GB/T 43710-2025Requirements for auditing of scientific data security (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part

1.Structure and drafting rules for standardization documents" Drafting. Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents. This document was proposed by the Ministry of Science and Technology. This document is under the jurisdiction of the National Science and Technology Platform Standardization Technical Committee (SAC/TC486). This document was drafted by: Computer Network Information Center of the Chinese Academy of Sciences, China National Institute of Standardization, China Network Security Review Technology and Certification Center, China Academy of Information and Communications Technology, China Software Evaluation Center (Software and Integrated Circuit Promotion Center of the Ministry of Industry and Information Technology), Beijing University of Posts and Telecommunications, Institute of High Energy Physics, Chinese Academy of Sciences, Institute of Information Engineering, Chinese Academy of Sciences, Beijing Shenzhou Green Alliance Technology Co., Ltd., Guangzhou Internet of Things Research Institute, Beijing Dikan Technology Co., Ltd., Fujian CITIC Network Security Information Technology Co., Ltd., Fujian Big Data Primary Development Co., Ltd. company. The main drafters of this document are. Liao Fangyu, Wei Jinxia, Zhao Jing, Li Jing, Long Chun, Du Guanyao, Wan Wei, Yang Fan, Wang Yueda, Fu Yuhao, Hu Lianglin, Zhu Yanhua, Yu Jianjun, Li Chong, Li Jingjing, Wang Zhiqiang, Yang Qinghai, Xu Kaicheng, Gan Jiefu, Jing Huiyun, Zhou Runsong, Guo Ying, Liu Jianyi, Qi Fazhi, Hou Fengyao, Ma Duohe, Wang Yan, Xu Zhen, Wang Liming, Ye Xiaohu, Wu Tiejun, Wang Wei, Li Dong, He Ying, Li Zhe.

Scientific data is a strategic and basic scientific and technological resource with the characteristics of the fastest transmission speed, the widest impact, and great potential for development and utilization. The data security law of the People's Republic of China has a profound impact on the economic development, national security, scientific and technological progress and overall competitiveness of all countries. The Personal Information Protection Law of the People's Republic of China and the Cybersecurity Law of the People's Republic of China together constitute the basis for the governance of my country's network data field. The new law marks the gradual maturity of the system construction that matches my country's status as a major network power and a digital power. It is proposed that "the security management of scientific data throughout its life cycle should be strengthened, and scientific data security protection measures should be formulated; the authentication and authorization of data downloads should be strengthened. This document is aimed at the security and compliance needs of scientific data in the natural sciences and can promote the scientific data The data security capabilities of relevant institutions will be improved, and scientific data security audits will be standardized to meet national compliance requirements. This document is a basic scientific data security standard applicable to scientific data agencies and is used to ensure the security of scientific data in their activities. The relevant requirements for scientific data security audits are stipulated, including general requirements, general audit requirements and special audits. The general requirements mainly describe the audit basis and audit objectives. The general audit requirements are to comprehensively evaluate the scientific data related institutions. The audit is conducted to assess the achievement of the organization's safety goals, including safety strategy, organizational construction, human resource management, management supervision, safety management, scientific and mathematical Conduct general audits on scientific data security control work in terms of life cycle business processes, etc. Special audit requirements are based on external Audits based on requirements and internal special requirements can meet the needs of scientific data related institutions for personal information security, submission security, and data export security. In view of the continuous improvement of the national data security compliance supervision system, the content of special audits will be further improved. New, meeting national regulatory requirements. The requirements for scientific data security audits are intended to objectively reflect the implementation of security controls in scientific data-related activities. Scientifically evaluate the confidentiality, availability, integrity, reliability, controllability, traceability, non-repudiation and other security goals and compliance of the system. Evaluation of data security controls. Scientific Data Security Audit Requirements

1 Scope

GB/T 43710-2025 sets the requirements for auditing the security of scientific data. China's national scientific data centres hold data that is simultaneously meant to be shared and subject to classification and export control, and the audit is what reconciles the two: it is the mechanism by which a centre can demonstrate, after the fact, who obtained what and under what authority. The standard sets the general principles of the audit - its basis and its objectives - then the general audit requirements covering the security strategy, the organisational structure, human resource management, business continuity management, management supervision, and security management including the classification and grading of data, followed by the audit of the data lifecycle activities, the conduct of the audit and the audit report, with an annex on the types, structure and content of the report and a worked sample. It took effect on 24 January 2025.

This document specifies the relevant requirements for scientific data security audits, including overall requirements, general audit requirements and special audit requirements. This document is applicable to scientific data organizations for auditing security control activities involved in scientific data related activities.

2 Normative references

The contents of the following documents constitute the essential clauses of this document through normative references in this document. For referenced documents without a date, only the version corresponding to that date applies to this document; for referenced documents without a date, the latest version (including all amendments) applies to This document.

GB/T 25069 Information security technical terms

GB/T 35294 Information Technology Scientific Data Citation

GB/T 36092-2018 Information technology backup storage backup technology application requirements

GB/T 39335 Information Security Technology Personal Information Security Impact Assessment Guide

GB/T 42574 Information Security Technology Implementation Guidelines for Notification and Consent in the Processing of Personal Information

GB/T 43705 Guidelines for the classification and grading of scientific data security

GB/T 43708 General requirements for scientific data security

GB/T 44024 Basic requirements for the protection of scientific data rights and interests

3 Terms and definitions

The terms and definitions defined in GB/T 25069 and GB/T 43708 and the following apply to this document.

3.1 scientific datascientificdata In the fields of natural sciences, engineering sciences, etc., the Records of original and derived information obtained by other means, or other data that can be used for scientific research activities. [Source: GB/T 43708-2025, 3.1]

3.2 Through management and technical measures, we will ensure the continuity of scientific data in the interests of national security, scientific and technological security, social public interests and the legitimate rights and interests of others. A state of being effectively protected and used in compliance with regulations. [Source: GB/T 43708-2025, 3.2]

3.3 Scientific data is collected and processed, stored and backed up, transmitted and exchanged, shared, used and served, safely disposed, and finally reused. Circular process. [Source: GB/T 43708-2025, 3.3]