GB/T 44462.1-2024Industrial internet enterprise cybersecurity - Part 1: Protection requirements of internet industrial enterprise (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part

1.Structure and drafting rules for standardization documents" Drafting. This document is Part 1 of GB/T 44462 "Industrial Internet Enterprise Cybersecurity". GB/T 44462 has been published as follows part.

1.Protection requirements for industrial enterprises applying the Industrial Internet;

2.Protection requirements for platform enterprises;

3.Identity resolution enterprise protection requirements. Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents. This document was proposed by the Ministry of Industry and Information Technology of the People's Republic of China. This document was prepared by the National Communications Standardization Technical Committee (SAC/TC485) and the National Cyber Security Standardization Technical Committee (SAC/TC260). Jointly managed. This document was drafted by: National Industrial Information Security Development Research Center, China Academy of Information and Communications Technology, and China Southern Power Grid Science Research Institute. Limited Liability Company, Guoneng Digital Technology Development (Beijing) Co., Ltd., China Aerospace Science and Industry Aerospace Technology Research Institute, Beijing Topsec Network Security Technology Co., Ltd., Ministry of Transport Science and Technology Research Institute, Fengtai Technology (Beijing) Co., Ltd., Beijing Venusstar Information Security Technology Co., Ltd. China Electronics Technology Standardization Institute, Beijing Jinghang Computing and Communication Research Institute, Schneider Electric (China) Co., Ltd., Chint Group Co., Ltd. Ltd., Hangzhou Anheng Information Technology Co., Ltd., China Software Testing Center (Software and Integrated Circuit Promotion Center of the Ministry of Industry and Information Technology) Center), Institute of Information Engineering, Chinese Academy of Sciences, Zhengzhou Xindajiean Information Technology Co., Ltd., Shanghai Baosight Software Co., Ltd. Beijing Winut Technology Co., Ltd., China Industrial Internet Research Institute, National Information Technology Security Research Center, Shanghai Chemical Bao Digital Technology Technology Co., Ltd., Shanghai Computer Software Technology Development Center, Shenzhen Gas Group Co., Ltd., China Southern Power Grid Co., Ltd. Co., Ltd., Guizhou Electronic Information Vocational and Technical College. The main drafters of this document are. Jiang Yan, Wang Rui, Liao Jian, Zhang Zheyu, Dong Liangyu, Sun Jun, Dong Na, Liang Zhihong, Kuang Xiaoyun, Zhang Ge, Li Jun, Wang Shirui, Zhang Liguang, Yu Meng, Ma Juan, Yang Zitao, Han Pengjun, Li Yang, An Gaofeng, Cao Yu, Yuan Zhen, Zhao Ran, Yang Xingcheng, Liu Zhiyao, Li Lin, Wang Zun, Zhang Yongjing, Bi Jihua, Xie Chengyun, Peng Hua, Ma Lixiang, Zhao Jianing, Zhang Weidong, Liu Weihua, Wang Chonghua, Wang Sirui, Guo Yang, Zha Qiwen, Zhao Zitong, Zeng Zhenzhen, Zhang Yu, Liu Zhenyu, Zhang Jing, Su Yang, Yang Yiwei, Huang Siqi, Li Jingtian, Liu Fang, Wang Xupei, Pei Yanchun, Ma Xiao, Hao Xin, An Chengfei.

There are many industrial Internet companies, with different levels of informatization development and different types of business. The network security protection rules of the industry In order to solve the problem that the existing network security protection requirements cannot meet the actual needs of the development of industrial Internet enterprises, it is necessary to implement industrial Internet companies' network security is classified and graded and relevant standards are formulated. GB/T 44462 "Industrial Internet Enterprise Cybersecurity" is a guide for industrial Internet enterprises to carry out cybersecurity classification and grading protection work. It is a basic standard for industrial enterprises, industrial Internet platform enterprises, and industrial Internet identification resolution enterprises that apply the industrial Internet. and enterprise data security, and proposes different levels of network security management and security protection technical requirements to guide enterprises to implement Adaptive security measures, due to the different needs of file users, consist of four parts.

1.Protection requirements for industrial enterprises using the Industrial Internet. The purpose is to propose industrial enterprises using the Industrial Internet Security requirements that need to be implemented in carrying out network security classification and grading protection work.

2.Protection requirements for platform enterprises. The purpose is to propose the requirements for industrial Internet platform enterprises to carry out network security classification and classification. Safety requirements that need to be implemented in protective work.

3.Protection requirements for identity resolution companies. The purpose is to propose the requirements for industrial Internet identity resolution companies to carry out network security analysis. Safety requirements that need to be implemented in class-based protection work.

4.Data protection requirements. The purpose is to propose the requirements for industrial Internet enterprises to carry out network security classification and classification protection work. Data security requirements to be implemented. This document is aimed at industrial enterprises that apply the Industrial Internet and proposes three different levels of security requirements. initial level, basic level, and enhanced level. To guide enterprises to implement the classification and grading management of industrial Internet security, and to provide security guidance for various information systems of industrial enterprises that apply industrial Internet. It lays the foundation for improving the protection level and provides guidance for the construction of the overall industrial Internet security protection capabilities of enterprises. Industrial Internet Enterprise Cybersecurity Part

1 Scope

GB/T 44462.1-2024 is Part 1 of the Chinese series on industrial internet enterprise cybersecurity, and sets the protection requirements for the industrial enterprises that use the industrial internet. Connecting a plant to a platform dissolves the air gap that its control system was designed around: engineering workstations, historians and PLCs become reachable from a network that was never in the threat model, and the enterprise that owns the plant, rather than the platform operator, carries the consequence. The standard first determines the security protection level appropriate to the enterprise, then fixes the scope of what must be protected - the equipment, the control system, the network, the platform, the data and the application - and sets the protection requirements at three graded levels: initial, basic and enhanced. It takes effect on 1 January 2025.

This document specifies the requirements for industrial enterprises that apply the Industrial Internet in terms of equipment, control, network, application platform software, management, and physical environment. Different levels of network security protection requirements in different aspects. This document is applicable to guiding industrial enterprises that apply the Industrial Internet to carry out network security classification and grading protection work.

2 Normative references

The contents of the following documents constitute essential clauses of this document through normative references in this document. For referenced documents without a date, only the version corresponding to that date applies to this document; for referenced documents without a date, the latest version (including all amendments) applies to This document.

GB/T 25069 Information security technical terms

GB/T 39786 Information security technology Basic requirements for the application of cryptography in information systems

GB/T 42021 Overall network architecture of the industrial Internet

3 Terms and definitions

The terms and definitions defined in GB/T 25069 and GB/T 42021 and the following apply to this document.

3.1 Industrial enterprises that use Industrial Internet technologies to achieve intelligent control, operation optimization and changes in production organization methods.

4 Abbreviations

The following abbreviations apply to this document. APP. Application