GB/T 40813-2021Information security technology—Security protection technical requirements and testing evaluation methods of industrial control systems (English PDF)
信息安全技术 工业控制系统安全防护技术要求和测试评价方法
This is a limited preview
Buy now to download the full PDF (61 pages)
Need quotation for your management?
Get a formal quotation for GB/T 40813-2021 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
October 11, 2021
Implementation date
May 1, 2022
Scope
GB/T 40813-2021 is the English-translated version of 信息安全技术 工业控制系统安全防护技术要求和测试评价方法.
GB/T 40813-2021 sets out the technical security protection requirements for industrial control systems, the assurance requirements that go with them and the methods used to test and evaluate them.
The technical requirements cover the physical environment, network communication, the network boundary, industrial hosts, control equipment, data, the security products themselves and centralized management and control of the system, while the assurance requirements deal with secure software development and system maintenance.
For each area a matching test and evaluation method is given, and informative annexes show typical boundary protection deployments in electricity, automobile manufacturing, oil extraction, rail transit, chemicals, municipal gas and water.
It applies to building, operating and maintaining industrial control systems and refines the approach of GB/T 22239-2019. It was issued on 11 October 2021 and has applied since 1 May 2022.
Found what you need?
Document preview — GB/T 40813-2021
National Standard of the People's Republic of China
- ICS
- 35.030
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Foreword
- Introduction
- 1 Scope
- 2 Normative references
- 3 Terms and definitions
- 4 Abbreviations
- 5 Overview
- 5.1 The basic structure of ICS
- 5.2 Security Protection Objects and Purpose
- 5.3 Constraints of safety protection measures
- 6 Technical requirements for safety protection
- 6.1 Physical environment security protection
- 6.2 Network communication security protection
- 6.3 Network border security protection
- 6.4 Security Protection of Industrial Hosts
- 6.5 Safety protection of control equipment
- 6.6 Data Security Protection
- 6.7 Safety of protective products
- 6.8 System centralized management and control
- 7 Safety protection guarantee requirements
- 7.1 Software development security protection
- 7.2 System maintenance and safety protection
- 8 Test and evaluation methods
- 8.1 Physical environment security protection
- 8.2 Network communication security protection
- 8.3 Network border security protection
- 8.4 Security Protection of Industrial Host
- 8.5 Safety protection of control equipment
- 8.6 Data Security Protection
- 8.7 Protecting product safety
- 8.8 System centralized management and control
- 8.9 Software Development Security Protection
- 8.10 System maintenance and safety protection
- Appendix A (Informative) Typical Application Reference Scenarios of Network Border Security Protection
- A.1 Electricity
- A.2 Automobile manufacturing
- A.3 Oil extraction
- A.4 Rail Transit
- A.5 Chemical
- A.6 Municipal
- A.7 Water
- Appendix B (informative) Data security protection objects
- Appendix C (informative) Typical deployment method of centralized management and control of the system
- Appendix D (informative) ICS security protection test evaluation process
- Reference
Foreword
This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.
Introduction
This document combines the laws and regulations, policy documents and standards that have been issued by the country, and focuses on The Basic Requirements for Full-Technical Network Security Level Protection" adds and refines security protection technical indicators, control points and control items, and develops for related parties Industrial control system safety level protection and daily safety protection work provide a more operational basis. Standardized documents related to this document include.
---GB/T 22239-2019 "Basic Requirements for Information Security Technology Network Security Level Protection";
---GB/T 28448-2019 "Information Security Technology Network Security Level Protection Evaluation Requirements";
---GB/T 36323-2018 "Information Security Technology Industrial Control System Security Management Basic Requirements";
---GB/T 36324-2018 "Information Security Technology Industrial Control System Information Security Classification Specification";
---GB/T 37980-2019 "Guidelines for Information Security Inspection of Industrial Control Systems in Information Security Technology".
1 Scope
This document specifies the safety protection technical requirements, guarantee requirements and test evaluation methods of industrial control systems.
This document is applicable to the construction, operation and maintenance of industrial control systems.
2 Normative references
The content of the following documents constitutes an indispensable clause of this document through normative references in the text. Among them, dated quotations Only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.
GB/T 7353-1999 Industrial automation instrument panel, cabinet, table, box
GB/T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements
GB/T 25069-2010 Information Security Technical Terms
GB/T 36324-2018 Information Security Technology Industrial Control System Information Security Classification Specification
GB/T 37933-2019 Information security technology industrial control system special firewall technical requirements
3 Terms and definitions
As defined by GB/T 22239-2019, GB/T 25069-2010, GB/T 36324-2018 and GB/T 37933-2019 and The following terms and definitions apply to this document.
3.1 Industrial control asset
Valuable software and hardware resources and data in the process of industrial production control.
Note: Including control equipment, industrial hosts, network equipment, applications, industrial data, etc.
3.2 Central control room
Located in the organization, it is a comprehensive place with functions such as production operation, process control, safety protection, instrument maintenance and production management.
3.3 Field control room
Located at the production site within the organization, a place with functions such as production operations, process control, and safety protection.
3.4 Field auxiliary room
It is located at the production site in the organization and is used to install industrial control system cabinets and other equipment.
3.5 Control equipment
A device used to control actuators and collect sensor data during industrial production.
Note: Including DCS field control unit, PLC and RTU and other unit equipment for production process control.
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 61 pages — is available in the English PDF.
Referenced standards
Normative references
- GB/T 7353-1999Panel, cabinet, console and case for industrial-process measurement and control equipment
- GB/T 22239-2019Information security technology - Baseline for classified protection of cybersecurity
- GB/T 25069-2010Information security techniques—Terminology
- GB/T 36324-2018Information security technology—Information security classification specifications of industrial control systems
- GB/T 37933-2019Information security technology—Technical requirements of industrial control system dedicated firewall
Similar standards
How to Download GB/T 40813-2021
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 22239-2019 — Information security technology - Baseline for classified protection of cybersecurity
GB/T 36324-2018 — Information security technology—Information security classification specifications of industrial control systems
GB/T 37933-2019 — Information security technology—Technical requirements of industrial control system dedicated firewall
Secure payment via Stripe
Payments accepted
GB/T 40813-2021
$770.00