GB/T 38561-2020Information security technology—Technical requirements for cybersecurity management support system (English PDF)

3.1 Cybersecurity management support system

Based on the organization's security goals, objects, processes, etc., the system that supports the organization's cybersecurity management work.

3.2 Object

An entity in cybersecurity management.

6.1 Security objective management

The support system has the management functions for organization's security objective and shall meet the following requirements:

a) Add, delete, query, modify security objective;

b) Perform classified management of security objective;

c) Publish and display security objective.

6.2 Emergency plan management

The support system has emergency plan management functions and shall meet the following requirements:

a) Add, delete, query and modify emergency plan information;

b) Perform classified and hierarchical management of emergency plans.

6.3 Object management

The support system has object management functions and shall meet the following requirements:

a) Modify, delete and query the information of the object;

b) Support automatic and manual acquisition of object's information;

c) Management of hardware assets, software assets, data assets, organizational personnel and other information, including:

1) Manage hardware asset information, including but not limited to IP address, MAC address, hardware model, etc.;

Note 1: Hardware assets mainly include computers, network equipment, security equipment, storage equipment, security protection equipment, office equipment.

2) Manage software asset information, including but not limited to software version, installation location, installation time, etc.;

Note 2: Software assets mainly include security systems, operating

6.12 Backup and recovery

The support system has data backup and recovery functions, which shall meet the following requirements:

a) Recover all data within six months, including but not limited to information security incidents, operational monitoring, alarms, processes, statistics and assessments;

b) The stored record data is not overwritten and deleted; an alarm is issued before storage resources are exhausted.

7.1 Identity authentication

The identity authentication of the support system shall:

a) During user registration, use the user name and user identifier to identify the user.

b) When the user logs in, use a controlled password or other mechanism with corresponding security strength to authenticate the user.

c) Adopt at least two kinds of identity authentication mechanisms, including but not limited to: "user name + password" authentication method, digital certificate authentication method, biometric authentication method.

d) When using the "user name + password" authentication method, ensure the password's complexity; set the user login's attempt threshold. When the user's unsuccessful login attempt exceeds the threshold, lock the administrator account and generate an audit log.

7.2 Access control Support system's

access control shall:

a) Allow or forbid access to system functions and data assets based on administrator user's roles and permissions;

b) Record and alert for illegal operations and attempted unauthorized access. data output. The system log is managed by the security auditor;

b) Detect the working status of each functional module of the support system; issue alarm when the working status is abnormal.

8.1 Configuration management assurance

Configuration management assurance shall meet the following requirements:

a) Provide unique authorization identifier for different users;

b) Provide corresponding configuration management documents according to different users.

8.2 Development

The support system's development shall meet the following requirements:

a) Describe the security functions of the system;

b) Describe the purpose and use of all security function interfaces;

c) Describe all parameters related to each security function interface;

d) Describe the security function implementation behavior related to the security function interface;

e) Describe direct error messages caused by the behavioral processing of security functions;

f) Provide system design documents.

8.3 Testing assurance

While providing the support system, provide the test documentation of the system. The test documentation shall include:

a) Determine the function of the system under test and describe the test objectives;

b) The test plan, test process's description, test results and comparison of expected test results with test results; […]