GB/T 32914-2023Information security technology —Capability requirements of cybersecurity service (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

This document replaces GB/T 32914-2016 "Information Security Technology Information Security Service Provider Management Requirements" and is consistent with Compared with GB/T 32914-2016, in addition to structural adjustments and editorial changes, the main technical changes are as follows.

a) Changed the term "information security services" to "network security services" and changed the definition (see 3.1, 3.1 of the 2016 version);

b) Added general requirements (see Chapter 4);

c) Change and merge the contents of Chapter 5 and Chapter 6 into "Chapter 5 General Requirements" (see Chapter 5, Chapter 5 and Chapter 6 of the 2016 edition) Chapter 6);

d) Added "supply chain management" requirements (see 5.4);

e) Added "remote service" requirements (see 5.7);

f) Added "legal protection" requirements (see 5.8);

g) Added "data security protection" requirements (see 5.9);

h) Added "service sustainability" requirements (see 5.10);

i) Added the content of "Special Requirements for Testing and Evaluation Services" (see 5.11);

j) Added the content of "Special Requirements for Security Operation and Maintenance Services" (see 5.12);

k) Added "enhanced requirements" content (see Chapter 6);

l) Added the content of "Common Tool Types Used by Network Security Services" (see Appendix A).

1 Scope

This document specifies the capability requirements for network security services, including general requirements and enhanced requirements.

This document is suitable for guiding network security service organizations to carry out network security services and evaluating the capability level of network security service organizations.

It can also provide reference for network security service demanders when choosing network security service agencies.

Note: The network security services described in this document do not include network security services involving state secrets.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 20984 Information Security Technology Information Security Risk Assessment Method

GB/T 22080 Information technology security technology information security management system requirements

GB/T 25069 Information Security Technical Terminology

GB/T 36959 Information security technology network security level protection evaluation agency capability requirements and evaluation specifications

GB/T 39204-2022 Information security technology security protection requirements for critical information infrastructure

GB/T 42446 Basic competency requirements for information security technology and network security practitioners

GB/T 42461 Information security technology network security service cost measurement guide

National Cybersecurity Incident Emergency Plan (Office of the Central Cybersecurity and Informatization Leading Group on January 10, 2017 [2017] Announced on the 4th)

Regulations on the Management of Network Product Security Vulnerabilities (July 12, 2021, Ministry of Industry and Information Technology, National Internet Information Office, Ministry of Public Security [2021] Announcement No. 66)

Catalog of key network equipment and network security-specific products (first batch) (State Internet Information Office Industry on June 1, 2017 and the Ministry of Information Technology and the Ministry of Public Security National Certification and Accreditation Supervision and Administration Commission [2017] No. 01)

3 Terms and definitions

The terms and definitions defined in GB/T 25069 and the following apply to this document.