GB/T 31168-2023Information security technology—Security capability requirements for cloud computing services (English PDF)

3 Terms and definitions

4 Abbreviations

5 Expression and implementation of cloud computing security requirements

6 System development and supply chain security

7 System and communications protection

8 Access control

9 Data protection

10 Configuration management

11 Maintenance management

12 Emergency response

13 Audit

14 Risk assessment and continuous monitoring

15 Security organization and personnel

16 Physical and environmental security

Foreword

This document was issued on 23 May 2023 by the State Administration for Market Regulation and the Standardization Administration of the People's Republic of China, and has been in force since 1 December 2023.

It replaces GB/T 31168-2014.

The document is under the responsibility of the Standardization Administration of China.

Classification: ICS 35.030, CCS L 80.

About this edition

GB/T 31168-2023 is the current edition. It was issued on 23 May 2023 and has been in force since 1 December 2023, replacing GB/T 31168-2014.

GB/T 31168-2014 has been superseded: a specification that still cites it is citing a withdrawn edition.

The interval between issue and effect is the transition period. It exists so that producers, laboratories and buyers can requalify products, revise procedures and use up documentation before the new text becomes the one that applies. The date on this page is the official one from the record of the Standardization Administration.

Classification and status

GB/T 31168-2023 is classified under ICS 35.030, in the field of information technology. ICS is the International Classification for Standards, the same scheme used by ISO and by the national bodies of most countries, which is what allows a Chinese standard to be placed beside its foreign counterparts on subject rather than on number.

Its Chinese Standard Classification code is CCS L 80. CCS is the domestic scheme, a letter for the sector and two digits for the subject within it, and it is the code by which the standard is filed and searched in China.

The GB/T prefix marks a recommended national standard. It is not, in itself, law: it becomes binding when a contract names it, when a regulation or a mandatory standard refers to it, or when a producer declares conformity with it. In practice that covers most of the cases in which it will be read — a purchase specification, an inspection agreement or a certification scheme.

The document is under the responsibility of the Standardization Administration of China, which is the body that maintains it and that will answer a formal question about its interpretation.