Valid

GB/T 32919-2016Information security technology—Application guide to industrial control system security control (English PDF)

信息安全技术工业控制系统安全控制应用指南

Preview PDF

This is a limited preview

Buy now to download the full PDF (105 pages)

Need quotation for your management?

Get a formal quotation for GB/T 32919-2016 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

August 29, 2016

Implementation date

March 1, 2017

Scope

GB/T 32919-2016 is the English-translated version of 信息安全技术工业控制系统安全控制应用指南.

GB/T 32919-2016 sets out a catalogue of security controls available for industrial control systems (ICS) and governs the process by which those controls are selected, tailored, compensated and supplemented so as to build a security control baseline.

Clause 1 states two uses for the document: giving a solid foundation to the security function requirements used in the security design of an industrial control system, security architecture design included, and guiding the adjustment and enhancement of security capability during the security rectification of an existing system; it is addressed to organizations responsible for building industrial control systems, to the staff responsible for implementing information security work and to other personnel engaged in information security.

The introduction adds that it is meant to guide the information security design, implementation and rectification work of ICS owners, users, design implementers and information security managers, and that it can also serve as a reference for information security operation, risk assessment and security inspection.

Its contents list names clause 5 Security control overview, clause 6 Security control baselines and their design, clause 7 Security control selection and tailoring, subdivided into selection, the tailoring process, guidance on scope definition, compensating controls, the assignment of security control parameters, supplementation and the establishment of a security control decision document, and clause 8 Application of the security control selection process.

Clause 3 defines industrial control system, supervisory control and data acquisition system (SCADA) and distributed control system (DCS), and takes further terminology from GB/T 25069-2010.

Annex A (informative) treats the security risks of industrial control systems, comparing them with traditional information systems and analysing threats and the vulnerabilities of policies and procedures, of networks and of platforms; Annex B (informative) carries the control list itself, arranged in families that include planning, security assessment and authorization, risk assessment, system and service acquisition, program management, personnel security, physical and environmental security, contingency planning, configuration management, maintenance, system and information integrity, media protection, incident response, education and training, identification and authentication, access control, audit and accountability, and system and communication protection; Annex C (normative) gives the security control baselines.

The standard was proposed by the National Information Security Standardization Technical Committee (SAC/TC260), was issued on 29 August 2016 and has applied since 1 March 2017.

Found what you need?

Document preview — GB/T 32919-2016

National Standard of the People's Republic of China

ICS: 35.040
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
Introduction
1 Scope
2 normative reference document
3 Terms and definitions
4 acronym
5 Safety Control Overview
6 Safety control baselines and their designs
7 Safety Control Options and Statutes
7.1 Selection and Statute Overview
7.2 Safety Control Options
7.3 security control cut
7.3.1 Crop process
7.3.2 Guidance on scope definition
7.3.3 Safety Control Compensation
7.3.4 Assignment of safety control parameters
7.4 Safety Control Supplement
7.5 Establish safety control decision document
8 Security Control Selection Process Application
Appendix A (informative) Safety risks for industrial control systems
A.2 Information system security threats and protective measures Impact on industrial control systems
A.3 Threats to industrial control systems
A.4 Industrial Control System Vulnerability Analysis
A.4.1 Overview of Vulnerability in Industrial Control Systems
A.4.2 Vulnerability of policies and procedures
A.4.3 Network Vulnerability
A.4.4 Platform Vulnerability
Appendix B (informative) Safety control list for industrial control systems
B.1 Planning (PL)
B.1.1 SAFETY PLANNING STRATEGY AND PROCEDURE (PL-1)
B.1.2 System Security Planning (PL-2)
B.1.3 Code of Conduct (PL-3)
B.1.4 Information Security Architecture (PL-4)
B.1.5 Safety activities planning (PL-5)
B.2 Safety Assessment and Authorization (CA)
B.2.1 Security Assessment and Authorization Strategies and Procedures (CA-1)
B.2.2 Safety assessment (CA-2)
B.2.3 ICS Connection Management (CA-3)
B.2.4 Implementation Plan (CA-4)
B.2.5 Security Authorization (CA-5)
B.2.6 Continuous monitoring (CA-6)
B.2.7 Permeation Test (CA-7)
B.2.8 Internal connection (CA-8)
B.3 Risk Assessment (RA)
B.3.1 Risk assessment strategies and procedures (RA-1)
B.3.2 Safety Classification (RA-2)
B.3.3 Risk assessment (RA-3)
B.3.4 Vulnerability Scanning (RA-4)
B.4 System and Service Acquisition (SA)
B.4.1 System and Service Acquisition Policies and Procedures (SA-1)
B.4.2 Resource allocation (SA-2)
B.4.3 Survival cycle support (SA-3)
B.4.4 Service Acquisition (SA-4)
B.4.5 System documentation (SA-5)
B.4.6 Software Use Restriction (SA-6)
B.4.7 User Installation Software (SA-7)
B.4.8 Safety Engineering Principles (SA-8)
B.4.9 External System Services (SA-9)
B.4.10 Configuration Management for Developers (SA-10)
B.4.11 Developers' Safety Test (SA-11)
B.4.12 Supply Chain Protection (SA-12)
B.4.13 Trustworthiness (SA-13)
B.4.14 Key system components (SA-14)
B.5 Program Management (PM)
B.5.1 Program Management Plan (PM-1)
B.5.2 Information Security Executive (PM-2)
B.5.3 Information security resources (PM-3)
B.5.4 Action and Milestone Program (PM-4)
B.5.5 List of Safe Assets (PM-5)
B.5.6 Safety performance measures (PM-6)
B.5.7 Organizational Structure (PM-7)
B.5.8 Key Infrastructure Program (PM-8)
B.5.9 Risk Management Strategy (PM-9)
B.5.10 Security Authorization Process (PM-10)
B.5.11 Business Process Definition (PM-11)
B.6 Personnel Safety (PS)
B.6.1 Personnel safety policies and procedures (PS-1)
B.6.2 Job Classification (PS-2)
B.6.3 Personnel review (PS-3)
B.6.4 Person leaving (PS-4)
B.6.5 Personnel Transfer (PS-5)
B.6.6 Access Protocol (PS-6)
B.6.7 Third Party Personnel Safety (PS-7)
B.6.8 Personnel penalties (PS-8)
B.7 Physical and Environmental Safety (PE)
B.7.1 Physical and Environmental Security Policies and Procedures (PE-1)
B.7.2 Physical Access Authorization (PE-2)
B.7.3 Physical Access Control (PE-3)
B.7.4 Access control of the transmission medium (PE-4)
B.7.5 Access control of the output device (PE-5)
B.7.6 Physical Access Monitoring (PE-6)
B.7.7 Access Log (PE-7)
B.7.8 Electrical Equipment and Cables (PE-8)
B.7.9 Emergency Shutdown (PE-9)
B.7.10 Emergency Power Supply (PE-10)
B.7.11 Emergency lighting (PE-11)
B.7.12 Fire (PE-12)
B.7.13 Temperature and humidity control (PE-13)
B.7.14 Waterproof (PE-14)
B.7.15 Delivery and removal (PE-15)
B.7.16 Alternate Workplace (PE-16)
B.7.17 Lightning protection (PE-17)
B.7.18 Electromagnetic protection (PE-18)
B.7.19 Information Disclosure (PE-19)
B.7.20 Personnel and equipment tracking (PE-20)
B.8 Contingency Plan (CP)
B.8.1 Contingency planning strategies and procedures (CP-1)
B.8.2 Contingency Plan (CP-2)
B.8.3 Contingency Planning Training (CP-3)
B.8.4 Contingency plan testing and exercise (CP-4)
B.8.5 Standby storage device (CP-5)
B.8.6 Standby processing equipment (CP-6)
B.8.7 Communication Services (CP-7)
B.8.8 System Backup (CP-8)
B.8.9 System Recovery and Reconstruction (CP-9)
B.9 Configuration Management (CM)
B.9.1 Configuration Management Policies and Procedures (CM-1)
B.9.2 Baseline configuration (CM-2)
B.9.3 Configuration Change (CM-3)
B.9.4 Safety Impact Analysis (CM-4)
B.9.5 Change Access Restrictions (CM-5)
B.9.6 Configuration Settings (CM-6)
B.9.7 Minimal function (CM-7)
B.9.8 List of System Components (CM-8)
B.9.9 Configuration Management Plan (CM-9)
B.10 Maintenance (MA)
B.10.1 Maintenance Strategy and Procedures (MA-1)
B.10.2 Controlled maintenance (MA-2)
B.10.3 Maintenance Tool (MA-3)
B.10.4 Remote Maintenance (MA-4)
B.10.5 Maintenance Personnel (MA-5)
B.10.6 Timely Maintenance (MA-6)
B.11 System and Information Integrity (SI)
B.11.1 System and Information Integrity Strategies and Procedures (SI-1)
B.11.2 Defect repair (SI-2)
B.11.3 Malicious Code Protection (SI-3)
B.11.4 System Monitoring (SI-4)
B.11.5 Safety alarm (SI-5)
B.11.6 Safety Function Verification (SI-6)
B.11.7 Software and Information Integrity (SI-7)
B.11.8 Input Verification (SI-8)
B.11.9 Error handling (SI-9)
B.11.10 Information processing and retention (SI-10)
B.11.11 Predictable failure prevention (SI-11)
B.11.12 Output information filtering (SI-12)
B.11.13 Memory Protection (SI-13)
B.11.14 Fail-safe procedures (SI-14)
B.11.15 Intrusion Detection and Protection (SI-15)
B.12 Media Protection (MP)
B.12.1 Media protection strategies and procedures (MP-1)
B.12.2 Media Access (MP-2)
B.12.3 Media Marking (MP-3)
B.12.4 Media Storage (MP-4)
B.12.5 Media Transfer (MP-5)
B.12.6 Media Destruction (MP-6)
B.12.7 Media Use (MP-7)
B.13 Event Response (IR)
B.13.1 Incident Response Strategies and Procedures (IR-1)
B.13.2 Event Response Training (IR-2)
B.13.3 Event Response Test and Exercise (IR-3)
B.13.4 Event Handling (IR-4)
B.13.5 Event Monitoring (IR-5)
B.13.6 Incident Report (IR-6)
B.13.7 Event Response Support (IR-7)
B.13.8 Incident Response Program (IR-8)
B.14 Education and Training (AT)
B.14.1 Education and training strategies and procedures (AT-1)
B.14.2 Safety awareness training (AT-2)
B.14.3 Role-based security training (AT-3)
B.14.4 Safety Training Record (AT-4)
B.15 Identification and Identification (IA)
B.15.1 Identification and identification strategies and procedures (IA-1)
B.15.2 Identification and identification of users within the organization (IA-2)
B.15.3 Identification and Identification of Equipment (IA-3)
B.15.4 Identifier Management (IA-4)
B.15.5 Authentication Management (IA-5)
B.15.6 Identification feedback (IA-6)
B.15.7 Password Module Identification (IA-7)
B.15.8 Identification and identification of users outside the organization (IA-8)
B.16 Access Control (AC)
B.16.1 Access Control Policies and Procedures (AC-1)
B.16.2 Account Management (AC-2)
B.16.3 Mandatory Access Control (AC-3)
B.16.4 Information flow forced access control (AC-4)
B.16.5 Separation of duties (AC-5)
B.16.6 Minimum authority (AC-6)
B.16.7 Failure Login Control (AC-7)
B.16.8 System Usage Tips (AC-8)
B.16.9 Previous Access Tips (AC-9)
B.16.10 Concurrent Session Control (AC-10)
B.16.11 Session Lock (AC-11)
B.16.12 Session Termination (AC-12)
B.16.13 Permission not identified for identification (AC-13)
B.16.14 Remote Access (AC-14)
B.16.15 Wireless Access (AC-15)
B.16.16 Access Control for Mobile Devices (AC-16)
B.16.17 Use of external systems (AC-17)
B.17 Audit and Accountability (AU)
B.17.1 Audit and Accountability Strategies and Procedures (AU-1)
B.17.2 Audit Event (AU-2)
B.17.3 Contents of audit records (AU-3)
B.17.4 Audit Storage Capacity (AU-4)
B.17.5 Audit Failure Response (AU-5)
B.17.6 Monitoring, analysis and reporting of audit information (AU-6)
B.17.7 Audit Simplification and Report Generation (AU-7)
B.17.8 Timestamp (AU-8)
B.17.9 Audit Information Protection (AU-9)
B.17.10 Anti-Rejection (AU-10)
B.17.11 Audit Information Retention (AU-11)
B.17.12 Audit Generation (AU-12)
B.18 System and Communication Protection (SC)
B.18.1 System and Communication Protection Policies and Procedures (SC-1)
B.18.2 Application Partition (SC-2)
B.18.3 Safety Function Isolation (SC-3)
B.18.4 Information in Shared Resources (SC-4)
B.18.5 Denial of Service Protection (SC-5)
B.18.6 Resource Priority (SC-6)
B.18.7 Boundary Protection (SC-7)
B.18.8 Transmission integrity (SC-8)
B.18.9 Transmission Confidentiality (SC-9)
B.18.10 Network interruption (SC-10)
B.18.11 Key Establishment and Management (SC-11)
B.18.12 Use of cryptographic techniques (SC-12)
B.18.13 Public Access Protection (SC-13)
B.18.14 Transmission of security attributes (SC-14)
B.18.15 Certificate Management (SC-15)
B.18.16 Mobile code (SC-16)
B.18.17 Session Authentication (SC-17)
B.18.18 Failure in known state (SC-18)
B.18.19 Remaining Information Protection (SC-19)
B.18.20 Execution program isolation (SC-20)
Appendix C (normative) Safety control baselines for industrial control systems
Reference

Foreword

This standard is drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

Industrial control systems (ICS) [including monitoring and data acquisition systems (SCADA), distributed control systems (DCS), programmable logic control (PLC) and other products] in nuclear facilities, aerospace, advanced manufacturing, petroleum and petrochemical, oil and gas pipeline network, power systems, transportation, water conservancy New Zealand, urban facilities and other important areas have been widely used.

With the development of information technology, especially the deep integration of information technology and industrialization and the rapid development of Internet of Things, industrial control system products More and more common use of common protocols, common hardware and common software, in various ways and the Internet and other public network connection, the traditional information system The threat of viruses, Trojans, etc. is spreading to the field of industrial control systems, and the information security of industrial control systems is increasing. prominent.

Industrial control system safety control application guide is for the industry to use the industrial control system given the safety control application of the basic side Method is to guide the selection, tailoring, compensation and supplementation of industrial control systems for safety control, forming a safety control baseline for the organization's needs to meet Organization of industrial control system security needs, to achieve the industrial control system for appropriate and effective risk control management.

This standard applies to industrial control system owners, users, design implementers and information security management, industrial control systems Information security design, implementation, rectification work to provide guidance, but also for industrial control system information security operation, risk assessment and security inspection work to mention for reference. Information Security Technology Industry Control System Security Control Application Guide

1 Scope

This standard provides a list of safety controls available for industrial control systems that govern the safety control selection process of industrial control systems to It constructs the safety program of the industrial control system - a conceptual level of security solution.

This standard applies to.

a) Facilitate the safety function requirements of the industrial control system for safety design (including safety architecture design) and safety Have a strong foundation.

b) to guide the adjustment and enhancement of safety capability in the safety and rectification of industrial control systems so that the industrial control system can be kept Full nature.

This standard is applicable to the organization responsible for the construction of industrial control systems, responsible for the implementation of information security workers and other Engaged in information security work related personnel.

2 Normative reference documents

The following documents are indispensable for the application of this document. For dated references, only the dated edition applies to this document. For undated references, the latest edition (including all modifications) applies to this document.

Information security - Technical information systems - Safety - rating - Guidelines for the protection of GB/T 22240-2008 Information security technical terminology GB/T 25069-2010

3 Terms and definitions

GB/T 25069-2010 Definitions and the following terms and definitions apply to this document.

3.1 Industrial control system

The Industrial Control System (ICS) is a generic term that includes a variety of control systems used in industrial production, including monitoring and data mining (SCADA), distributed control system (DCS) and other smaller control systems, such as programmable logic controller (PLC), is now wide Widely used in industrial and critical infrastructures.

3.2 Supervisory control and data acquisition system; SCADA

In the process of industrial production control, large-scale long-distance geographical distribution of assets and equipment in the wide area network environment for centralized data Acquisition and monitoring management of the control system. It is based on the computer, the remote distribution of equipment to monitor the operation, its main features include Data acquisition, parameter measurement and regulation, signal alarm and so on. The SCADA system is typically a master terminal control unit located in the control center (MTU), communication lines and equipment, remote terminal unit (RTU) and other components.

3.3 Distributed control system; DCS

Based on the computer, within the system (within the organization) on the production process of distributed control, centralized management system. DCS system Generally including the site control level, control and management level two levels, the site control level is mainly a single sub-process control, control management level master

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 105 pages — is available in the English PDF.

Referenced standards

Cited by

Similar standards

GB/T 18805-2026|GB/T 32915-2026|GB/T 42382.2-2026|GB/T 42382.3-2026|GB/T 47277-2026|GB/T 47312-2026

How to Download GB/T 32919-2016

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.