Partners save 15% on every standard

Valid

GB/T 45409-2025Cybersecurity technology — Technical specifications for operation and maintenance security management products (English PDF)

网络安全技术运维安全管理产品技术规范

Open the GB/T 45409-2025 preview as PDF

Preview — first pages of GB/T 45409-2025 (full document: 35 pages)

This is a limited preview

Buy now to download the full PDF (35 pages)

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

March 28, 2025

Implementation date

October 1, 2025

Scope

GB/T 45409-2025 is the English-translated version of 网络安全技术运维安全管理产品技术规范.

GB/T 45409-2025 is the Chinese national standard covering the product that stands between an administrator and the systems he maintains — the security function requirements, the product's own security, the security assurance requirements, the evaluation method matched to each requirement, the grading of products into levels, and the separation of system, security and audit administrators, which exists because a product that holds every administrative credential is itself worth attacking. It is the supporting standard for GB 42250-2022 on network security special products. First edition, in force from 1 October 2025. Issued on 28 March 2025, it has been in force since 1 October 2025.

Document preview — GB/T 45409-2025

National Standard of the People's Republic of China

ICS: 35.040
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

PrefaceIII
IntroductionIV
1 Scope1
2 Normative references1
3 Terms and Definitions1
4 Abbreviations2
5 General2
6 Safety technical requirements3
6.1 Security Function Requirements3
6.2 Self-security requirements6
6.3 Security requirements8
7 Test and evaluation methods9
7.1 General description and test environment9
7.2 Safety function evaluation10
7.3 Self-security assessment16
7.4 Security Assessment23
Appendix A (Normative) Technical requirements for operation and maintenance safety management products and corresponding test evaluation methods28
A.1 Classification of safety technical requirements28
A.2 Test evaluation method29
Appendix B (Informative) Typical Application Scenarios of Operation and Maintenance Security Management Products31

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents.

This document was proposed and coordinated by the National Cybersecurity Standardization Technical Committee (SAC/TC260).

This document was drafted by: The Third Research Institute of the Ministry of Public Security, Zhejiang Qizhi Technology Co., Ltd., Institute of Software of the Chinese Academy of Sciences, Huawei Technologies Technology Co., Ltd., Shanghai Chenrui Information Technology Co., Ltd., China Cybersecurity Review and Certification and Market Supervision Big Data Center, National Industrial Information Information Security Development Research Center, Qi'anxin Wangshen Information Technology (Beijing) Co., Ltd., Beijing Tianrongxin Network Security Technology Co., Ltd., Beijing Shenzhou Green Alliance Technology Co., Ltd., Xi'an Jiaotong University Jabil Network Technology Co., Ltd., Beijing University of Posts and Telecommunications, Hangzhou Zhonger Network Technology Co., Ltd.

Company, Blue Elephant Standard (Beijing) Technology Co., Ltd., Yuanjiang Shengbang (Beijing) Network Security Technology Co., Ltd., Sangfor Technologies Co., Ltd.

Ltd., Changyang Technology (Beijing) Co., Ltd., Hangzhou Anheng Information Technology Co., Ltd., Beijing Times Newway Information Technology Co., Ltd.

Company, Beijing Venusstar Information Security Technology Co., Ltd., Shanghai Sanling Guard Information Security Co., Ltd., China Electronics Technology Network Security Technology Co., Ltd.

Co., Ltd., Shanghai Guanan Information Technology Co., Ltd., Guangdong Anchuang Information Technology Development Co., Ltd., Blue Shield Information Security Technology Co., Ltd.

Co., Ltd., Beijing Zhiyou Network Security Technology Co., Ltd., Shaanxi Network and Information Security Evaluation Center, Henan Zhongke Ernst & Young Technology Co., Ltd.

Company, State Grid Blockchain Technology (Beijing) Co., Ltd., Guangdong Information Security Evaluation Center, Guangdong Radio and Television Measurement and Testing Group Co., Ltd., Inner Mongolia Gu Digital Economic Security Technology Co., Ltd. and State Grid Xinjiang Electric Power Co., Ltd. Electric Power Science Research Institute.

The main drafters of this document are: Zhang Yan, Zou Chunming, Hu Jinming, Zhao Ge, Shen Liang, Xu Peng, Wu Qiang, Cai Yongjuan, Yan Min, Yang Chen, Wang Feng, Wang Xi, Shen Yongbo, Wang Chonghua, Song Xiaobao, Jiang Wei, Zhou Jin, He Jianfeng, Ma Xiangliang, Ge Fangjun, Zhang Debao, Wang Chengyi, Liu Chen, Wang Yizhou, Wu Yan, Wang Lianqiang, Zhou Ruiqun, Liu Biao, Yan Yuheng, Xie Jiang, Zhong Yingnan, Liu Qiang, Han Yun, Feng Yanfei, Guo Junwu, Shi Zhuyu, Ye Jinhong, Tang Di, Cai Yuyuan, Gajdar Gingers.

Introduction

In order to implement Article 23 of the Cybersecurity Law of the People's Republic of China, GB 42250 "Information Security Technology Network Security Special Products The Security Technical Requirements specifies the baseline requirements that both network security-specific products and their providers must meet.

This document is a supporting standard for GB 42250.GB 42250 and this document are used together to guide the research and development, production and operation of operation and maintenance safety management products.

Production, service, testing and certification.

Network security technology operation and maintenance security management products Technical Specifications

1 Scope

This document specifies the security function requirements, inherent security requirements, security assurance requirements and testing and evaluation methods of operation and maintenance security management products.

And put forward product grade classification requirements.

This document applies to the design, research and development, production, service, testing and certification of operation and maintenance safety management products.

2 Normative references

GB/T 18336

GB/T 22239-2019

GB/T 25069

GB/T 36626-2018

GB/T 39786-2021

GB/T 39837-2021

GB 42250-2022

3 Terms and definitions

GB/T 18336 (all parts), GB/T 25069 and the following terms and definitions apply to this document.

3.1

Provide a unified identity authentication interface and multiple remote operation and maintenance management methods for operation and maintenance users, and centrally manage assets and their accounts.

A product that authorizes, monitors and audits the operation and maintenance process, and issues alarms and blocks any illegal operations.

3.2

Information assets that are protected by operation and maintenance security management products and are remotely operated and managed through operation and maintenance security management products.

Note. Common operation and maintenance objects include operating systems, database management systems, network equipment, security equipment, etc.

3.3

Users (personnel or automated operation and maintenance tools) who operate, maintain and manage information assets through operation and maintenance security management products.

Note. Operation and maintenance users usually use their accounts as user identification, and the accounts are managed and maintained by operation and maintenance security management products.

3.4

Administrators who manage the operation and maintenance security management product itself.

Note. Authorized administrators include system administrators, security administrators, and audit administrators, and their responsibilities are limited to the management of the operation and maintenance security management product itself.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 35 pages — is available in the English PDF.

Referenced standards

Normative references

GB/T 18336

Editions of GB/T 45409

Edition	Title	Revision	Status
GB/T 45409-2025	Cybersecurity technology - Technical specifications for operation and maintenance security management products	current edition	Current

This page sells the current edition, GB/T 45409-2025. Earlier editions are listed for reference only.

How to Buy GB/T 45409-2025

1Add to cart. Click the "Buy GB/T 45409-2025" button on this page. You can add more standards before checkout.
2Checkout. Enter your email and billing details. Payment is processed securely by Stripe (cards, Apple Pay, Google Pay supported).
3Instant delivery (0–9 sec). Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4Invoice included. A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.