GB/T 47957-2026Security and resilience - Protective security - Guidelines for the development of a security plan for an organization (English PDF)

1 Scope 1

2 Normative References 1

3 Terms and Definitions 1

4 Security Plan 1

5 Components of a Security Plan 2

References 9

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents".

Drafting.

This document is equivalent to ISO 22342:2023 "Safety and resilience protection. guidance for organizations to establish safety plans".

Please note that some content in this document may involve patents. The issuing organization of this document assumes no responsibility for identifying patents.

This document was proposed and is under the jurisdiction of the National Technical Committee on Standardization of Public Security Infrastructure (SAC/TC351).

Introduction

All organizations are committed to managing security risks in their environment to ensure that assets are properly protected, stakeholder interests are protected, and [achievements are made possible].

Personal goals.

Organizations need to establish and maintain a structured security approach.

A security plan aims to protect an organization from security threats by taking all appropriate actions and controls.

Effectively integrate into the existing management system.

Integrating an organization's risk management processes into its security planning model contributes to proper security management. A security plan clarifies obligations and responsibilities.

The allocation of resources and the provision of guidance on the application of control measures enable organizations to be protected from security risks.

Adopting an adaptive and flexible planning approach can provide solutions for unplanned situations. Given the dynamic nature of security threats...

To address unpredictability, this document introduces a planning approach that emphasizes adaptability and flexibility related to technical and human factors.

The purpose of this document is to improve and sustainably protect the essential elements that an organization needs to provide.

Safety and resilience protection Guidelines for establishing a safety plan for an organization

1 Scope

This document provides guidance for organizations on governance, risk management, security control measures, and the process of establishing security plans.

This document is applicable to organizations of all types, sizes, and natures that establish security plans. This document is not applicable to guiding service and operational activities.

2 Normative references the contents of the following documents, through normative references within the text, constitute essential provisions of this document. Dated citations are not included.

For references to documents, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies.

This document.

GB/T 24353-2022 Risk Management Guidelines Note. GB/T 44483-2024 Safety and Resilience Terminology (ISO 22300:2021, MOD) ISO 31000 Risk Management Guidelines Note. GB/T 24353-2022 Guidelines for Risk Management (ISO 31000:2021, IDT) the terms and definitions defined in ISO 22300 and ISO 31000, as well as the following terms and definitions, apply to this document.

Need-to-know

Access to specific information may be required based on business or operational needs, including the process of proactively determining the level of information protection and the access permissions of the subject.

4.Security Plan

Organizations should create, implement, and maintain security plans to enable management activities to be based on security risk analysis and aligned with organizational objectives.

Safety plan should include.

---Based on the characteristics of each organization;

---Based on security strategies and objectives related to threats and vulnerabilities;

---Prior to implementation, it must be reviewed and formally approved by the highest management body;

---Predicting potential long-term security-related events requires incorporating specific procedures, and it is also advisable to predict and establish adaptive structures, from...

And to properly handle such disruptive events.

Organizations can use a single security plan or a comprehensive and holistic security plan supported by multiple more detailed sub-plans.

Note. Due to the size of an organization or the complexity of its operations, a single security plan is not always feasible.