GB/T 35274-2023Data security technology—Security capability requirements for big data services (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

This document replaces GB/T 35274-2017 "Information Security Technology Big Data Service Security Capability Requirements" and is consistent with GB/T 35274-2017. In addition to structural adjustments and editorial changes, the main technical changes are as follows.

a) Deleted 5 data life cycle, data services, data exchange, data sharing and important data (see Chapter 3 of the 2017 edition) Terms and definitions, adding data processing, data security, data protection, data collection, data storage, data use, data processing, 11 terms and definitions of data transmission, data provision, data disclosure and data destruction (see Chapter 3), revised big data platform, Big data applications, big data systems, big data users, big data services, big data service providers and data supply chains (see section Chapter 3, Chapter 3 of the 2017 edition) Description of 7 terms and definitions;

b) The overall requirements (see 4.1 of the 2017 version) and requirement classification (see 4.2 of the 2017 version) are deleted, and the overall content of the standard is revised. sorted out (see Chapter 4, 4.3 of the 2017 edition);

c) Deleted service planning and management (see 5.4 of the 2017 version), data supply chain management (see 5.5 of the 2017 version) and compliance Management (see 5.6 of the 2017 edition), the policies and procedures, organization and personnel, and asset management security capability requirements have been modified (see 5.1, 5.2, 5.3, 2017 version of 5.1, 5.3, 5.2);

d) Reorganized and changed data activity security for data collection, data transmission, data storage, data processing, data exchange and data destruction Requirements, data collection, storage, use, processing, transmission, provision, disclosure in accordance with the requirements of the Data Security Law and the Personal Information Protection Law The data processing process and destruction clarifies the big data processing security capability requirements of big data service providers (see Chapter 6, 2017 Chapter 6 of the annual edition);

e) Added "big data service security risk management capabilities", from risk identification, security protection, security monitoring, security inspection, security impact The response and security recovery link stipulates the data security risk management capabilities of big data service providers in the operation of big data systems. (See Chapter 7);

f) Deleted in Appendix A (see Appendix A of the 2017 version).

1 Scope

This document stipulates the big data service security capability requirements of big data service providers, including big data organizational management security capabilities, big data According to the requirements of processing security capabilities and big data service security risk management capabilities.

This document is applicable to guide the construction of big data service security capabilities of big data service providers, and is also applicable to third-party organizations' use of big data security capabilities. Evaluate the service provider's big data service security capabilities.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 5271 (all parts) Information technology vocabulary

GB/T 25069-2022 Information security technical terms

GB/T 35273-2020 Information Security Technology Personal Information Security Specifications

GB/T 35295-2017 Information technology big data terminology

3 Terms and definitions

GB/T 5271 (all parts), GB/T 25069-2022, GB/T 35273-2020 and GB/T 35295-2017 and the following terms and definitions apply to this document.