GB/T 36959-2018Information security technology —Capability requirements and evaluation specification for assessment organization of classified protection of cybersecurity (English PDF)

3.1 Capability evaluation

According to standards and/or other normative documents, the process of

4.3 Capability requirements for level I assessment organizations

e) There are no less than 15 technical and managerial personnel with cybersecurity related work experience; no less than 2 full-time penetration testers, with clear job responsibilities and relatively stable personnel;

f) Have a fixed office space, equipped with testing and evaluation tools and experimental environments that meet the needs of the evaluation business;

g) It has complete rules and regulations for security and confidentiality management, project management, quality management, personnel management, file management, training and education;

h) Does not involve business that may affect the fairness of the evaluation results (except for personal use) such as cybersecurity product development, sales, or information system security integration;

i) Other conditions that shall be met.

4.3.2 Organizational management capabilities

4.3.2.1 The manager of the assessment organization shall master the classified protection policy documents and be familiar with relevant standards and specifications.

4.3.2.2 The assessment organization shall organize and set up relevant departments in a certain way; clarify their responsibilities, authorities and mutual relations; ensure the orderly development of various tasks.

4.3.2.3 The assessment organization shall have professional and technical personnel and management personnel competent for the level evaluation work; the proportion of bachelor's degree (including) or above shall not be less than 70%.

4.3.2.4 The assessment organization shall set up positions that meet the needs of the level evaluation work, such as evaluation technicians, evaluation project team leaders, technical supervisors, quality supervisors, security officers, equipment managers, file managers, etc., with clear job responsibilities and stable personnel.

4.3.2.5 The assessment organization shall formulate complete rules and regulations, including but not limited to the following:

a) Project management system The assessment organization shall formulate a comprehensive evaluation project management system in line with its own characteristics in accordance with GB/T 28449, which shall mainly include the organization

4.3.3.2 Evaluation capability

4.3.3.2.1 The assessment organization shall prove that it has more than 2 years of work experience in cybersecurity-related work by providing case, process records and other materials.

4.3.3.2.2 The assessment organization shall ensure that it is engaged in evaluation work within its capabilities and has sufficient resources to meet the requirements of the evaluation work, which is specifically reflected in the following aspects:

a) Security technology evaluation and implementation capabilities, including the development, use, maintenance and professional judgment of obtaining relevant results in terms of physical and environmental security, network and communication security, equipment and computing security, application and data security, etc.;

b) Security management evaluation and implementation capabilities, including security strategy and management system, security management organization and personnel, security construction management, security operation and maintenance management, development, use, maintenance and professional judgment of obtaining relevant results;

c) Security testing and analysis capabilities, which refer to the capability to develop test-related work instructions based on actual evaluation requirements, use special evaluation equipment and tools to realize vulnerability discovery and problem analysis;

d) The overall evaluation implementation capability, which refers to the capability to give specific results of the overall evaluation based on the form the evaluation report. The evaluation report shall be compiled according to the format and content requirements of the evaluation report template of classified protection of cybersecurity as uniformly formulated by the public security administrative department. The evaluation report shall pass the review and have relevant records.

4.3.4 Security and assurance capabilities of facilities and equipment

4.3.4.1 The assessment organization shall have the necessary office environment, equipment, facilities and management system. The technical equipment and facilities used shall in principle meet the following conditions:

a) The product development and production organization is invested by a Chinese citizen, legal person, or invested or controlled by the state, has an independent legal personality within the territory of the People's Republic of China;

b) The core technology and key components of the product have our country's independent intellectual property rights;

c) The product development and production organizations and their main businesses and technical personnel have no criminal records;

d) The product development and production organizations declare that they have not intentionally left or set loopholes, backdoors, Trojan horses and other programs and functions;

e) No harm to national security, social order, or public interest;

f) It shall be equipped with critical network equipment and special cybersecurity products that have passed security certification or meet the requirements of security testing.

4.3.4.2 The assessment organization shall be equipped with evaluation equipment and tools that meet the requirements of the level evaluation work, such as WEB security detection tools, malicious behavior detection tools, etc., to assist in the discovery of security issues during the testing process. Testing equipment and tools shall pass the testing of authoritative organizations and provide testing reports.

4.3.4.3 The assessment organization shall have a computer room that meets the relevant requirements and the necessary software and hardware equipment to meet the needs of cybersecurity simulation, technical training and simulation testing.

4.3.4.4 The assessment organization shall ensure that the evaluation equipment and tools are in good operating condition; ensure that it provides

4.3.6.3 Standardization of evaluation methods and procedures

The assessment organization shall ensure that all working procedures,

4.3.8 Sustainability

4.3.8.1 The assessment organization shall formulate a strategic plan according to its own situation; ensure the continuous construction and development of the assessment organization through continuous investment.

4.3.8.2 The assessment organization shall periodically review and continuously improve the management system; continuously improve management requirements. Set mid-term and long-term goals; gradually improve quality management capabilities through the realization of goals.

4.3.8.3 The assessment organization shall do a good job of training in accordance with the training system and keep training and evaluation records.

4.3.8.4 The assessment organization shall devote special forces to the summary of evaluation practice and the research of evaluation technology. The assessment organizations shall conduct experience exchanges and technical discussions, to keep pace with the development of evaluation technology.

4.4 Capability requirements for level II assessment organizations

4.4.2.5 The assessment organization shall formulate complete rules and regulations, including but not limited to the following:

a) Confidentiality management system The confidentiality management system shall be formulated in accordance with the relevant national confidentiality regulations. The system shall specify the scope of confidentiality objects, personnel confidentiality responsibilities, various measures and requirements for confidentiality management during the evaluation process, penalties for violations of the confidentiality system.

b) Project management system The assessment organization shall formulate a comprehensive evaluation project management system in line with its own characteristics in accordance with GB/T 28449, which shall mainly include the organization of the evaluation work, job responsibilities, the work content and management requirements of each stage of the evaluation.

c) Equipment management system It shall include the relevant responsibilities of organizational personnel in the management of equipment, various regulations on the purchase, use, operation and maintenance of instrument and equipment.

d) Document management system It shall include the relevant responsibilities of the staff of the organization in the management of the evaluation documents, the provisions on the borrowing and reading of files, the storage and the destruction, etc.

e) Personnel management system It shall include the content and requirements of personnel recruitment, evaluation, daily management, resignation.

f) Training and education system It shall include the content and requirements of the formulation of training plans, the implementation of training, the evaluation and induction of training, the establishment of personnel training files.

g) Appeal, complaint and dispute handling system

a) Security technology evaluation implementation capabilities, including the development, use, maintenance and professional judgment of obtaining relevant results in terms of physical and environmental security, network and communication security, equipment and computing security, application and data security, etc. The evaluation guide shall cover the current mainstream products and related technologies;

b) Security management evaluation and implementation capabilities, including security strategy and management system, security management organization and personnel, security construction management, security operation and maintenance management and other aspects of the development, use, maintenance and professional judgment of obtaining relevant results;

c) Security testing and analysis capabilities, which refer to the development of test-related work instructions based on actual evaluation requirements; the capability to realize vulnerability discovery and problem analysis with the help of special evaluation equipment and tools; having the cryptanalysis evaluation capabilities;

d) The overall evaluation implementation capability, which refers to the capability to give specific results of the overall evaluation based on the result recording part, the result summary part and the problem analysis part of the evaluation report's unit evaluation, from the perspective of security control points and between levels and regions;

e) Risk analysis capability, which refers to the capability to establish a set of unified risk analysis methods based on the relevant norms and standards of classified protection, analyze the impact of the security issues in the level evaluation results that may have on the security of the system under evaluation in a scientific and reasonable manner.

4.4.3.2.3 The assessment organization shall strengthen the application of information technology in the implementation of evaluation; with the help of automated means, standardize the evaluation process; optimize the allocation of resources; reduce errors that may be caused by human factors; improve the efficiency of evaluation work.

4.4.3.2.4 The assessment organization shall establish a complete mechanism for the development, maintenance and update of evaluation methods to continuously improve its own evaluation technical capabilities.

4.4.3.2.5 The assessment organization shall combine the industry characteristics and business types of the system under test; analyze the

4.4.4.1 The assessment organization shall have the necessary office environment, equipment, facilities and management system; the technical equipment and facilities used shall in principle meet the following conditions:

a) The product development and production organization is invested by a Chinese citizen, legal person, or invested or controlled by the state, meanwhile has an independent legal personality within the territory of the People's Republic of China;

b) The core technology and key components of the product have our country's independent intellectual property rights;

c) The product development and production organization and their main businesses and technical personnel have no criminal records;

d) The product development and production organizations declare that they have not intentionally left or set loopholes, backdoors, Trojan horses and other programs and functions;

e) No harm to national security, social order, or public interest;

f) It shall be equipped with critical network equipment and special cybersecurity products that have passed security certification or meet the requirements of security testing.

4.4.4.2 The assessment organization shall be equipped with evaluation equipment and tools that meet the requirements of the level evaluation work, such as WEB security detection tools, malicious behavior detection tools, network protocol analysis tools, source code security audit tools, etc., to assist in analyzing and positioning security problem during the testing process.

Testing equipment and tools shall pass the testing of authoritative organizations and provide testing reports.

4.4.4.3 The assessment organization shall have a computer room that meets the relevant requirements and the necessary software and hardware equipment; it shall establish a basic environment composed of mainstream network equipment, security equipment, operating systems and database systems, to meet the needs of network simulation, technical training and simulation testing.

4.4.4.4 The assessment organization shall ensure that the evaluation equipment and tools are in good operating condition; ensure that they provide accurate evaluation data through continuous updating and upgrading.

4.4.4.5 The testing equipment and tools shall be properly marked.

4.4.4.6 The assessment organization shall establish a special system, to effectively operate and maintain the computer used for evaluation data

strictly implement relevant management norms and technical standards; develop objective, fair and safe evaluation services.

4.4.6.1.2 The personnel of the assessment organization shall be free from commercial, financial and other pressures that may affect the evaluation results.

4.4.6.1.3 The assessment organization shall publicly announce to the public the policies, regulations, standards and norms on which it conducts the evaluation of cybersecurity's classified protection.

4.4.1 Basic conditions

The assessment organization shall have the following basic conditions:

a) Enterprises and organizations registered and established within the territory of the People's Republic of China, invested by Chinese citizens, legal persons, or invested by the state;

equipment administrators, file administrators, etc., with clear job responsibilities and stable personnel. Among them, technical supervisors and quality supervisors shall be full-time personnel, not concurrently.

4.4.6.2 Reliability and confidentiality assurance capability

4.4.6.2.1 The legal persons and main staff of the assessment organization are limited to Chinese citizens within the territory of the People's Republic of China; they have no criminal record.

4.4.6.2.2 The assessment organization shall prove that its organization is compliant, the property rights relationship is clear, the capital registration meets the requirements, by providing documents such as the nature of the organization, shareholding structure, capital contribution, legal person, shareholder identity.

4.4.6.2.3 The assessment organization shall establish and maintain personnel files of staff, including basic personnel information, social background, work experience, training records, professional qualifications, rewards and punishments, etc., to ensure the stability and reliability of personnel.

4.4.6.2.4 The test equipment and tools used by the assessment organization shall have a comprehensive function list; there shall be no hidden functions outside the function list.

4.4.6.2.5 The assessment organization shall attach importance to security and confidentiality work; assign persons responsible for security and confidentiality work.

4.4.6.2.6 The assessment organization shall regularly educate the staff on confidentiality in accordance with the confidentiality management system; the assessment organization and evaluation personnel shall keep the state secrets, work secrets, business secrets, personal privacy that they know about in the evaluation activities.

4.4.6.2.7 The assessment organization shall clarify the requirements for job confidentiality; sign a "Confidentiality Responsibility Letter" with all personnel; stipulate its security and confidentiality obligations and legal responsibilities; be responsible for inspection and implementation.

4.4.6.2.8 The assessment organization shall adopt technical and management

a) The assessment organization shall issue an evaluation report in accordance with the template format of evaluation report of classified protection of cybersecurity as uniformly formulated by the public security administrative department.

b) The evaluation report shall include all evaluation results, professional judgments based on these results, all information needed to understand and interpret these results. The above information shall be correctly, accurately and clearly stated.

c) The evaluation report shall be reviewed by the evaluation project team leader as the first editor; the technical director (or quality director) shall be responsible for review; the organization manager or its authorized personnel shall issue or approve it.

d) The assessment organization that has passed the capability evaluation shall uniformly stamp the special identification on qualified capability of the assessment organization, register, archive the level evaluation report issued by it.

4.4.6.6 Security management capabilities

Assessment organizations shall pay attention to their own security and improve security management capabilities by deploying security measures.

4.4.7 Risk control capability

4.4.7.1 The assessment organization shall fully estimate the risks that the evaluation may bring to the system under test. The risks include but are not limited to the following:

a) The risk caused by the assessment organization due to its own capability or insufficient resources;

b) The risk that test verification activities may affect the normal operation of the system under test;

c) The risk that the access of test equipment and tools may affect the normal operation of the system under test;

d) The risk of leakage of important information of the system under test (such as network topology, IP address, business process, security mechanism, security risks and related documents, etc.) that may occur during the evaluation process.

4.4.7.2 The assessment organization shall adopt a variety of measures to avoid and control the risks that the aforementioned system under test may face.

4.5 Capability requirements for Level III assessment organizations

e) There are no less than 50 technical and managerial personnel with cybersecurity related work experience; no less than 5 full-time penetration testers, with clear job responsibilities and relatively stable personnel;

f) Have a fixed office space, equipped with testing and evaluation tools and experimental environments that meet the needs of the evaluation business;

g) It has complete rules and regulations for security and confidentiality management, project management, quality management, personnel management, file management, training and education;

h) Does not involve business that may affect the fairness of the evaluation results (except for personal use) such as cybersecurity product development, sales, or information system security integration;

i) Other conditions that shall be met.

4.5.2 Organizational management capabilities

4.5.2.1 The manager of the assessment organization shall master the classified protection policy documents and be familiar with relevant standards and specifications. […]