GB/T 34942-2025Cybersecurity technology — The assessment method for security capability of cloud computing service (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

This document replaces GB/T 34942-2017 "Information Security Technology Cloud Computing Service Security Capability Assessment Method" and is in line with GB/T Compared with 34942-2017, in addition to structural adjustments and editorial changes, the main technical changes are as follows.

a) The applicable limits of the scope have been changed (see Chapter 1, Chapter 1 of the 2017 edition);

b) Added assessment requirements for different capability levels and comprehensive assessment requirements (see 5.2 and 5.5);

c) The specific assessment methods have been changed (see Chapters 6 to 8, 10 to 14, and Chapters 5 to 14 of the 2017 edition);

d) Added data protection assessment method (see Chapter 9).

Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents.

This document is proposed and coordinated by the National Cybersecurity Standardization Technical Committee (SAC/TC260).

This document was drafted by: China Electronics Technology Standardization Institute, China Cybersecurity Review and Certification and Market Supervision Big Data Center, National Information Technology Security Research Center, China Information Security Evaluation Center, China Academy of Information and Communications Technology, University of Science and Technology of China, Sichuan University China University of Posts and Telecommunications, China National Cyberspace Administration of China, China Great Wall Internet System Application Co., Ltd., State Information Center, National Industrial Information Security Development Research Institute Research Center, National Computer Network Emergency Response Technology Coordination Center, the 15th Research Institute of China Electronics Technology Group Corporation, and the Software Research Institute of the Chinese Academy of Sciences.

Institute of Information Engineering, Chinese Academy of Sciences, Hangzhou Anheng Information Technology Co., Ltd., Beijing University of Aeronautics and Astronautics, Beijing Institute of Technology University of Posts and Telecommunications, Chongqing University of Electronic Science and Technology, Xidian University, Beijing University of Chemical Technology, Renmin University of China, Communication University of China, Tsinghua University, Shanghai Municipal Information Security Evaluation and Certification Center, the 30th Research Institute of China Electronics Technology Group Corporation, the Archives Information Center of Chongqing Municipal Market Supervision Administration, Mongolia Digital Economy Security Technology Co., Ltd., China Mobile Communications Co., Ltd. Research Institute, Huawei Cloud Computing Technology Co., Ltd., Alibaba Cloud Computing Co., Ltd., Tianyi Cloud Technology Co., Ltd., and AsiaInfo Technologies (Chengdu) Co., Ltd.

The main drafters of this document are: Yang Jianjun, Wang Huili, Jia Dawen, He Yanzhe, Wu Yang, Hu Huaming, Lu Xia, Zhang Lina, Liu Jialiang, Zhang Jianjun, Li Jingchun, Zuo Xiaodong, Chen Xingshu, Min Jinghua, Zhou Yachao, Shi Dawei, Chen Yonggang, Zhang Liwu, Yang Chen, Fang Yong, Cao Ling, Zhang Mingtian, Wu Bin, Ma Qingdong, Qu Ping, Zhang Dongju, Ji Lei, Li Yanwei, Huo Shanshan, Wu Qianhong, Yang Zhen, Huang Yonghong, Ma Wenping, Xi Ning, Yang Li, Pei Qingqi, Wang Mingyan, Qin Bo, Yang Yang, Ge Xiaonan, Yan Min, Jiang Zhengtao, Li Na, Cai Yuyuan, Liu Yan, Ge Zhenpeng, Fan Xiaohui, Xiao Min, Han Xuefeng, Li Lianlei, Gao Qiang, Xu Yu, Jin Song, Zhang Ling, Li Fengfeng, Fang Qiang, Si Boyang, and Liao Shuangxiao.

The previous versions of this document and the documents it replaces are as follows.

— First published in 2017 as GB/T 34942-2017;

— This is the first revision.

Introduction

GB/T 31168-2023 "Information Security Technology Cloud Computing Service Security Capability Requirements" puts forward the requirements for cloud service providers to ensure the security of cloud computing environment.

The security capabilities that should be possessed to ensure the security of customer information and business in a cloud computing environment. This standard divides the cloud computing service security capability requirements into general requirements, enhanced requirements, and Strong requirements and advanced requirements, enhanced requirements and advanced requirements are the supplement and reinforcement of the lower level requirements.

Cloud service providers should have appropriate security capabilities depending on the sensitivity and business importance.

This document is the supporting evaluation standard of GB/T 31168-2023, corresponding to Chapter 6 to Chapter 16 of GB/T 31168-2023 This document also provides the corresponding evaluation methods from Chapter 6 to Chapter 16.

Provide guidance for the security capability assessment of computing services. Third-party assessment agencies can develop corresponding security assessment plans, using multiple methods such as interviews, inspections, and tests.

This document can also provide a reference for cloud service providers to conduct self-assessments. Cybersecurity Technology Cloud computing service security capability assessment method

1 Scope

This document establishes the principles and implementation process for conducting assessments based on GB/T 31168-2023 and describes the specific safety requirements for each Methods for conducting assessments.

This document is suitable for third-party assessment agencies to assess the security capabilities of cloud service providers when providing cloud computing services.

It provides a reference for service providers when conducting self-assessment.

2 Normative references

GB/T 20984-2022

GB/T 25069-2022

GB/T 31167-2023

GB/T 31168-2023

GB/T 35273

GB/T 37972

GB 50174

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022, GB/T 31167-2023 and GB/T 31168-2023 and the following terms and definitions apply In this document.