GB/T 36637-2018Information security technology—Guidelines for the information and communication technology supply chain risk management (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

With the popularization of information and communication technologies, it is crucial to strengthen the security and control of the ICT supply chain. Currently, countries around the world It has been widely recognized in the ICT industry that the supply chain of the ICT industry in the traditional industry is more complex and there is a greater probability of security risks. strengthen ICT supply chain security management enhances customers' trust in the ICT supply chain and the ICT industry.

Compared to traditional supply chains, ICT supply chains have many different characteristics, such as. ICT supply chain covers all ICT products and services.

The life cycle includes not only the supply phase of traditional supply chain production, integration, warehousing, delivery, but also the design and development phase of product services.

And after-sales operation and maintenance; ICT products are developed, integrated or delivered by globally distributed suppliers, and the global distribution of supply chains enables customers to supply The mastery of the chain and the ability to control security risks are declining; traditional supply chains focus on how to effectively deliver products to customers, or The strength of supply chain robustness, while ICT supply chain security is more concerned about whether there will be additional features injected into products and services, delivered products And whether the service is consistent with expectations. These characteristics make the ICT supply chain have more security risks than the traditional supply chain, and strengthen ICT supply.

The security risk management of the chain should not be delayed.

This standard does not regulate the safety code of conduct for information technology product suppliers. Recommended in critical information infrastructure or critical information systems Use this standard. However, due to individual needs and relevance, organizations can choose to apply standards to other systems or specific organizations, but applications The control measures of this standard may increase the potential cost of the organization and external suppliers, and the organization needs to weigh the cost and risk.

1 Scope

This standard specifies the security risk management process and control measures for the information and communication technology (hereinafter referred to as ICT) supply chain.

This standard applies to ICT suppliers and operators of important information systems and key information infrastructures.

Insurance management, also applicable to suppliers and demanders who guide ICT products and services to strengthen supply chain security management, but also for third-party assessment machines Refer to the ICT supply chain for security risk assessment.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this document. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 25069-2010 Information Security Technology Terminology

GB/T 31722-2015 Information technology security technology information security risk management

3 Terms and definitions

The following terms and definitions as defined in GB/T 25069-2010 and GB/T 31722-2015 apply to this document.