Valid

GB/T 40645-2021Information security technology—General requirements for security of Internet information services (English PDF)

信息安全技术互联网信息服务安全通用要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (19 pages)

Need quotation for your management?

Get a formal quotation for GB/T 40645-2021 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

October 11, 2021

Implementation date

May 1, 2022

Scope

GB/T 40645-2021 is the English-translated version of 信息安全技术互联网信息服务安全通用要求.

GB/T 40645-2021 sets out general security requirements for Internet information services.

The technical requirements follow information through generation, processing, release, dissemination, storage and destruction, while the security assurance requirements cover the management system, organization and personnel, business continuity, and operation and maintenance.

A normative annex classifies the security level of Internet information services, and informative annexes give an example of customizing the requirements into a component package and describe the security assessment process, from choosing the assessment target and its security level to the evaluation form and the confirmation of results.

Providers of Internet information services use it to build security measures and to carry out security assessments. It was issued on 11 October 2021 and has applied since 1 May 2022.

Found what you need?

Document preview — GB/T 40645-2021

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Foreword
1 Scope
2 Normative references
3 Terms and definitions
4 Overview
5 Safety technical requirements
5.1 Information Generation
5.2 Information Processing
5.3 Information release
5.4 Information dissemination
5.5 Information storage
5.6 Information Destruction
6 Security requirements
6.1 Management System
6.2 Organization and personnel
6.3 Business Continuity
6.4 Operation and maintenance
Appendix A (Normative) Classification of Internet Information Service Security Level
Appendix B (informative) General requirements for Internet information service security component package customization example
Appendix C (informative) Internet information service security assessment process
C.1 Determine the target of assessment
C.2 Determine the security level of the assessment object
C.3 General requirements for customization
C.4 Develop an evaluation form
C.5 Implementation Evaluation
C.6 Confirmation result

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

1 Scope

This document specifies general security requirements for Internet information services, including security technical requirements and security assurance requirements.

This document is suitable for Internet information service providers to carry out Internet information service security construction and security assessment, including security management systems Degree and technical safeguard measures.

2 Normative references

The contents of the following documents constitute the indispensable clauses of this document through normative references in the text. Among them, dated quotations Only the version corresponding to that date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements

GB/T 25069 Information Security Technical Terms

GB/T 35273-2020 Information Security Technology Personal Information Security Specification

3 Terms and definitions

The following terms and definitions defined in GB/T 25069 and GB/T 35273-2020 apply to this document.

3.1 Internet information service

Based on relevant technical and functional attributes such as information release, interaction, and dissemination, open scene information provided to the public through the Internet service.

Note: Common forms of Internet information services include content release, comment evaluation, information sharing, recommendation push, content search, communication group, webcast, etc.

3.2 Information generation

The activities of collecting and editing information for the purpose of providing Internet information services.

3.3 Information processing

The activities of identifying, filtering, grading and categorizing information in accordance with established rules.

3.4 Information release

An activity that uses the Internet to provide information to individuals or organizations in a public setting.

3.5 Information dissemination

The activity of disseminating and spreading information through the Internet.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 19 pages — is available in the English PDF.

Referenced standards

Normative references

Cited by

Similar standards

GB/T 20272-2026|GB/T 20274.2-2026|GB/T 22186-2026|GB/T 24294.1-2026|GB/T 28455-2026|GB/T 31499-2026

How to Download GB/T 40645-2021

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.