GB/T 32921-2016Information security technology—Security criterion on supplier conduct of information technology products (English PDF)

3.1 Information technology product

hardware, software, systems and services with the functions of collecting, storing, processing, transmitting, controlling, exchanging, and displaying data or information

NOTE: Information technology products include computers and their auxiliary equipment, communication equipment, network equipment, automatic control equipment, operating systems, databases, application software and services and so on.

3.2 Information technology product supplier

an organization that provides information technology products

NOTE: Information technology product suppliers include manufacturers, sellers, agents, integrators, and service providers.

3.3 User related information

information related to natural or legal persons and data defining and describing such information

NOTE: User related information includes user identity information, as well as user-generated documents, programs, multimedia materials, user communication content, address, time, product configuration, operation and location data, and logs generated during system operation, and so on.

3.4 Expressed consent

the user information subject clearly authorizes consent and retains evidence

3.5 Remote control

control activities implemented on user products through remote connection

NOTE: Remote control activities include realizing product start and stop, changing product configuration, changing product operating status, popping up dialog boxes, automatic remote upgrades, and pushing business data, and so on.

3.6 National critical information infrastructure

basic information networks and important information systems related to the national economy and people's livelihood; when these networks or systems are attacked and damaged, they will harm national network security, economic security, public interests, public safety, and so on […]

4.1 General

In principle, information technology product supplier shall not collect, store, and process user-related information, and remotely control the products that have been provided to users and the information systems where the products are located. When really necessary, the principles of express authorization, minimum sufficient usage, minimum authority, safety and credibility shall be followed.

4.2 Safety guidelines for the collection and processing of user related information

with foreign laws.

4.3 Safety guidelines for remotely controlling user products

When the supplier remotely controls the user's product:

a) Before the user purchases and uses the product, the user shall be clearly informed of the purpose and usage of the remote-control behavior;

b) Before the user purchases and uses the product, a method to prohibit remote control shall be provided. The user shall be informed of the missing features of the product after the remote control is prohibited;

c) The user's product can be controlled remotely only after the user's expressed consent. Display prompt information when remotely controlling the user's product;

d) The remote control activities shall be used only for the purpose and use agreed by the user. Strictly limit the frequency of remote control activities and the range of product systems involved;

e) No hidden interface shall be set in the product. Components that can disable or bypass security mechanisms shall not be loaded;

f) There shall be no unspecified functional modules in the product;

g) Users shall be informed to test or maintain the interface. Provide users with a way to close the test or maintain the interface;

h) Necessary technical and management measures shall be taken to ensure the safety of the remote control process. Provide security features that can only be accessed using a specific account within a limited time window;

i) Record all input and output data of remote control. Log the remote control activities implemented for future audits;

j) It shall provide detection and verification methods for remote control of user products and data interaction between products and suppliers. If encryption technology is used, information such as encryption algorithm shall be provided during the inspection and verification of the third-party organization. The port and protocol used by the third-party organization shall be notified.

4.4 Other behavioral safety guidelines

The supplier: […]