Valid

GB/T 43206-2023Information security technology - Testing and evaluation requirements for information system cryptography application (English PDF)

信息安全技术信息系统密码应用测评要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (45 pages)

Need quotation for your management?

Get a formal quotation for GB/T 43206-2023 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

September 7, 2023

Implementation date

April 1, 2024

Scope

GB/T 43206-2023 is the English-translated version of 信息安全技术信息系统密码应用测评要求.

GB/T 43206-2023 is the Chinese standard "Information security technology - Testing and evaluation requirements for information system cryptography application".

Its scope clause reads: This document stipulates the general evaluation requirements, technical evaluation requirements, and management evaluation requirements for information system level one to level four password applications. requirements, and provides requirements for overall assessment requirements, risk analysis and evaluation, and assessment conclusions.

Note. The information system password application levels described in this document are consistent with the password application levels specified in GB/T 39786-2021, among which the fifth-level password application Assessment requirements are not described in this document.

This document is suitable for guiding and standardizing the evaluation activities in the security assessment of information system password applications. Its clauses include normative reference documents; terms and definitions.

Found what you need?

Document preview — GB/T 43206-2023

National Standard of the People's Republic of China

ICS: 35.030
Classification: L80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
1 Scope
2 Normative reference documents
3 Terms and Definitions
4 General
5 General assessment requirements
5.1 Cipher Algorithm
5.2 Cryptotechnology
5.3 Cryptocurrency products
5.4 Password Service
5.5 Key Management
6 Technical evaluation requirements
6.1 Physical and environmental security
6.2 Network and communications security
6.3 Device and Computing Security
6.4 Application and data security
7 Management Assessment Requirements
7.1 Management system
7.2 Personnel management
7.3 Construction and operation
7.4 Emergency response
8 Overall evaluation requirements
8.1 Overview
8.2 Inter-unit evaluation
8.3 Inter-level evaluation
9 Risk Analysis and Evaluation
10 Evaluation Conclusion
Appendix A (informative) Key Life Cycle Management Check Points
Appendix B (informative) Typical password function evaluation technology
Appendix C (informative) Typical encryption product application evaluation technology

1 Scope

This document stipulates the general evaluation requirements, technical evaluation requirements, and management evaluation requirements for information system level one to level four password applications.

requirements, and provides requirements for overall assessment requirements, risk analysis and evaluation, and assessment conclusions.

Assessment requirements are not described in this document.

This document is suitable for guiding and standardizing the evaluation activities in the security assessment of information system password applications.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations

For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 25069-2022 Information security technical terms

GB/T 39786-2021 Basic requirements for information security technology information system password application

GM/Z4001 cryptographic terminology

3 Terms and definitions

The following terms and definitions as defined in GB/T 25069-2022, GB/T 39786-2021 and GM/Z4001 apply to this document.

document.

3.1

Pass the assessment recognized by the national cryptography management department or have the professional skill level certificate of cryptography technology application technician or cryptography engineering technician

Book, personnel engaged in security assessment of cryptographic applications.

Note. Referred to as "secret evaluator".

3.2 Checkexamine

Secret evaluators conduct interviews, document review, on-site inspection and analysis of evaluation objects to help the secret evaluators understand, clarify or obtain evidence.

the process of.

Note. Please refer to GM/T 0116-2021 for the evaluation methods that can be used during verification and the method selection instructions.

[Source. GB/T 25069-2022, 3.237, with modifications]

3.3

A relatively independent and complete set of assessment content, consisting of assessment indicators, assessment objects, assessment implementation and result determination.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 45 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB 38031-2025|GB/T43206-2023|GB/T 1.1-2020|GB/T 39786-2021|GB/T 25069-2022|GB/T 43779|GB/T 43696|GB/T 42453

How to Download GB/T 43206-2023

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.