GB/T 47324-2026Cybersecurity protection requirements for internet of vehicles platforms (English PDF)

3.1 Internet of vehicles

Complex network and related systems that, through next-generation network communication technologies, achieve deep integration with the automotive, electronics, road traffic and transportation sectors, and achieve comprehensive interconnection and information interaction among vehicles, roads, people, and platforms, thereby enhancing driving safety, transportation efficiency and services, and supporting the development of automated driving.

3.2 Common middleware

A type of software that facilitates interaction among software components and provides connections between system software and application software.

Note: It mainly includes microservice middleware, message middleware, web service middleware, etc.

3.6 Sensitive personal information

Personal information that, once leaked or used illegally, may lead to discrimination against vehicle owners, drivers, passengers, people outside the vehicle, etc., or serious harm to their personal or property safety.

Note: This includes vehicle movement trajectory, audio, video, images and biometric information.

6.1 Physical environment security requirements

6.1.1 Physical location selection

Requirements for physical location selection shall include the following.

a) Requirements for the basic site selection conditions of the computer room shall comply with the provisions for Level 2 specified in GB/T 22239;

b) The computer room shall be located away from areas prone to geological disasters, such as mudslides and landslides;

c) The load-bearing capacity of the computer room shall meet the requirements for the computer room building.

6.1.2 Physical access control

Requirements for physical access control shall include the following.

a) Requirements for the management of computer room entrances and exits shall comply with the provisions for Level 2 specified in GB/T 22239;

b) Visitors requiring access to the computer room shall be subject to an application and approval process, and their activities shall be restricted and monitored.

6.1.3 Protection against theft and vandalism

Requirements for protection against theft and vandalism shall include the following.

a) Requirements for the protection of equipment against theft and vandalism shall comply with the provisions for Level 2 specified in GB/T 22239;

b) Major equipment shall be placed in the computer room;

c) Media shall be classified and labeled, and stored in media or archives rooms;

d) Necessary anti-theft alarm facilities shall be installed in the main computer room.

6.1.4 Lightning protection

Requirements for lightning protection shall include the following.

a) Requirements for lightning protection of various cabinets, facilities and equipment shall comply with the provisions for Level 2 specified in GB/T 22239;

b) The building where the computer room is located shall be equipped with measures for protection against direct lightning strikes, lightning surge intrusion, and lightning induction.

6.1.5 Fire protection

Requirements for fire protection shall include the following.

a) Requirements for fire protection of the computer room and related working rooms and auxiliary rooms shall comply with the provisions for Level 2 specified in GB/T 22239;

b) The computer room shall be equipped with firefighting equipment.

6.1.6 Water and moisture protection

Requirements for water and moisture protection of the windows, roof, walls and interior of the computer room shall comply with the provisions for Level 2 specified in GB/T 22239.

6.1.7 Electrostatic discharge protection

Requirements for electrostatic discharge protection shall include the following.

a) Requirements for electrostatic discharge protection measures in the computer room shall comply with the provisions for Level 2 specified in GB/T 22239;

b) Critical equipment (including network equipment, security equipment, servers storing confidential data, etc.) shall be equipped with necessary grounding and anti-static measures.

6.1.8 Temperature and humidity control

Requirements for temperature and humidity control in the computer room shall comply with the provisions for Level 2 specified in GB/T 22239.

6.1.9 Dust protection

Necessary dust protection measures shall be taken, and shoe covers shall be worn when entering or exiting the computer room.

6.1.10 Power supply

Requirements for power supply shall include the following.

a) Requirements for power supply configuration and overvoltage protection for the computer room shall comply with the provisions for Level 2 specified in GB/T 22239;

b) A short-term backup power supply shall be provided to ensure that at least critical equipment (including network equipment, security equipment, and servers storing confidential data) can continue normal operation in the event of a power outage.

6.1.11 Electromagnetic protection

Requirements for electromagnetic protection shall comply with the provisions for Level 2 specified in GB/T 22239.

6.2 Security management requirements

6.2.1 Security management systems

Requirements for security management systems shall include the following.

a) Security management systems appropriate to the current operational conditions of the internet of vehicles platform operators shall be established, including routine management and operation procedures, emergency response mechanisms, update service procedures;

b) Security management systems shall be formally and effectively issued and shall be subject to version control.

6.2.2 Security management organizations and personnel

6.2.2.1 Requirements for security management organizations

Requirements for security management organizations shall include the following.

a) Requirements for post establishment, personnel allocation, authorization and approval shall comply with the provisions for Level 1 specified in GB/T 22239;

b) Dedicated positions for the internet of vehicles platform, such as system administrator and security administrator, shall be established, and the responsibilities of each position shall be defined;

c) Authorization and approval items, approving departments, and approvers shall be clearly specified according to the responsibilities of each department and position;

d) Approval procedures shall be implemented for routine management operations such as system changes, critical operations, physical access, and system access.

6.2.2.2 Personnel requirements

Personnel requirements shall include the following.

a) Requirements for personnel recruitment, personnel departure, security training, and access by external personnel shall comply with the provisions for Level 1 specified in GB/T 22239;

b) A dedicated internet of vehicles-related department or designated personnel shall be assigned or authorized to be responsible for personnel recruitment;

c) Security awareness education and job skills training shall be provided to all categories of personnel, and they shall be informed of approval procedures for routine management operations, security responsibilities, and disciplinary measures.

6.2.3 Platform security construction management

6.2.3.1 Classification and filing

Classification and filing shall include the following.

a) The internet of vehicles platforms shall be classified and filed in accordance with the relevant requirements of the competent industry authorities, and the protection level of the security protection object shall be clearly defined;

b) The methods and rationale for identifying the object subject to classification of security protection of internet of vehicles and determining its protection level shall be documented in written form or other equivalent forms.

6.2.3.2 Security solution design requirements

Requirements for selecting security measures during security solution design shall comply with the provisions for Level 1 specified in GB/T 22239.

6.2.3.3 Product procurement and use requirements

Requirements for product procurement and use shall comply with the provisions for Level 1 specified in GB/T 22239.

6.2.3.4 In-house software development requirements

Requirements for in-house software development shall include the following.

a) A software development management system shall be established to clearly specify development process control methods and personnel codes of conduct;

b) Secure coding guidelines shall be established, and developers shall be required to develop code in accordance with such guidelines;

c) Security testing shall be conducted during the software development process;

d) Where open-source code is incorporated, its open-source license and code security shall be inspected, tested, and audited.

6.2.3.5 Outsourced software development requirements

For outsourced software development, confidentiality agreements shall be signed with the development organization and its personnel.

6.2.3.6 Engineering implementation requirements

For engineering implementation, a dedicated department or designated personnel shall be assigned or authorized to be responsible for managing the implementation process.

6.2.3.7 Testing and acceptance requirements

Security testing shall be conducted during testing and acceptance. […]