GB/T 42775-2023Data security risk prevention and control for securities and futures industry—Guidelines of data classification (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

Introduction

With the advancement of information technology and the further deepening of application in the industry in recent years, including the direct management of the national securities and futures industry authorities, Various market entities, including industry organizations, industry associations, and securities and futures operating institutions, have accumulated a large amount of data. On the one hand, it needs to be effective Identify rational data usage needs, clarify technical standards for key links, and determine the scope of new technologies; on the other hand, it is necessary to combine In response to the development and changes of the industry, we must effectively identify new risks and hazards, continue to strengthen data security management, establish and improve data management systems, and take necessary data management measures.

According to safety protection measures, the safe operation of the market and the legitimate rights and interests of investors are maintained.

There are many types of businesses in the securities and futures industry, and the data is characterized by high complexity and diversity. Adopt standardized data classification and grading methods Laws can help industry organizations clarify data, determine the importance or sensitivity of data, and take appropriate and reasonable management measures and security measures in a targeted manner. protective measures to form a set of scientific and standardized data management and protection mechanisms, thereby promoting data openness and sharing on the basis of ensuring data security.

Enjoy. Data classification is a key part of data protection work. It is the basis for establishing a unified, accurate and complete data architecture and the realization of centralized The basis for Sinochemical, professional and standardized data management. Industry organizations follow a unified data classification method and analyze the generated and generated data based on their own business characteristics.

Classification of data collected, processed, used or managed is conducive to clearly clarifying data assets, achieving standardized management of data, and providing data Provide support for maintenance and expansion. Data classification is based on data classification, using standardized and clear methods to distinguish the importance and sensitivity of data.

Gain differences and determine data levels. Data classification helps industry organizations determine the role of data at each stage of its life cycle based on different levels of data.

Data security protection strategies and control measures that should be adopted in each link, thereby improving the data management and security protection level of industry organizations and ensuring that data Data integrity, confidentiality and availability.

This document provides guiding principles for data classification and grading work, and is based on JR/T 0176.1-2019 "Securities and Futures Industry Data Model No.

Part 1: Based on the business line division of "Abstract Model Design Method", combined with the characteristics of the securities and futures industry, a step-by-step approach from business to data is proposed.

The divided data classification and grading method is also provided with relevant suggestions on data classification and grading management for reference by relevant institutions in the securities and futures industry. this In addition, it can be used as a reference for the securities and futures industry when formulating relevant standards for data management, data security and protection.

1 Scope

This document provides the applicable data scope, safeguard measures, principles and methods for data classification and grading in the securities and futures industry, Suggestions on how to deal with key issues in data classification and grading.

This document is applicable to various institutions in the securities and futures industry (referred to as "industry institutions") to carry out data classification and analysis when preventing and controlling data security risks. level use. Other relevant agencies can be used as references. This document does not apply to data involving state secrets.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 10113 General terms for classification and coding

GB/T 22240-2020 Information security technology network security level protection grading guide

JR/T 0171-2020 Technical specifications for personal financial information protection

JR/T 0176.1-2019 Securities and futures industry data model Part 1: Abstract model design method

JR/T 0197-2020 Financial Data Security Data Security Classification Guide

3 Terms and definitions

The following terms and definitions apply to this document.