GB/T 41574-2022Information technology - Security techniques - Code of practice for protection of personal information in public clouds (English PDF)

National Standard of the People's Republic of China

Classification

L 80

Issued by: State Administration for Market Regulation, China National Standardization Administration

Contents

• Foreword
• Introduction
• 1 Scope
• 2 Normative references
• 3 Terms and Definitions
• 4 Overview
• 4.1 Structure of this document
• 4.2 Control Category
• 5 Information Security Policy
• 5.1 Information Security Management Guidance
• 5.1.1 Information Security Policy
• 5.1.2 Review of Information Security Policy
• 6 Information Security Organizations
• 6.1 Internal Organization
• 6.1.1 Roles and responsibilities for information security
• 6.1.2 Separation of duties
• 6.1.3 Liaison with functional bodies
• 6.1.4 Contact with specific interested parties
• 6.1.5 Information Security in Project Management
• 6.2 Mobile devices and remote work
• 7 Human Resource Security
• 7.1 Before Appointment
• 7.2 Appointment
• 7.2.1 Management responsibilities
• 7.2.2 Information security awareness, education and training
• 7.2.3 Violation Handling Process
• 7.3 Termination and Change of Appointment
• 8 Asset Management
• 9 Access Control
• 9.1 Business Requirements for Access Control
• 9.2 User Access Management
• 9.2.1 User registration and logout
• 9.2.2 User Access Provision
• 9.2.3 Privileged Access Management
• 9.2.4 User's Secret Authentication Information Management
• 9.2.5 Review of User Access Rights
• 9.2.6 Removal or adjustment of access rights
• 9.3 User Responsibilities
• 9.3.1 Use of Secret Authentication Information
• 9.4 System and Application Access Control
• 9.4.1 Information Access Restrictions
• 9.4.2 Secure Login Procedure
• 9.4.3 Password Management System
• 9.4.4 Use of Privileged Utilities
• 9.4.5 Access control of program source code
• 10 Password
• 10.1 Password Control
• 10.1.1 Password Control Usage Policy
• 10.1.2 Key management
• 11 Physical and Environmental Security
• 11.1 Safe area
• 11.2 Equipment
• 11.2.1 Equipment placement and protection
• 11.2.2 Supporting Facilities
• 11.2.3 Cabling Safety
• 11.2.4 Equipment maintenance
• 11.2.5 Movement of assets
• 11.2.6 Security of equipment and assets outside the organization's premises
• 11.2.7 Safe disposal or reuse of equipment
• 11.2.8 Unattended User Equipment
• 11.2.9 Cleaning up the desktop and screen strategy
• 12 Operational Safety
• 12.1 Operating procedures and responsibilities
• 12.1.1 Documented operating procedures
• 12.1.2 Change Management
• 12.1.3 Capacity Management
• 12.1.4 Separation of development, test, and runtime environments
• 12.2 Malware Prevention
• 12.3 Backup
• 12.3.1 Information backup
• 12.4 Logging and Monitoring
• 12.4.1 Event Log
• 12.4.2 Protection of log information
• 12.4.3 Administrator and operator logs
• 12.4.4 Clock synchronization
• 12.5 Running software control
• 12.6 Technical Aspects of Vulnerability Management
• 12.7 Information Systems Audit Considerations
• 13 Communication Security
• 13.1 Network Security Management
• 13.2 Information transfer
• 13.2.1 Information transfer policies and procedures
• 13.2.2 Information transfer protocol
• 13.2.3 Electronic messaging
• 13.2.4 Confidentiality or non-disclosure agreement
• 14 System acquisition, development and maintenance
• 15 Supplier Relations
• 16 Information Security Incident Management
• 16.1 Management and Improvement of Information Security Incidents