GB/T 47324-2026Cybersecurity protection requirements for internet of vehicles platforms (English PDF)

6.1 Physical environment security requirements

6.1.1 Physical location selection Requirements for physical location selection shall include the following.

a) Requirements for the basic site selection conditions of the computer room shall comply with the provisions for Level 2 specified in GB/T 22239;

b) The computer room shall be located away from areas prone to geological disasters, such as mudslides and landslides;

c) The load-bearing capacity of the computer room shall meet the requirements for the computer room building.

6.1.2 Physical access control Requirements for physical access control shall include the following.

a) Requirements for the management of computer room entrances and exits shall comply with the provisions for Level 2 specified in GB/T 22239;

b) Visitors requiring access to the computer room shall be subject to an application and approval process, and their activities shall be restricted and monitored.

6.1.3 Protection against theft and vandalism Requirements for protection against theft and vandalism shall include the following.

a) Requirements for the protection of equipment against theft and vandalism shall comply with the provisions for Level 2 specified in GB/T 22239;

b) Major equipment shall be placed in the computer room;

c) Media shall be classified and labeled, and stored in media or archives rooms;

d) Necessary anti-theft alarm facilities shall be installed in the main computer room.

6.1.4 Lightning protection Requirements for lightning protection shall include the following.

a) Requirements for lightning protection of various cabinets, facilities and equipment shall comply with the provisions for Level 2 specified in GB/T 22239;

6.2 Security management requirements

6.2.1 Security management systems Requirements for security management systems shall include the following.

a) Security management systems appropriate to the current operational conditions of the internet of vehicles platform operators shall be established, including routine management and operation procedures, emergency response mechanisms, update service procedures;

b) Security management systems shall be formally and effectively issued and shall be subject to version control.

6.2.2 Security management organizations and personnel

6.2.2.1 Requirements for security management organizations Requirements for security management organizations shall include the following.

a) Requirements for post establishment, personnel allocation, authorization and approval shall comply with the provisions for Level 1 specified in GB/T 22239;

b) Dedicated positions for the internet of vehicles platform, such as system administrator and security administrator, shall be established, and the responsibilities of each position shall be defined;

c) Authorization and approval items, approving departments, and approvers shall be clearly specified according to the responsibilities of each department and position;

d) Approval procedures shall be implemented for routine management operations such as system changes, critical operations, physical access, and system access.

6.2.2.2 Personnel requirements Personnel requirements shall include the following.

a) Requirements for personnel recruitment, personnel departure, security training, and access by external personnel shall comply with the provisions for Level 1 specified in GB/T 22239;

b) A dedicated internet of vehicles-related department or designated personnel shall be assigned or authorized to be responsible for personnel recruitment;

c) Security awareness education and job skills training shall be provided to all categories of personnel, and they shall be informed of approval procedures for routine management operations, security responsibilities, and disciplinary measures.

6.2.3 Platform security construction management

6.2.3.1 Classification and filing Classification and filing shall include the following.

a) The internet of vehicles platforms shall be classified and filed in accordance with the relevant requirements of the competent industry authorities, and the protection level of the security protection object shall be clearly defined;

b) The methods and rationale for identifying the object subject to classification of security protection of internet of vehicles and determining its protection level shall be documented in written form or other equivalent forms.

6.2.3.2 Security solution design requirements Requirements for selecting security measures during security solution design shall comply with the provisions for Level 1 specified in GB/T 22239.

6.2.3.3 Product procurement and use requirements Requirements for product procurement and use shall comply with the provisions for Level 1 specified in GB/T 22239.

6.2.3.4 In-house software development requirements Requirements for in-house software development shall include the following.

a) A software development management system shall be established to clearly specify development process control methods and personnel codes of conduct;

b) Secure coding guidelines shall be established, and developers shall be required to develop code in accordance with such guidelines;

c) Security testing shall be conducted during the software development process;

d) Where open-source code is incorporated, its open-source license and code security shall be inspected, tested, and audited.

6.2.3.5 Outsourced software development requirements For outsourced software development, confidentiality agreements shall be signed with the development organization and its personnel.

6.2.3.6 Engineering implementation requirements For engineering implementation, a dedicated department or designated personnel shall be assigned or authorized to be responsible for managing the implementation process.

6.2.3.7 Testing and acceptance requirements Security testing shall be conducted during testing and acceptance.

Note 1. 2. **Search (Optional).** Enter the keyword '**GB/T 47324-2026**' in the search bar, if it is not already shown. 3.