Valid

GB/T 42457-2023Security for industrial automation and control systems - Secure product development lifecycle requirements (English PDF)

Preview PDF

This is a limited preview

Buy now to download the full PDF

Need quotation for your management?

Get a formal quotation for GB/T 42457-2023 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

March 17, 2023

Implementation date

October 1, 2023

Scope

GB/T 42457-2023 (Security for industrial automation and control systems - Secure product development lifecycle requirements) is available as an English-translated PDF.

GB/T 42457-2023 is the Chinese standard "Security for industrial automation and control systems - Secure product development lifecycle requirements". Its scope clause reads: This document specifies process requirements for the secure development of products used in industrial automation and control systems.

It defines a secure development lifecycle (SDL) for the purpose of developing and maintaining secure products. This lifecycle includes security requirements definition, secure design, secure implementation (including coding guidelines), verification and validation, defect management, patch management and product end-of-life.

These requirements can be applied to new or existing processes for developing, maintaining and retiring hardware, software or firmware for new or existing products.

These requirements apply to the developer and maintainer of the product, but not to the integrator or user of the product. A summary list of the requirements in this document can be found in Appendix B.

Found what you need?

Document preview — GB/T 42457-2023

National Standard of the People's Republic of China

Issued by: SAMR; SAC

Foreword4
Introduction5
1 Scope8
2 Normative References8
3 Terms, Definitions, Abbreviated Terms, Acronyms and Conventions8
3.1 Terms and Definitions9
3.2 Abbreviated Terms and Acronyms15
3.3 Conventions16
4 General Principles17
4.1 Concepts17
4.2 Maturity Model18
5 Practice 1 - Security Management20
5.1 Purpose20
5.2 SM-1.Development Process20
5.3 Rationale and Supplemental Guidance21
5.4 SM-2.Identification of Responsibilities21
5.5 SM-3.Identification of Applicability22
5.6 SM-4.Security Expertise22
5.7 SM-5.Process Scoping23
5.8 SM-6.File Integrity23
5.9 SM-7.Development Environment Security23
5.10 SM-8.Controls for Private Keys24
5.11 SM-9.Security Requirements for Externally Provided Components24
5.12 SM-10.Custom Developed Components from Third-party Suppliers25
5.13 SM-11.Assessing and Addressing Security-related Issues26
5.14 SM-12.Process Verification26
5.15 SM-13.Continuous Improvement27
6 Practice 2 - Specification of Security Requirements28
6.1 Purpose28
6.2 SR-1.Product Security Context28
6.3 SR-2.Threat Model29
6.4 SR-3.Product Security Requirements30
6.5 SR-4.Product Security Requirements Content31
6.6 SR-5.Security Requirements Review31
7 Practice 3 - Secure by Design32
7.1 Purpose32
7.2 SD-1.Secure Design Principles32
7.3 SD-2.Defense In-depth Design34
7.4 SD-3.Security Design Review35
7.5 SD-4.Secure Design Best Practices36
8 Practice 4 - Secure Implementation37
8.1 Purpose37

1 Scope

This document specifies process requirements for the secure development of products used in industrial automation and control systems. It defines a secure development lifecycle (SDL) for the purpose of developing and maintaining secure products. This lifecycle includes security requirements definition, secure design, secure implementation (including coding guidelines), verification and validation, defect management, patch management and product end-of-life.

These requirements can be applied to new or existing processes for developing, maintaining and retiring hardware, software or firmware for new or existing products. These requirements apply to the developer and maintainer of the product, but not to the integrator or user of the product. A summary list of the requirements in this document can be found in Appendix B.

2 Normative References

The contents of the following documents constitute indispensable clauses of this document through the normative references in the text. In terms of dated references, only the version with the specified date applies to this document. In terms of references without a specified date, the latest version (including all the modifications) is applicable to this document.

IEC 62443-2-4 Security for Industrial Automation and Control Systems - Part 2-4.Security

Program Requirements for IACS Service Providers

NOTE. GB/T 40682-2021 Security for Industrial Automation and Control System - Security Program

Requirements for IACS Service Providers (IEC 62443-2-4.2015, IDT)

IEC TR 62443-1-2 Security for Industrial Automation and Control Systems - Part 1-2.Master

Glossary of Terms and Abbreviations

3 Terms, Definitions, Abbreviated Terms, Acronyms and

Conventions

The terminology databases for ISO and IEC can be accessed at the following URLs.

GB/T 42456 | GB/T 41295.4 | GB/T 41571 | GB/T 11605 | […]

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — all pages — is available in the English PDF.

Referenced standards

Normative references

GB/T 40682-2021Security for industrial automation and control system - Security program requirements for IACS service providers

IEC 62443

Cited by

How to Download GB/T 42457-2023

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.