GB/T 45389-2025Data security technology — Capability requirements for assessment organization of data security (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting is required.

Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents.

This document was proposed and coordinated by the National Cybersecurity Standardization Technical Committee (SAC/TC 260).

This document was drafted by: National Information Technology Security Research Center, China Electronics Technology Standardization Institute, National Computer Network Emergency Response Team Technical Processing Coordination Center, China Cybersecurity Review and Certification and Market Supervision Big Data Center, China Information Security Evaluation Center, China Network Space Research Institute, the Third Research Institute of the Ministry of Public Security, China Academy of Information and Communications Technology, China Software Evaluation Center, National Industrial Information Security Development Research Institute Research Center, the 15th Institute of China Electronics Technology Group Corporation, University of Science and Technology of China, Institute of Software, Chinese Academy of Sciences, Industrial and Information Technology The Fifth Electronic Research Institute of the Ministry of Information and Communications Technology, the Sixth Research Institute of China Electronics Information Industry Group Co., Ltd., the Supervision Center of the State Administration of Radio and Television, Information Center of Civil Aviation Administration of China, Education Management Information Center of Ministry of Education, Beijing UnionPay Gold Card Technology Co., Ltd., Beijing Times Xinwei Information Technology Co., Ltd., Guangdong Radio and Television Metrology and Testing Group Co., Ltd., Guangzhou Jingyuan Safety Technology Co., Ltd., Nanjing Big Data Testing Technology Co., Ltd.

Technology Co., Ltd., Shaanxi Information Engineering Research Institute, Transportation Information Security Center Co., Ltd., National Application Software Product Quality Inspection Testing center, etc.

The main drafters of this document are: Yu Kequn, Yang Tao, Chen Lin, Hu Ying, Zhang Yuguang, Ren Yingjie, Zhu Xuefeng, Lin Xingchen, Wang Hui, Zuo Xiaodong, Zhang Xiaomei, Xu Jinghui, Zhang Xiaofei, Gao Song, Jiang Wei, Wang Pu, Ru Mengyuan, Wang Hui, Wang Yiyu, Cheng Yuqi, Tang Gang, Zhang Dexin, Sun Jun, Zhao Ran, Zhang Yuanyuan, Huo Shanshan, Liu Jian, Yan Min, Yang Chen, Shan Boshen, Lu Liewen, Zhao Yunlong, Li Yan, Zhang Wei, Yang Weiping, Chen Cong, Wang Xinjie, Yu Zhengchen, Dai Ming, Du Jian, Tang Di, He Gang, Chen Zhijun, Zhao Xiaorong, Guo Jianhong, Cao Yue, Chen Jing, and Song Hongtao.

Data security technology Data security assessment agency Competency requirements

1 Scope

This document specifies the capability requirements for data security assessment agencies, including basic conditions, management capabilities, technical capabilities, human resources capabilities, Manpower, location and equipment resource capabilities.

This document is applicable to the capacity building of data security assessment agencies themselves, as well as the capacity evaluation of data security assessment agencies.

The processor selects a third-party data security assessment agency to provide reference.

2 Normative references

GB/T 19001-2016

GB/T 25069-2022

GB/T 32914-2023

GB/T 39335-2020

GB/T 41479-2022

3 Terms and definitions

The terms and definitions defined in GB/T 25069-2022 and GB/T 41479-2022 and the following apply to this document.