GB/T 42461-2023Information security technology - Guidelines for cyber security service cost measurement (English PDF)

Foreword

This document was issued on 17 March 2023 by the State Administration for Market Regulation; Standardization Administration of the PRC and takes effect on 1 October 2023.

It is a GB/T standard: recommended rather than compulsory, but it is the text a Chinese reviewer applies when assessing a submission.

It is classified under ICS 35.030, Chinese classification L80.

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1. Structure and Drafting Rules for Standardization Documents"

drafting.

Please note that some contents of this document may refer to patents. The issuing agency of this document assumes no responsibility for identifying patents.

This document is proposed and managed by the National Information Security Standardization Technical Committee (SAC/TC260).

This document was drafted by. Beijing Saixi Technology Development Co., Ltd., Beijing Anxin Tianxing Technology Co., Ltd., China Electronics Technology Network

Network Information Security Co., Ltd., Beijing Jiangnan Tianan Technology Co., Ltd., Shanghai Guanan Information Technology Co., Ltd., Qi Anxin Technology Group

Co., Ltd., China Information Security Evaluation Center, China Network Security Review Technology and Certification Center, Antiy Technology Group Co., Ltd.

Division, China Power Great Wall Internet System Application Co., Ltd., the Third Research Institute of the Ministry of Public Security, Shanghai 30 Guardian Information Security Co., Ltd., Hangzhou Dipco

Technology Co., Ltd., State Grid Xinjiang Electric Power Co., Ltd. Electric Power Research Institute, Beijing Tianrongxin Network Security Technology Co., Ltd., China Changjiang

Jiang Three Gorges Group Co., Ltd., Sangfor Technology Co., Ltd., Wasu Digital TV Media Group Co., Ltd., Qingdao Civil Aviation Kaiya System

Integration Co., Ltd., Research Institute of China Mobile Communications Co., Ltd., Beijing Shenzhou NSFOCUS Technology Co., Ltd.

The main drafters of this document. Xu Yuna, Chen Qingmin, Chen Guanzhi, Liu Huijing, An Jincheng, Zhang Tiezheng, Xie Jiang, Wang Yan, Sun Mingliang, You Qi,

Song Lili, Jia Fei, Wang Xinru, Zhang Ning, Zhou Mengyan, Zhang Chunming, Zhang Yan, Huang Changchun, Chen Changsong, Ganlu, Zhang Lin, Liu Jilin, Fang Houfeng, He Ling,

Mali, Zhang Jing, Zhang Runshi, Ye Xiang, Liu Xiaojiang, Liu Qing, Yang Kai, Chen Lei.

Information Security Technology Network Security Service Cost

Measurement Guide

1 Scope

GB/T 42461-2023 covers how the cost of a cyber security service is composed and measured — an overview of what makes up that cost, then the measurement of total cost and of its parts. Human cost is treated separately from non-human cost, a further clause takes the items that fall under neither heading, and an informative annex works through the calculation of a unit price for security service personnel. A second annex carries a full cost calculation for a typical service project, running from the project background and the stated service requirements to the labour figure. Cost here is measured without profit, and that exclusion is what lets one supplier's number be set beside another's. A security service is mostly people and time, so a tender can turn on how each side counts hours, seniority and overhead rather than on what is delivered; a buyer with no common basis for comparison chooses on the headline figure and meets the difference later, in staff who are cheaper than the work needs. The guidance is used by security service suppliers pricing their work, by buyers running tenders and settling final accounts, and by the procurement and finance staff on both sides who have to defend the figures afterwards.

This document establishes the cost composition of network security services, and provides guidelines for cost measurement of network security services. Cybersecurity in this document

Service costs do not include profit.

This document is applicable to network security service cost budgets, project bidding, project final accounts, and other relevant issues related to network security service suppliers and buyers.

Contract preparation and other activities, other related parties refer to it.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references

For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to

this document.

GB/T 25069-2022 Information Security Technical Terminology

GB/T 30283-2022 Information Security Technology Information Security Service Classification and Code

3 Terms and Definitions

The following terms and definitions defined in GB/T 25069-2022 and GB/T 30283-2022 apply to this document.

3.1

Cybersecurity service cybersecurityservice

It is a network security process implemented by the service provider in accordance with the service agreement for various network security needs of organizations or individuals.

Note 1. Network security services are usually based on information security technology, products or management systems, and are provided by professional network security personnel or organizations in the form of outsourcing.

Support and assistance provided.

Note 2. Network security services are usually carried out in the form of service items between network security service providers and network security service demanders.

Note 3. The "network security service" in this document is equivalent to the "information security service" in GB/T 30283-2022.

[Source. GB/T 30283-2022, 3.1, modified]

3.2

service agreement serviceagreement

The agreement signed by the service demander and the service provider before the start of the service and abide by it during the service process.

Note. It usually includes service principles, service content, service form, service level agreement, service price, service deliverables, service security requirements, etc. The form can be

So is the service contract and its accompanying statement of work.

[Source. GB/T 30283-2022, 3.4, modified]

3.3

demand side

An organization or individual that obtains externally provided network security services to meet network security needs and achieve its own business goals.

[Source. GB/T 30283-2022, 3.2, modified]