GB/T 31506-2022Information security technology—Security guidelines for website system of government affairs (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

This document replaces GB/T 31506-2015 "Information Security Technology Government Portal System Security Technical Guidelines", and Compared with GB/T 31506-2015, in addition to structural adjustment and editorial changes, the main technical changes are as follows.

--- Combined with the standard name change and content, the content of safety management measures has been added to the scope (see Chapter 1);

--- Changed the terms and definitions of 3.1~3.3 (see Chapter 3, 3.1~3.3 of the.2015 edition);

--- Added English abbreviations in the full text (see Chapter 4);

---Redescribe the overview of Chapter 5, delete the website system logical structure and website system composition structure, and change the website security goal and protective measures and the content of the operating mode (see Chapter 5, Chapter 5 of the.2015 edition);

--- Adjust the classification into physical security, communication network, regional boundaries, content publishing and data security, computing environment, security management center, management management systems, governing bodies, personnel and training, development and delivery, operation and maintenance, evaluation inspections, password management, system logout (see Section 6 Chapters and Chapters 7, Chapters 6 and 7 of the.2015 Edition);

--- Improve the content of specific safety protection measures in each classification (see Chapters 6 and 7, Chapters 6 and 7 of the.2015 edition);

--- Deleted Appendix A (normative appendix) advanced security technical measures (Appendix A of the.2015 edition).

1 Scope

This document gives the security technical measures and security management measures that can be taken when implementing security protection for the government website system.

This document is suitable for guiding government departments to carry out security protection of website systems, and can also be used as a safety supervision for government website systems. A reference when managing and evaluating inspections.

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 8566-2007 Information Technology Software Life Cycle Process

GB/T 25069 Information Security Technical Terminology

GB/T 30998-2014 Information Technology Software Security Assurance Specification

GB/T 31168 Information Security Technology Cloud Computing Service Security Capability Requirements

GB/T 32925-2016 Basic requirements for security management of government networked computer terminals for information security technology

GB/T 33562-2017 Implementation Guide for Information Security Technology Security Domain Name System

GB/T 35273-2020 Information Security Technology Personal Information Security Specification

GB/T 36637-2018 Information Security Technology ICT Supply Chain Security Risk Management Guidelines

GB/T 37002-2018 Information Security Technology Email System Security Technical Requirements

GB/T 37729-2019 Information Technology Intelligent Mobile Terminal Application Software (APP) Technical Requirements

GB/T 38249-2019 Information Security Technology Government Website Cloud Computing Service Security Guidelines

GB/T 38645-2020 Information Security Technology Network Security Incident Emergency Drill Guide

GB/T 39477-2020 Information Security Technology Government Information Sharing Data Security Technical Requirements

GB/T 39786-2021 Basic requirements for cryptographic applications of information security technology information systems

GB 50174-2017 Data Center Design Specification

3 Terms and Definitions

The terms and definitions defined in GB/T 25069 and the following apply to this document.

4 Abbreviations

The following abbreviations apply to this document.