Valid

GB/T 37046-2018Information security techniques —Assessment criteria for disaster recovery service capability (English PDF)

信息安全技术灾难恢复服务能力评估准则

Preview PDF

This is a limited preview

Buy now to download the full PDF (43 pages)

Need quotation for your management?

Get a formal quotation for GB/T 37046-2018 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

December 28, 2018

Implementation date

July 1, 2019

Scope

GB/T 37046-2018 is the English-translated version of 信息安全技术灾难恢复服务能力评估准则.

GB/T 37046-2018 sets out how the capability of an organization that provides information system disaster recovery services is assessed.

It describes the disaster recovery service lifecycle and a capability maturity model, and the capability elements behind it: the site, system and team resources a provider needs, eight disaster recovery process areas from needs analysis, backup center construction and recovery planning to emergency response and capability assessment, and eight project and organizational process areas such as quality assurance, configuration, risk and supplier coordination.

It then defines five process capability levels, from basic execution to continuous improvement, and the assessment itself. It is used together with GB/T 36957-2018 by the buyers, providers and assessors of disaster recovery services. It was issued on 28 December 2018 and has applied since 1 July 2019.

Found what you need?

Document preview — GB/T 37046-2018

National Standard of the People's Republic of China

ICS: 35.040
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and Definitions
4 Abbreviations
5 Disaster Recovery Service Capability Maturity Model Overview
5.1 Disaster Recovery Service Lifecycle Overview
5.2 Disaster Recovery Service Capability Component
5.3 Disaster Recovery Service Capability Maturity Model
6 Disaster Recovery Service Capability Element
6.1 Disaster Recovery Service Resource Configuration
6.1.1 Disaster Recovery Service Site Resource Allocation Capability
6.1.2 Disaster Recovery System Resource Configuration Capability
6.1.3 Disaster Recovery Service Team Capabilities
6.2 Disaster Recovery Service Process
6.2.1 Overview of the Disaster Recovery Service Process
6.2.2 PA01---Disaster Recovery Needs Analysis
6.2.3 PA02---Disaster Recovery Resource Acquisition
6.2.4 PA03---Disaster Backup Center Selection and Construction
6.2.5 PA04---Disaster Backup System Technical Planning and Implementation
6.2.6 PA05---Disaster Backup System Operation and Maintenance and Technical Support
6.2.7 PA06---Development and Management of Disaster Recovery Plan
6.2.8 PA07---Emergency response and disaster takeover
6.2.9 PA08---Disaster Recovery Capability Assessment
6.3 Disaster Recovery Service Project Process and Organization Process
6.3.1 Disaster Recovery Services Project Process and Organizational Process Overview
6.3.2 PA09---Quality Assurance
6.3.3 PA10---Management Configuration
6.3.4 PA11---Manage project risk
6.3.5 PA12---Project Planning
6.3.6 PA13---Project Monitoring
6.3.7 PA14---Management System Engineering Support Environment
6.3.8 PA15---Skills and Knowledge Improvement
6.3.9 PA16---Coordination with suppliers
7 Disaster Recovery Service Process Capability Level Definition
7.1 Overview of Disaster Recovery Service Process Capabilities
7.2 Ability Level 1 - Basic Executive Level
7.2.1 Basic Executive Level Overview
7.2.2 Public Features 1.1 - Perform Basic Implementation
7.3 Capacity Level 2 - Planning and Tracking Level
7.3.1 Planning and Tracking Level Overview
7.3.2 Public Characteristics 2.1---Planning Execution
7.3.3 Public characteristics 2.2---Standardized implementation
7.3.4 Common Features 2.3---Verification Execution
7.3.5 Common Features 2.4---Tracking Execution
7.4 Ability Level 3 - Full Definition Level
7.4.1 Full Definition Level Overview
7.4.2 Public characteristics 3.1---Definition of standard procedures
7.4.3 Common Features 3.2---Execute the defined process
7.4.4 Public Features 3.3---Coordination Implementation
7.5 Capability Level 4 - Quantization Control Level
7.5.1 Quantitative Control Level Overview
7.5.2 Public characteristics 4.1--- Establish measurable quality objectives
7.5.3 Public characteristics 4.2--- Objectively manage execution
7.6 Ability Level 5 - Continuous Improvement Level
7.6.1 Continuous Improvement Level Overview
7.6.2 Public characteristics 5.1 - Improve organizational capabilities
7.6.3 Public characteristics 5.2---Improve process effectiveness
8 Disaster Recovery Service Capability Assessment
8.1 Overview
8.2 Disaster Recovery Service Capability Assessment
8.3 Applicability of the appendix to this standard
Appendix A (informative) Disaster Recovery Level and Tool and Equipment Reference Table
Appendix B (Normative) Disaster Recovery Service and Process Area Correspondence Table
Appendix C (Normative) Mapping of Disaster Recovery Capability Levels and Capabilities Elements Table

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

This standard refers to and draws on GB/T 30271-2013 "Information Security Technology Information Security Service Capability Assessment Guidelines", GB/T 20988-2007 "Information Security Technology Information System Disaster Recovery Specification", GB/T 20261-2006 "Information Technology System Security Full Engineering Capability Maturity Model, ISO /IEC 21827:2008 "Information Technology Security Technology System Security Engineering Capability Maturity Model The relevant content and ideas of the type S (SSE-CMM) are combined with practical experience at home and abroad.

The content of this standard is a detailed refinement of the information system disaster recovery service capability assessment under the framework of GB/T 30271-2013.

An assessment framework for the service capabilities of the Information Systems Disaster Recovery Organization. Mainly to explain the disaster recovery service organized by the disaster recovery service Method and model for assessing capabilities, and methods and characterization of the assessment of service capabilities of disaster recovery services.

See GB/T 36957-2018. This standard is in the process of developing disaster recovery service process for the disaster recovery service organization.

The information system disaster recovery technology process in GB/T 20988-2007 is mainly for the service capability of the disaster recovery service organization.

The framework of the assessment method, model, and grading; GB/T 36957-2018 mainly describes the disaster recovery organization when doing disaster recovery services.

Specific requirements; GB/T 20988-2007 is an explanation of the information system disaster recovery service process, and for information system disaster recovery The core of the elaboration of the capability is the information system; this standard is used in conjunction with GB/T 36957-2018.

1 Scope

This standard specifies the basic principles that information system disaster recovery services should follow, and clarifies the information system disaster recovery service organization service. The evaluation mechanism of the ability.

This standard applies to the demand side, provider and evaluator of the information system disaster recovery service.

2 Normative references

The following documents are indispensable for the application of this document. For dated references, only dated versions apply to this document. For undated references, the latest edition (including all amendments) applies to this document.

GB/T 20988-2007 Information Security Technology Information System Disaster Recovery Specification

GB/T 25069-2010 Information Security Technology Terminology

GB/T 29246-2017 Information technology security technology information security management system overview and vocabulary

GB/T 30271-2013 Information Security Technology Information Security Service Capability Assessment Criteria

GB/T 36957-2018 Information Security Technology Disaster Recovery Service Requirements

ISO/IEC 21827:2008 Information Technology Security Technology System Security Engineering Capability Maturity Model (SSE-CMM)

3 Terms and definitions

GB/T 25069-2010, GB/T 20988-2007, GB/T 30271-2013, GB/T 29246-2017, The following terms and definitions as defined in GB/T 36957-2018 and ISO /IEC 21827:2008 apply to this document. In order to facilitate Used, the following repeatedly lists some terms in GB/T 36957-2018, GB/T 29246-2017 and GB/T 30271-2013 and definition.

3.1 Disaster recovery service

In order to restore an information system from a fault or paralysis caused by a disaster to a functioning state and to support the business functions it supports Activities such as analysis, design, implementation, operation, maintenance, and organization management that are carried out from an abnormal state caused by a disaster to an acceptable state Process. [GB/T 36957-2018, definition 3.2]

3.2 Disaster recovery service provider

An organization or department that has a professional disaster recovery service team and resources and can provide disaster recovery services, referred to as service providers. [GB/T 36957-2018, definition 3.4]

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 43 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB/T 18805-2026|GB/T 32915-2026|GB/T 42382.2-2026|GB/T 42382.3-2026|GB/T 47277-2026|GB/T 47312-2026

How to Download GB/T 37046-2018

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.