measures for information that might be used in other rating objects to securely transfer or temporarily store it to recoverable medium, so as to guarantee continued use in the future.

9.3 Equipment Migration or Abolishment

Activity objective.

Ensure that after the termination of rating objects, the migrated or abolished equipment does not include sensitive information. The mode of equipment disposal shall comply with the requirements of relevant national departments. […]