Valid

GB/T 30270-2024Cybersecurity technology - Methodology for IT security evaluation (English PDF)

网络安全技术信息技术安全评估方法

Preview PDF

This is a limited preview

Buy now to download the full PDF (334 pages)

Need quotation for your management?

Get a formal quotation for GB/T 30270-2024 in 30 minutes.

Issued by

State Administration for Market Regulation, China National Standardization Administration

Level / Type

National · Recommended

Issue date

April 25, 2024

Implementation date

November 1, 2024

Scope

GB/T 30270-2024 is the English-translated version of 网络安全技术信息技术安全评估方法.

GB/T 30270-2024 — This document describes the procedures that assessors are required to perform when conducting an assessment based on the criteria and assessment evidence defined in ISO/IEC 15408: The minimum set of rows: This document applies to assessment activities carried out in accordance with ISO/IEC 15408:

Found what you need?

Document preview — GB/T 30270-2024

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80
Replacing: GB/T 30270-2013

Issued by: State Administration for Market Regulation, China National Standardization Administration

Preface
Introduction
1 Scope
2 Normative references
3 Terms and Definitions
4 Abbreviations
5 Writing style
6 Verb Usage
7 Overall Assessment Guidelines
8 Relationship between ISO/IEC 15408 and the structure of this document
9 Evaluation process and related tasks
9.1 Overview
9.2 Overview of the evaluation process
9.2.1 Purpose
9.2.2 Role Responsibilities
9.2.3 Role Relationship
9.2.4 General evaluation model
9.2.5 Assessor's decision
9.3 Evaluating Input Tasks
9.3.1 Purpose
9.3.2 Application Notes
9.3.3 Management of the Evidence Assessment Subtask
9.4 Evaluation sub-activity
9.5 Evaluation Output Task
9.5.1 Purpose
9.5.2 Evaluation Output Management
9.5.3 Application Note
9.5.4 Writing OR subtask
9.5.5 Writing ETR subtask
10 APE category: PP assessment
10.1 Overview
10.2 Reuse of certified PP assessment results
10.3 PP Introduction (APE_INT)
10.3.1 Assessment sub-activity (APE_INT:1)
10.4 Declaration of Conformity (APE_CCL)
10.4.1 Assessment sub-activity (APE_CCL:1)
10.5 Security Problem Definition (APE_SPD)
10.5.1 Assessment sub-activity (APE_SPD:1)
10.6 Security Objectives (APE_OBJ)
10.6.1 Assessment sub-activity (APE_OBJ:1)
10.6.2 Assessment sub-activity (APE_OBJ:2)
10.7 Extended Component Definition (APE_ECD)
10.7.1 Evaluation sub-activity (APE_ECD:1)
10.8 Security Requirements (APE_REQ)
10.8.1 Assessment sub-activity (APE_REQ:1)
10.8.2 Assessment sub-activity (APE_REQ:2)
11 ACE category: PP configuration evaluation
11.1 Overview
11.2 PP-Module Introduction (ACE_INT)
11.2.1 Evaluation sub-activity (ACE_INT:1)
11.3 PP-Module Declaration of Conformity (ACE_CCL)
11.3.1 Sub-activity evaluation (ACE_CCL:1)
11.4 PP-Module Security Problem Definition (ACE_SPD)
11.4.1 Evaluation sub-activity (ACE_SPD:1)
11.5 PP-Module Security Objective (ACE_OBJ)
11.5.1 Evaluation sub-activity (ACE_OBJ:1)
11.5.2 Evaluation sub-activity (ACE_OBJ:2)
11.6 PP-Module Extension Component Definition (ACE_ECD)
11.6.1 Evaluation sub-activity (ACE_ECD:1)
11.7 PP-Module Safety Requirements (ACE_REQ)
11.7.1 Evaluation sub-activity (ACE_REQ:1)
11.7.2 Evaluation sub-activity (ACE_REQ:2)
11.8 PP-Module Conformance (ACE_MCO)
11.8.1 Evaluation sub-activity (ACE_MCO:1)
11.9 PP-Configuration Consistency (ACE_CCO)
11.9.1 Evaluation sub-activity (ACE_CCO:1)
12 ASE Category: Safety Objective Assessment
12.1 Overview
12.2 Application Note
12.2.1 Reusing the evaluation results of a certified PP
12.3 ST Introduction (ASE_INT)
12.3.1 Evaluation sub-activity (ASE_INT:1)
12.4 Declaration of Conformity (ASE_CCL)
12.4.1 Evaluation sub-activity (ASE_CCL:1)
12.5 Security Problem Definition (ASE_SPD)
12.5.1 Evaluation sub-activity (ASE_SPD:1)
12.6 Security Objectives (ASE_OBJ)
12.6.1 Evaluation sub-activity (ASE_OBJ:1)
12.6.2 Evaluation sub-activity (ASE_OBJ:2)
12.7 Extended Component Definition (ASE_ECD)
12.7.1 Evaluation sub-activity (ASE_ECD:1)
12.8 Security Requirements (ASE_REQ)
12.8.1 Evaluation sub-activity (ASE_REQ:1)
12.8.2 Evaluation sub-activity (ASE_REQ:2)
12.9 TOE Summary Specification (ASE_TSS)
12.9.1 Evaluation sub-activity (ASE_TSS:1)
12.9.2 Evaluation sub-activity (ASE_TSS:2)
12.10 Composite Product Safety Objective Conformance (ASE_COMP)
12.10.1 Overview
12.10.2 Evaluation sub-activity (ASE_COMP:1)
13 ADV category: Development
13.1 Overview
13.2 Application Note
13.3 Security Architecture (ADV_ARC)
13.3.1 Evaluation sub-activity (ADV_ARC:1)
13.4 Functional Specification (ADV_FSP)
13.4.1 Evaluation sub-activity (ADV_FSP:1)
13.4.2 Evaluation sub-activity (ADV_FSP:2)
13.4.3 Evaluation sub-activity (ADV_FSP:3)
13.4.4 Evaluation sub-activity (ADV_FSP:4)
13.4.5 Evaluation sub-activity (ADV_FSP:5)
13.4.6 Evaluation sub-activity (ADV_FSP:6)
13.5 Implementation Representation (ADV_IMP)
13.5.1 Evaluation sub-activity (ADV_IMP:1)
13.5.2 Evaluation sub-activity (ADV_IMP:2)
13.6 TSF Internal (ADV_INT)
13.6.1 Evaluation sub-activity (ADV_INT:1)
13.6.2 Evaluation sub-activity (ADV_INT:2)
13.6.3 Evaluation sub-activity (ADV_INT:3)
13.7 Security Policy Model (ADV_SPM)
13.7.1 Evaluation sub-activity (ADV_SPM:1)
13.8 TOE Design (ADV_TDS)
13.8.1 Evaluation sub-activity (ADV_TDS:1)
13.8.2 Evaluation sub-activity (ADV_TDS:2)
13.8.3 Evaluation sub-activity (ADV_TDS:3)
13.8.4 Evaluation sub-activity (ADV_TDS:4)
13.8.5 Evaluation sub-activity (ADV_TDS:5)
13.8.6 Evaluation Sub-Activity (ADV_TDS:6)
13.9 Composite Design Compliance (ADV_COMP)
13.9.1 Overview
13.9.2 Evaluation sub-activity (ADV_COMP:1)
14 AGD category: Guidance documents
14.1 Overview
14.2 Application Notes
14.3 Operation User Guide (AGD_OPE)
14.3.1 Evaluation sub-activity (AGD_OPE:1)
14.4 Preparation procedure (AGD_PRE)
14.4.1 Evaluation sub-activity (AGD_PRE:1)
15 ALC Class: Life Cycle Support
15.1 Overview
15.2 CM Capability (ALC_CMC)
15.2.1 Evaluation sub-activity (ALC_CMC:1)
15.2.2 Evaluation sub-activity (ALC_CMC:2)
15.2.3 Evaluation sub-activity (ALC_CMC:3)
15.2.4 Evaluation sub-activity (ALC_CMC:4)
15.2.5 Evaluation sub-activity (ALC_CMC:5)
15.3 CM Range (ALC_CMS)
15.3.1 Evaluation sub-activity (ALC_CMS:1)
15.3.2 Evaluation sub-activity (ALC_CMS:2)
15.3.3 Evaluation sub-activity (ALC_CMS:3)
15.3.4 Evaluation sub-activity (ALC_CMS:4)
15.3.5 Evaluation sub-activity (ALC_CMS:5)
15.4 Delivery (ALC_DEL)
15.4.1 Evaluation sub-activity (ALC_DEL:1)
15.5 Development Security (ALC_DVS)
15.5.1 Evaluation sub-activity (ALC_DVS:1)
15.5.2 Evaluation sub-activity (ALC_DVS:2):199
15.6 Defect Correction (ALC_FLR):201
15.6.1 Evaluation sub-activity (ALC_FLR:1):201
15.6.2 Evaluation sub-activity (ALC_FLR:2)
15.6.3 Evaluation sub-activity (ALC_FLR:3)
15.7 Lifecycle Definition (ALC_LCD)
15.7.1 Evaluation sub-activity (ALC_LCD:1)
15.7.2 Evaluation sub-activity (ALC_LCD:2)
15.8 TOE Development Component (ALC_TDA)
15.8.1 Evaluation sub-activity (ALC_TDA:1)
15.8.2 Evaluation sub-activity (ALC_TDA:2)
15.8.3 Evaluation sub-activity (ALC_TDA:3)
15.9 Tools and Techniques (ALC_TAT)
15.9.1 Evaluation sub-activity (ALC_TAT:1)
15.9.2 Evaluation sub-activity (ALC_TAT:2)
15.9.3 Evaluation sub-activity (ALC_TAT:3)
15.10 Composite Part Integration and Delivery Process Conformity Verification (ALC_COMP)
15.10.1 Overview
15.10.2 Evaluation sub-activity (ALC_COMP:1)
16 ATE category: test
16.1 Overview
16.2 Application Notes
16.2.1 Understanding the Expected Behavior of TOE
16.2.2 Testing and Alternative Methods for Verifying Expected Functional Behavior
16.2.3 Verification of the adequacy of testing
16.3 Coverage (ATE_COV)
16.3.1 Evaluation sub-activity (ATE_COV:1)
16.3.2 Evaluation sub-activity (ATE_COV:2)
16.3.3 Evaluation sub-activity (ATE_COV:3)
16.4 Depth (ATE_DPT)
16.4.1 Evaluation sub-activity (ATE_DPT:1)
16.4.2 Evaluation sub-activity (ATE_DPT:2)
16.4.3 Evaluation sub-activity (ATE_DPT:3)
16.4.4 Evaluation sub-activity (ATE_DPT:4)
16.5 Functional Test (ATE_FUN)
16.5.1 Evaluation Sub-Activity (ATE_FUN:1)
16.5.2 Evaluation sub-activity (ATE_FUN:2)
16.6 Independent Test (ATE_IND)
16.6.1 Evaluation sub-activity (ATE_IND:1)
16.6.2 Evaluation sub-activity (ATE_IND:2)
16.6.3 Evaluation sub-activity (ATE_IND:3)
16.7 Composite Function Test (ATE_COMP)
16.7.1 Overview
16.7.2 Evaluation sub-activity (ATE_COMP:1)
17 AVA category: vulnerability assessment
17.1 Overview
17.2 Vulnerability Analysis (AVA_VAN)
17.2.1 Evaluation sub-activity (AVA_VAN:1)
17.2.2 Evaluation sub-activity (AVA_VAN:2)
17.2.3 Evaluation sub-activity (AVA_VAN:3)
17.2.4 Evaluation sub-activity (AVA_VAN:4)
17.2.5 Evaluation Sub-Activity (AVA_VAN:5)
17.3 Composite Vulnerability Assessment (AVA_COMP)
17.3.1 Overview
17.3.2 Evaluation sub-activity (AVA_COMP:1)
18 ACO Class: Combination
18.1 Overview
18.2 Application Notes
18.3 Combination Basic Principles (ACO_COR)
18.3.1 Evaluation sub-activity (ACO_COR:1)
18.4 Development Evidence (ACO_DEV)
18.4.1 Evaluation Sub-Activity (ACO_DEV:1)
18.4.2 Evaluation Sub-Activity (ACO_DEV:2)
18.4.3 Evaluation sub-activity (ACO_DEV:3)
18.5 Dependencies of Dependent Components (ACO_REL)
18.5.1 Evaluation sub-activity (ACO_REL:1)
18.5.2 Evaluation sub-activity (ACO_REL:2)
18.6 Combined TOE Test (ACO_CTT)
18.6.1 Evaluation sub-activity (ACO_CTT:1)
18.6.2 Evaluation sub-activity (ACO_CTT:2)
18.7 Combined Vulnerability Analysis (ACO_VUL)
18.7.1 Evaluation Sub-Activity (ACO_VUL:1)
18.7.2 Evaluation Sub-Activity (ACO_VUL:2)
18.7.3 Evaluation Sub-Activity (ACO_VUL:3)
Appendix A (Informative) General Assessment Guidelines
A:1 Purpose
A:2 Sampling
A:3 Dependencies
A:3:1 Overview
A:3:2 Dependencies between activities
A:3:3 Dependencies between sub-activities
A:3:4 Dependencies between behaviors
A:4 On-site verification
A:4:1 Overview
A:4:2 General approach
A:5 Guidance on checklists
A:5:1 Configuration Management Aspects
A:5:2 Development security aspects
A:5:3 Checklist Example
A:6 Assessment of institutional responsibilities
Appendix B (Informative) Vulnerability Assessment (AVA)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting:

This document replaces GB/T 30270-2013 "Information Technology Security Technology Information Technology Security Assessment Methods":

Compared with GB/T 30270-2013, in addition to structural adjustments and editorial changes, the main technical changes are as follows:

--- Deleted the "Overview" section (see Chapter 5 of the:2013 edition);

--- Changed "Document Conventions" (see Chapter 5, Chapter 6, Chapter 7, Chapter 8, Chapter 6 of the:2013 edition);

--- Changed "General Assessment Tasks" (see Chapter 9, Chapter 7 of the:2013 edition);

--- Changed "Protection Profile Assessment" (see Chapter 10, Chapter 8 of the:2013 edition);

--- Changed "ASE Category: Safety Objective Assessment" (see Chapter 12, Chapter 9 of the:2013 edition);

--- Changed the "defect correction sub-activity" (see 15.6, Chapter 14 of the:2013 edition);

--- Deleted "EAL1 evaluation", "EAL2 evaluation", "EAL3 evaluation" and "EAL4 evaluation" (see Chapter 10,:2013 edition, Chapters 11, 12 and 13);

--- Added "ACE Class: PP-Configuration Evaluation", "ADV Class: Development", "AGD Class: Guidance Document", "ALC Class: Life Cycle Support "ATE: Testing" "AVA: Vulnerability Assessment" "ACO: Combination" (see Chapters 11, 13, 14, and Chapter 15, Chapter 16, Chapter 17, Chapter 18):

This document is equivalent to ISO/IEC 18045:2022 "Information security, cybersecurity and privacy protection, information technology security assessment criteria" Information Technology Security Assessment Methodology:

The following minimal editorial changes were made to this document:

--- In order to coordinate with the existing standards, the name of the standard is changed to "Network Security Technology Information Technology Security Assessment Method";

--- For ease of use, the abbreviations appearing in the text are added to the Abbreviations section:

Introduction

The target audience of this document is primarily assessors who use ISO/IEC 15408 and certifiers who confirm the performance of assessors, and secondarily assessors:

Origins, developers and authors of protection profiles, PP-modules, PP-configurations, security goals, and other parties interested in IT security:

This document does not address all questions regarding IT security assessments, and some questions may require further explanation: These explanations will be provided by each assessment system decides how to proceed, even if they are subject to multilateral mutual recognition agreements:

The table is given in Annex A: This document is intended to be used in conjunction with ISO/IEC 15408:

Cybersecurity Technology Information Technology Security Assessment Methods

1 Scope

This document describes the procedures that assessors are required to perform when conducting an assessment based on the criteria and assessment evidence defined in ISO/IEC 15408:

The minimum set of rows:

This document applies to assessment activities carried out in accordance with ISO/IEC 15408:

2 Normative references

The contents of the following documents constitute the essential clauses of this document through normative references in this document:

For referenced documents without a date, only the version corresponding to that date applies to this document; for referenced documents without a date, the latest version (including all amendments) applies to this document:

GB/T 18336.1-2024 Cybersecurity technology Information technology security assessment criteria Part 1: Introduction and general model (ISO/IEC 15408-1:2022, IDT) GB/T 18336.2-2024 Cybersecurity technology Information technology security assessment criteria Part 2: Security functional components (ISO/IEC 15408-2:2022, IDT) GB/T 18336.3-2024 Cybersecurity technology Information technology security assessment criteria Part 3: Security assurance components (ISO/IEC 15408-3:2022, IDT) GB/T 18336.5-2024 Cybersecurity technology Information technology security assessment criteria Part 5: Predefined security requirements package (ISO/IEC 15408-5:2022, IDT) ISO/IEC 15408-1 Information security, network security and privacy protection Information technology security evaluation criteria Part 1: Introduction and Note: GB/T 18336.1-2024 Cybersecurity technology Information technology security assessment criteria Part 1: Introduction and general model (ISO/IEC 15408-1:2022, IDT) ISO/IEC 15408-2 Information security, network security and privacy protection Information technology security evaluation criteria Part 2: Security functions Note: GB/T 18336.2-2024 Cybersecurity technology Information technology security evaluation criteria Part 2: Security functional components (ISO/IEC 15408-2:

2022, IDT)

ISO/IEC 15408-3 Information security, network security and privacy protection Information technology security evaluation criteria Part 3: Security protection Note: GB/T 18336.3-2024 Cybersecurity technology Information technology security assessment criteria Part 3: Security assurance components (ISO/IEC 15408-3:

2022, IDT)

ISO/IEC 15408-4 Information security, network security and privacy protection Information technology security evaluation criteria Part 4: Evaluation criteria Note: GB/T 18336.4-2024 Cybersecurity technology Information technology security assessment criteria Part 4: Normative framework for assessment methods and activities

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 334 pages — is available in the English PDF.

Referenced standards

Normative references

ISO/IEC 15408

Cited by

How to Download GB/T 30270-2024

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.