GB/T 36324-2018Information security technology—Information security classification specifications of industrial control systems (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

The information security of industrial control systems is related to industrial production and operation, national economic security, and the safety of people's lives and property, to strengthen the industrial control system. Unified information security management adopts hierarchical management of information security in industrial control systems. This standard specifies industrial control based on risk assessment System information security classification rules and rating methods, put forward grade division model and grading factors, including assets of industrial control system Degree, the extent of potential risks and the degree of information security threats that need to be resisted, and proposes the division of information security into industrial control systems. Four levels of features.

Chapter 4 of this standard gives an overview of the industrial control system and describes the basic composition of the industrial control system and the object of grading the industrial control system; Chapter 5 The rules for the classification of information security in industrial control systems stipulate the classification model for information security in industrial control systems, and information on industrial control systems Safety rating elements, information security level characteristics of industrial control systems; Chapter 6 Industrial control system information security rating methods, proposed industrial Control system information security grading process, stated the determination of industrial control system grading objects, determine the importance of industrial control system assets, confirm Determine the degree of potential impact after infringement, determine the level of information security threats that need to be resisted, and determine the level of information security for industrial control systems; Appendix A Explains the classification of production safety accidents and emergency environmental events.

In 5.3, to clearly indicate the safety technical requirements for each level of information security in industrial control systems compared to a lower level of safety Increases and enhancements. The new part of each level is represented by the "Summer bold font."

1 Scope

This standard stipulates the rules and classification methods for information security level classification of industrial control systems based on risk assessment and proposes Models and grading factors, including the degree of importance of assets in industrial control systems, the extent of the potential risks involved, and the information security threats that need to be resisted Degree, and put forward four levels of characteristics of information security in industrial control systems.

This standard is applicable to industrial production companies and related administrative departments, providing reference for the classification of information security levels in industrial control systems.

The guide provides the basis for the planning, design, operation and maintenance, evaluation and management of information security for industrial control systems.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this document. For undated references, the latest version (including all amendments) applies to this document.

GB/T 22080-2016 Information Technology Security Technology Information Security Management System Requirements

GB/T 31722-2015 Information Technology Security Technology Information Security Risk Management

Production Safety Accident Report and Investigation and Handling Regulations State Council Decree No. 493

Emergency Environmental Information Reporting Methods Order No. 17 of the Ministry of Environmental Protection

3 Terms and Definitions, Abbreviations