GB/T 37988-2019Information security technology—Data security capability maturity model (English PDF)
信息安全技术 数据安全能力成熟度模型
This is a limited preview
Buy now to download the full PDF (109 pages)
Need quotation for your management?
Get a formal quotation for GB/T 37988-2019 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
August 30, 2019
Implementation date
March 1, 2020
Scope
GB/T 37988-2019 is the English-translated version of 信息安全技术 数据安全能力成熟度模型.
GB/T 37988-2019 is the Chinese standard "Information security technology - Data security capability maturity model".
Its scope clause reads: This standard provides the maturity model architecture of the organization's data security capabilities; specifies the maturity level requirements for data collection security, data transmission security, data storage security, data processing security, data exchange security, data destruction security, general security.
Its clauses include terms and definitions; abbreviations; dsmm architecture; data collection security; data transmission security; data storage security; data processing security; data exchange security; data destruction security; generic security.
It was issued by the State Administration for Market Regulation on AUGUST 30, 2019 and took effect on MARCH 01, 2020.
Found what you need?
Document preview — GB/T 37988-2019
National Standard of the People's Republic of China
- ICS
- 35.040
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword4
- 1 Scope5
- 2 Normative references5
- 3 Terms and definitions5
- 4 Abbreviations8
- 5 DSMM architecture9
- 5.1 Maturity Model Architecture9
- 5.2 Security capability dimensions10
- 5.3 Capacity maturity level dimension11
- 5.4 Data security process dimension14
- 6 Data collection security16
- 6.1 PA01 data classification and grading16
- 6.2 PA02 Data collection security management18
- 6.3 PA03 Data source authentication and recording21
- 6.4 PA04 Data quality management23
- 7 Data transmission security25
- 7.1 PA05 data transmission encryption25
- 7.2 PA06 Network availability management28
- 8 Data storage security29
- 8.1 PA07 storage media security29
- 8.2 PA08 Logic storage security31
- 8.3 PA09 Data backup and recovery34
- 9 Data processing security38
- 9.1 PA10 data desensitization38
- 9.2 PA11 Data analysis security41
- 9.3 Proper use of PA12 data44
- 9.4 PA13 Data processing environment security46
- 9.5 PA14 Data import and export security49
- 10 Data exchange security52
- 10.1 PA15 Data sharing security52
- 10.2 PA16 Data release security55
- 10.3 PA17 Data interface security57
- 11 Data destruction security59
- 11.1 PA18 Data destruction and disposal59
- 11.2 Destruction and disposal of PA19 storage media61
- 12 Generic security64
- 12.1 PA20 Data security policy planning64
- 12.2 PA21 Organization and personnel management67
- 12.3 PA22 Compliance management72
- 12.4 PA23 Data asset management76
- 12.5 PA24 Data supply chain security78
- 12.6 PA25 Metadata management81
- 12.7 PA26 Terminal data security83
- 12.8 PA27 Monitoring and audit85
- 12.9 PA28 Authentication and access control88
- 12.10 PA29 Requirement analysis91
- 12.11 PA30 Security incident response93
- Appendix A (Informative) Description of capability maturity level and GP96
- A.1 Overview96
- A.2 Capability maturity level 1 - Informal execution96
- A.3 Capability maturity level 2 - Plan tracking97
- A.4 Capability maturity level 3 - Fully defined99
- A.5 Capability maturity level 4 - Quantitative control101
- A.6 Capability maturity level 5 - Continuous improvement102
- Appendix B (Informative) Reference method for evaluation of capability maturity level104
- Appendix C (Informative) Assessment process of capability maturity level AND model usage method105
- C.1 Assessment process of capability maturity level105
- C.2 How to use the capability maturity model107
- References109
Foreword
This standard was drafted in accordance with the rules given in GB/T 1.1-2009.
1 Scope
This standard provides the maturity model architecture of the organization's data security capabilities; specifies the maturity level requirements for data collection security, data transmission security, data storage security, data processing security, data exchange security, data destruction security, general security.
2 Normative references
The following documents are essential to the application of this document. For the dated documents, only the versions with the dates indicated are applicable to this document; for the undated documents, only the latest version (including all the amendments) is applicable to this standard.
GB/T 25069-2010 Information security technology - Glossary
3 Terms and definitions
The terms and definitions as defined in GB/T 25069-2010 and GB/T 29246-2017, as well as the following terms and definitions apply to this document.
4 Abbreviations
The following abbreviations apply to this document.
5 DSMM architecture
Through the quantification of the security capabilities of each data security process of the organization, it evaluates the realization capability of each security process.
6 Data collection security
The data security capability requirements for this level are described as follows. Technical tools.
7 Data transmission security
The data security capabilities of this level are described as follows.
Organizational construction. No mature and stable data transmission security and key management mechanisms have been established in any business;
The data security capability requirements for this level are described as follows. Technical tools.
8 Data storage security
The data security capability requirements for this level are described as follows. Technical tools.
The data security capability requirements for this level are described as follows. […]
9 Data processing security
The data security capability requirements for this level are described as follows. Technical tools.
By adopting appropriate security control measures in the data analysis process, prevent the security risks of the leakage of valuable information and personal privacy, in the data mining and analysis process. […]
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 109 pages — is available in the English PDF.
Referenced standards
Normative references
Cited by
- GB/T 46917.3-2026Standard semantic knowledge base - Part 3: Technical requirements for semantic integration
- GB/T 37932-2025Data security technology - Security requirements for data transaction services
- GB/T 45498.3-2025Specifications for the social security card one-card-pass of the People's Republic of China - Part 3: Security specifications
- GB/T 46575-2025Intelligent computing - Internet of supercomputing - Reference architecture
- GB/T 42564-2023Information security technology - Security technical requirements for edge computing
- GB/T 42971-2023Third-party service platform for electronic contract information security technical requirement
Similar standards
How to Download GB/T 37988-2019
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 10003-2026 — Biaxially oriented polypropylene (BOPP) film
GB/T 10004-2026 — Plastic/Plastic laminated films and pouches for packaging
GB/T 10007-2026 — Rigid cellular plastics - Determination of shear properties
Secure payment via Stripe
Payments accepted
GB/T 37988-2019
$800.00