GB/T 39204-2022Information security technology—Cybersecurity requirements for critical information infrastructure protection (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" drafted.

Introduction

In order to implement the "Network Security Law of the People's Republic of China" and the "Regulations on the Security Protection of Critical Information Infrastructure" on the protection of critical information infrastructure To implement the requirements of operational security, on the basis of the national network security level protection system, learn from relevant departments in my country to carry out network development in important industries and fields.

The mature experience of network security protection work, absorb domestic and foreign measures in the security protection of critical information infrastructure, combined with my country's existing network Safety assurance system and other achievements, from the aspects of analysis and identification, safety protection, detection and evaluation, monitoring and early warning, active defense, incident handling, etc.

Critical information infrastructure security protection requirements, take necessary measures to protect critical information infrastructure business continuity, and its important data from being protected Destroy and effectively strengthen the security protection of critical information infrastructure.

1 Scope

This document specifies the analysis and identification of critical information infrastructure, security protection, detection and evaluation, monitoring and early warning, active defense, incident handling, etc. safety requirements.

This document is applicable to instruct operators to carry out full life cycle security protection of critical information infrastructure, and can also be used for critical information infrastructure For reference and use by other relevant parties who implement security protection.

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 20984 Information Security Technology Information Security Risk Assessment Method

GB/T 25069 Information Security Technical Terminology

3 Terms and Definitions

The terms and definitions defined in GB/T 25069 and the following apply to this document.

4 Basic principles of security protection

The security protection of critical information infrastructure should be based on the network security level protection system, implement key protection, and follow the following basics. in principle.

---Overall prevention and control with key business as the core. The security protection of critical information infrastructure aims to protect critical business, One or more networks and information systems involved are systematically designed for security, and an overall security prevention and control system is constructed.