GB/T 28450-2020Cybersecurity technology - Guidelines for information security management systems auditing (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1.Structure and Drafting Rules of Standardization Documents".

Drafting.

This document supersedes GB/T 28450-2020 "Information Technology Security Technology - Guidelines for Auditing Information Security Management Systems" and is consistent with...

Compared with GB/T 28450-2020, apart from structural adjustments and editorial changes, the main technical changes are as follows.

---All sections on "General Principles," "Establishing Audit Programs," and "Identifying and Assessing Audit Program Risks" in the chapter "Management of Audit Programs" have been deleted.

Contents (see sections 5.1 and 5.3.4 of the 2020 edition);

---The section "Risks and Opportunities Identified When Planning an ISMS" in the chapter "Management of Audit Programs" has been removed [see 2020 edition].

5.2.1d)];

---The section on "Implementing the Audit Program" in the chapter on "Management of Audit Programs" has been deleted. Specifically, the section on "IS5.4.2 specifies the objectives, scope, and..." has been removed.

The "Evaluation of the process for maintaining and effectively improving the ISMS" in the "Guidelines" [see 5.4, 5.4.2.1b) of the 2020 edition];

---The section on "Distribution of Audit Reports" in the chapter on "Conducting the Audit" has been deleted. The original text stated, "When distributing audit reports, appropriate measures should be taken to ensure the reports are properly distributed."

"Confidentiality" (see 6.5 and 6.5.2.1 in the 2020 edition).

This document adopts the ISO /IEC 27007.2020 standard, "Information security, network security and privacy protection, information security management system audit".

guide".

The following minimal editorial changes have been made to this document.

---The standard's name has been changed to "Guidelines for Auditing Information Security Management Systems in the Field of Cybersecurity."

---Added Appendix A with a plan for the changes (see A.3.3);

---The order of continuous improvement and non-compliance corrective actions in Appendix A has been changed.

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260).

1 Scope

Based on GB/T 19011-2021, this document provides guidelines for the management and auditing of Information Security Management System (ISMS) audit schemes.

Guidelines on implementation and ISMS auditor competence, etc.

This document is applicable to all organizations that need to understand or implement internal or external audits of ISMS, or that need to manage ISMS audit programs.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 19011-2021 Guidelines for Management System Auditing (ISO 19011.2018, IDT)

GB/T 29246-2023 Information Security Technology - Overview and Glossary of Information Security Management Systems (ISO /IEC 27000.2018)

IDT)

3 Terms and Definitions

The terms and definitions defined in GB/T 19011-2021 and GB/T 29246-2023 apply to this document.

4 Review Principles

The principles in Chapter 4 of GB/T 19011-2021 apply.

5 Management of the audit plan