GB/T 36626-2018Information security technology—Management guide for secure operation and maintenance of information systems (English PDF)
信息安全技术 信息系统安全运维管理指南
This is a limited preview
Buy now to download the full PDF (15 pages)
Need quotation for your management?
Get a formal quotation for GB/T 36626-2018 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
September 17, 2018
Implementation date
April 1, 2019
Scope
GB/T 36626-2018 is the English-translated version of 信息安全技术 信息系统安全运维管理指南.
GB/T 36626-2018 is a management guide for the secure operation and maintenance (O&M) of information systems.
It describes the security O&M management system, with its model, classes of activity, activity elements and management principles, and gives objectives, requirements and implementation guidance for formulating and reviewing the security O&M strategy, for the O&M organization (roles and responsibilities, pre-employment review, job duties, termination and change) and for procedures covering asset, log, access, password and vulnerability management, backup, and security event management and response.
It also covers support systems such as a security service desk, asset and vulnerability management, intrusion detection, abnormal behaviour monitoring and association analysis.
Organizations use it to set up and run their own security O&M management. It was issued on 17 September 2018 and has applied since 1 April 2019.
Found what you need?
Document preview — GB/T 36626-2018
National Standard of the People's Republic of China
- ICS
- 35.040
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword
- 1 Scope
- 2 Normative references
- 3 Terms and Definitions
- 4 Abbreviations
- 5 Information System Security Operation and Maintenance System
- 5.1 Safety Operation and Maintenance Model
- 5.2 Classification of safety operation and maintenance activities
- 5.3 Safety operation and maintenance activities elements
- 5.4 Safety Operation and Maintenance Management Principles
- 6 Security Operation and Maintenance Strategy
- 6.1 Security Operation and Maintenance Strategy Formulation
- 6.2 Security Operation and Maintenance Strategy Review
- 7 Management of the safe operation and maintenance organization
- 7.1 Roles and Responsibilities of Safe Operation and Maintenance
- 7.2 Pre-employment review
- 7.3 Job performance responsibilities
- 7.4 Termination and Change
- 8 Safety Operation and Maintenance Procedures
- 8.1 Asset Management
- 8.2 Log Management
- 8.3 Access Control
- 8.4 Password Management
- 8.5 Vulnerability Management
- 8.6 Backup
- 8.7 Security Event Management and Response
- 9 Safety operation and maintenance support system
- 9.1 Information System Security Service Desk
- 9.2 Asset Management System
- 9.3 Vulnerability Management System
- 9.4 Intrusion Detection System
- 9.5 Abnormal Behavior Monitoring System
- 9.6 Association Analysis System
Foreword
This standard was drafted in accordance with the rules given in GB/T 1.1-2009.
1 Scope
This standard provides guidance and recommendations for the information system security operation and maintenance management system, and gives the management of the security operation and maintenance strategy and security operation and maintenance organization.
Objectives, requirements, and implementation guidelines for related activities such as management, safety operation and maintenance procedures, and safety operation and maintenance support systems.
This standard can be used to guide the establishment and operation of the information system security operation and maintenance management system of each organization.
2 Normative references
The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this document. For undated references, the latest edition (including all amendments) applies to this document.
GB/T 22081-2016 Information Technology Security Technology Information Security Control Practice Guide
GB/T 29246-2017 Information technology security technology information security management system overview and vocabulary
GB/T 31722-2015 Information technology security technology information security risk management
3 Terms and definitions
The following terms and definitions as defined in GB/T 29246-2017 apply to this document.
3.1 Threat
A potential source of an event that could lead to negative outcomes for an asset or organization. [GB/T 25069-2010, definition 2.3.94]
3.2 Information system security operation and maintenance
A series of pre-defined actions taken to ensure that the information system is protected from various security threats after the information system has been authorized to operate activity.
3.3 Security policy
A set of rules, guidelines, and guidelines for managing how assets, including sensitive information, are managed, protected, and distributed within an organization and its systems. Practice, especially those that have an impact on system security and related elements. [GB/T 25069-2010, definition 2.3.2]
3.4 Procedure
A written description of the course of action taken to perform a given task. [GB/T 25069-2010, definition 2.1.7]
3.5 Information system security operation and maintenance support system
An auxiliary system tool used to support the secure operation and maintenance of information systems. Including but not limited to automatic asset discovery system, configuration management system, […]
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 15 pages — is available in the English PDF.
Referenced standards
Normative references
Cited by
- GB/T 47855-2026Basic requirements for smart park information systems
- GB/T 45409-2025Cybersecurity technology — Technical specifications for operation and maintenance security management products
- GB/T 44408-2024Smart city—Intelligent multi-function pole system—Funtional requirements
- GB/T 43443-2023Internet of things—Interface requirements of intelligent agricultural information system
- CY/T 231-2020The overall structure of the Internet of Things platform for book publishing
Similar standards
How to Download GB/T 36626-2018
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 22081-2016 — Information technology -- Security techniques -- Code of practice for information security controls
GB/T 31722-2015 — Information technology -- Security techniques -- Information security risk management
GB/T 7251.4-2026 — Low-voltage switchgear and controlgear assemblies - Part 4: Particular requirements for assemblies for construction sites (ACS)
Secure payment via Stripe
Payments accepted
GB/T 36626-2018
$235.00