GB/T 41574-2022Information technology - Security techniques - Code of practice for protection of personal information in public clouds (English PDF)

0.1 Background and environment

In recent years, more and more cloud service customers use the services of cloud service providers and entrust them with personal information processing.

GB/T 35273-2020 stipulates that the party who accepts the entrusted processing (9.1 in GB/T 35273-2020 is called "the entrusted person", this article

"Processor" in the document, that is, "entrusted person") requirements. This document provides a

A general compliance framework for the protection of personal information in the public cloud, which guides processors to carry out personal information processing operations in the public cloud.

Public cloud service providers are usually required to sign contracts with cloud service customers and comply with personal information protection laws on both sides

Provide services under the premise of relevant regulations. For these requirements of personal information protection, cloud service providers and cloud service customers are based on the law

laws and regulations and the contracts between them.

When the public cloud service provider processes personal information in accordance with the requirements of cloud service customers, the public cloud service provider acts as a "personal information"

The role of "processor". Cloud service customers who have a contractual relationship with public cloud personal information processors are "personal information controllers". In cloud computing

Under the environment, the personal information controller has the right to control personal information, and it also has the authority to process and use personal information. Personal Information Control

Both the personal information processor and the personal information processor can process personal information, but the personal information processor, as the entrusted party, can only perform personal information control

Personal information processing operations requested by the controller and operations necessary to achieve the objectives of the personal information controller. At the same time, cloud service customers can also

Authorize one or more cloud service users to use its services, but these services are limited to the cloud service customer's contract with the public cloud personal information processor

Available services agreed in the contract.

The purpose of this document is to create a common set of control categories and control measures, consistent with the information security control objectives and controls in GB/T 22081

The measures are used in combination and implemented by the personal information processor. The purpose of this document is as follows.

---Help public cloud personal information processors perform their corresponding obligations, including direct obligations and contractual obligations stipulated by laws and regulations.

other obligations as set out;

---Make public cloud personal information processors transparent in related matters, and facilitate cloud service customers to choose well-managed cloud-based

personal information processing services;

---Assist cloud service customers and public cloud personal information processors to sign contracts and agreements;

---Unable to audit data hosted in multiple parties or virtualized servers (clouds) in a single cloud service customer, or such audits

Exercising audit powers and assuming compliance for cloud service customers that may increase risk to existing physical and logical cybersecurity controls

Consistency responsibility provides a mechanism.

This document provides a general compliance framework for public cloud service providers, especially those operating across borders.

0.2 Personal information protection control of public cloud computing services

In the process of implementing cloud computing information security management system based on GB/T 22080, public cloud personal information processors can refer to this article

choose personal information protection controls. This document can also implement general personal information protection controls as a public cloud personal information processor

Guidance document for measures. In particular, this document, on the basis of GB/T 22081, takes into account the specific risks faced by personal information processors

surroundings.

Generally speaking, organizations implement GB/T 22080 to protect their own information assets. However, public cloud personal information processors protect

The personal information is actually the information assets of cloud service customers. Therefore, the implementation of GB/T 22081 by the public cloud personal information processor

Control measures are reasonable and necessary. At the same time, in order to adapt to the characteristics of risk dispersion in the public cloud computing environment, and to meet the needs of cloud service customers

Contractual requirements with public cloud personal information processors, this document enhances the control measures in GB/T 22081.This document is passed by

GB/T 22081 is enhanced in the following 2 ways.

--- Provides implementation guidelines applicable to public cloud personal information protection for certain control measures in GB/T 22081;

---Appendix B provides a new set of control measures and related guidance to address the failure to meet the set of control measures in GB/T 22081

public cloud personal information protection requirements.

0.3 Personal Information Protection Requirements

Organizations determine their protection requirements for personal information. These requirements come from the following 3 main sources.

a) Legal, regulatory, regulatory and contractual requirements. A source is the legal, legal and

Regulatory, regulatory and contractual requirements or obligations, as well as sociocultural responsibilities and operating environment requirements. It should be noted that laws, regulations and

Contracts may mandate that personal information processors choose specific controls, or they may be required to develop specific guidelines to implement them.

these control measures.

b) Risk. Another source is the organization's assessment of risk associated with personal information, based on consideration of the organization's overall business strategy and objectives

risk. Organizations use risk assessments to identify threats, assess vulnerabilities and likelihood of occurrence, and estimate potential impacts. GB/T 31722

Provides information security risk management guidelines, including recommendations for risk assessment, risk acceptance, risk communication, risk monitoring, and risk review.

discussion. ISO /IEC 29134 provides guidance on privacy impact assessments.

c) Organizational policy. Although organizational policy covers many obligations from law and social culture, the organization may voluntarily choose to go beyond

a) requirements.

0.4 Selection and implementation of control measures in cloud computing environment

Organizations may select controls from this document (including those in the referenced GB/T 22081, as well as application-specific innovations

The built-in portfolio reference set of controls). If desired, the organization may also select controls from other sets of controls, or design new controls.

measures to meet specific requirements.

The choice of control measures depends on the decision of the organization. These decisions are based on risk acceptance, risk treatment options, and

based on the general risk management approach of the customers and suppliers with which the organization has contractual relationships. The choice of control measures is also subject to domestic and foreign laws and regulations

constraints. If a control measure in this document is not selected, the reason for not being selected shall be stated and documented.

In addition, the selection and implementation of controls also depends on the organization's actual role in the overall cloud computing reference architecture (see

GB/T 32399). In a cloud computing environment, there may be situations where multiple organizations participate in providing infrastructure services and application services. in a

In some cases, the selected controls may be unique to a particular service class in the cloud computing reference architecture. and in other cases

Below, implementing security controls may share roles. The contractual agreement needs to specify the personal information assumed by all organizations providing or using the cloud service.

information protection responsibility. These organizations include public cloud personal information processors and their subcontractors, cloud service customers.

The control measures in this document can be considered as a guideline applicable to most organizations. Details of these control measures are given below

Description and implementation guide. If public cloud personal information processors design information systems, services and operations with pre-emptive consideration to protect personal information

requirements for personal information, the implementation of these control measures will be simpler. This is part of "Privacy by Design" (see Ref. [9])

part.

0.5 Develop additional guidelines

This document can be seen as a starting point for the development of guidelines for the protection of personal information. For the protection of personal information, the controls and practices in this document

Not all existing guidance may be applicable, and additional controls and implementation guidance not included in this document may be required. included in the development

When documenting additional controls or guidance, cross-referencing the applicable provisions in this document may assist auditors and business partners

Compliance check.

0.6 Lifecycle Considerations

Personal information has its inherent life cycle, from creation and generation, through storage, processing, use, transmission, and eventual destruction or disappearance.

Personal information faces different risks in its life cycle, but it is still important to protect personal information at all stages of the life cycle.

Personal information protection needs to be considered in combination with existing and new information systems, and full life cycle management should be carried out.

information technology security technology

A practical guide to the protection of personal information in the public cloud