GB/T 47692-2026Cybersecurity technology - Incident investigation principles and processes (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is modified to adopt ISO/IEC 27043:2015 "Principles and procedures for investigating information technology security incidents".

The technical differences between this document and ISO/IEC 27043:2015, and the reasons therefor, are as follows.

---Added normative reference to GB/T 25069-2022, and uses the existing definitions of this standard in the "Terms and Definitions" section, using the normative...

The national standard GB/T 29246-2023 replaces ISO/IEC 27000 to adapt to my country's technical requirements;

---The phrase "implementation process of evaluation results" in section 7.13 and other parts of the document has been changed to "improvement process" to enhance readability;

---Changed "Preparation regarding equipment (hardware and software), infrastructure, and personnel" in section 8.5 to "Preparation regarding equipment (hardware and software), policy..." the preparation work now includes a new strategic dimension, covering "preparations in areas such as infrastructure and personnel," making the overall preparation work more comprehensive.

---The fourth paragraph of section 9.4 has been deleted. "Experts and scholars in the field of digital surveys need to design methods applicable to network environments and real-time survey processes." the steps for appropriately acquiring potential digital evidence in scenarios such as cloud computing environments and massive data environments should be aligned with national standards.

---Version 9.5 has been revised to include "using cryptography that complies with national cryptography management requirements" to comply with Chinese laws.

The following editorial changes have been made to this document.

---The wording in Chapter 1 has been revised;

---The charts have been renumbered because the original preface, which included the charts, was removed;

---The abbreviation "DVR" has been removed; this abbreviation is not used in this document.

---The title of Chapter 5, "Digital Surveys," has been changed to "Principles of Digital Surveys" to better reflect the actual content of this chapter;

---The generalized description of international differences in section 5.2 has been revised, such as the possibility that different jurisdictions may have different statutory requirements, depending on the specific circumstances.

Specific laws of a jurisdiction, recommendations to seek legal guidance within a specific jurisdiction, etc., to align with national standards.

---Edited version 6.2 has been modified, changing the sub-procedures that were originally listed line by line in each process into a single paragraph for easier reading and to improve readability.

The sections on "Pre-Event Planning Collection" and "Pre-Event Potential Digital Evidence Storage and Processing" are consistent with Chapter 7, with changes made to "Potential Digital Evidence".

"Digital Evidence Storage" is changed to "Potential Digital Evidence Storage and Preservation," consistent with Chapter 9: The "Potential Digital Evidence" category is added to the Investigation Process section.

"Evidence Acquisition" is consistent with Chapter 10;

---The description of the hierarchical structure of the digital survey process in the last paragraph of 6.2 has been revised and moved to the second paragraph of 6.1 for easier understanding;

---The addition of "class" or "group" after processes such as the preparatory process and the planning process indicates a collection of processes at different levels, for more...

Good regional division into levels makes it easier to understand;

---The section 7.1, "The input information generated by the above four objectives is referred to as the pre-known system input in the remainder of this document," has been deleted.

The wording has been revised in later texts to better suit Chinese expression habits;

---Changed "Laws of a specific jurisdiction" in section 7.4 to "Requirements of national laws and regulations";

---The clause in 7.12 that "this review especially needs to verify compliance with the legal provisions of the specific judicial system and the principles of digital forensics" has been amended to...

"This review especially needs to verify whether it complies with national laws and regulations and the principles of digital forensics."

---Merge paragraphs 3 and 4 of section 8.2;

---Simplify some meaningless statements in sections 8.3, 8.4, and 8.5, and delete the section about the preparatory process for numerical surveys in the second paragraph of section 8.4.

The objective-related content is omitted because it has already been described in section 7.1, and there is obvious repetition.

---The wording regarding different jurisdictions in 10.7 has been revised;

Appendix A (Informative Appendix) has been deleted because its content mainly involved comparisons with other international numerical survey models and was not relevant to this document.

Applicable;

---To align with existing national cybersecurity standards, the standard's name has been changed to "Principles and Processes for Investigating Cybersecurity Technical Incidents".

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Cybersecurity Standardization Technical Committee (SAC/TC260).

1 Scope

This document describes the procedures and principles for incident investigations, including but not limited to unauthorized access, data corruption, system crashes, or corporate information breaches.

Investigations into incidents involving breaches of security, as well as other categories of incidents.

This document is intended to guide organizations in conducting investigations involving digital evidence in various incident investigation scenarios, from pre-incident preparation to...

The various processes involved in concluding the investigation.

Note. This document does not provide a specific description of the principles and procedures for implementing each survey activity.

2 Normative references

The contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 25069-2022 Terminology for Information Security Technologies GB/T 29246-2023 Information Security Technology - Overview and Glossary of Information Security Management Systems (ISO/IEC 27000:2018) IDT)

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022 and GB/T 29246-2023, as well as the following terms and definitions, apply to this document.

Acquisition

is the process of creating a copy of data within a defined set.

Note. The output of the acquisition process is a copy of the potential digital evidence.

[Source. GB/T 25069-2022, 3.257] 3.2 activity A set of cohesive tasks for a given process.

[Source. GB/T 25069-2022, 3.256] 3.3 Analysis the process of evaluating potential digital evidence to assess its relevance to the investigation of the incident.

Note. Potential digital evidence becomes digital evidence when it is determined to be relevant to the event.

[Source. ISO/IEC 27042:2015, 3.1] 3.4 collection the process of collecting information from entities that contain potential digital evidence.

[Source. ISO/IEC 27037:2012, 3.3]