GB/T 42765-2023Management system for security operation - Requirements with guidance for use (English PDF)

1 Scope

This document establishes the principles, requirements and usage guidelines for establishing, implementing, maintaining and continuously improving the security service management system:

Security services provide a framework for risk management:

This document is applicable to organizations engaged in security business with the following needs:

a) Establish, implement, maintain and continuously improve the security service management system;

b) Evaluate the consistency of security services with their management policies;

c) Demonstrate the ability to consistently meet customer needs:

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text: Among them, the dated quotations

For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document:

GB/T 19000-2016 Quality management system basics and terminology (ISO 9000:2015, IDT)

GB/T 23694-2013 Risk Management Terminology (ISO Guide73:2009,IDT)

3 Terms and definitions

The terms and definitions defined in GB/T 23694-2013, GB/T 19000-2016 and the following apply to this document:

3:1 assetsasset

Anything of tangible or intangible value in an organization (3:33):

Note 1: Tangible assets include people (emphasized in this document), physical and environmental assets:

Note 2: Intangible assets include information, brand and reputation:

3:2 auditaudit

A systematic and independent review conducted to obtain and objectively evaluate objective evidence to determine the extent to which audit criteria are met:

Documentation process (3:42):

Note 1: The audit can be an internal audit (first party) or an external audit (second party or third party), or it can be a multi-system audit (including two or more experts):

Industry):

Note 2: The organization (3:33) may itself conduct internal audits, or have an external entity conduct internal audits on its behalf:

Note 3: For the definitions of “evidence” and “criteria”, see GB/T 19000-2016:

[Source: GB/T 19000-2016,3:13:1]

3:3 auditorauditor

The person who conducts the audit (3:2):

[Source: GB/T 19011-2021,3:15] […]