GB/Z 41288-2022Information security techonology - Guidelines of cyber security protection for important industrial control system (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part

1.Structure and Drafting Rules of Standardization Documents" drafted. Please note that some content of this document may be patented. The issuing agency of this document assumes no responsibility for identifying patents. This document is proposed and managed by the National Information Security Standardization Technical Committee (SAC/TC260). This document is drafted by: Global Energy Internet Research Institute Co., Ltd., State Grid Corporation of China, National Information Technology Security Research Center Heart, National Energy Administration, NARI Group Co., Ltd., China Electric Power Research Institute Co., Ltd., China Southern Power Grid Co., Ltd., China Huaneng Group Co., Ltd., China Information Security Evaluation Center, 11th Bureau of the Ministry of Public Security, China Electronics Standardization Institute, China Aerospace Science and Industry Corporation Group Co., Ltd., Machinery Industry Instrumentation Comprehensive Technology and Economic Research Institute, the Third Research Institute of the Ministry of Public Security, National Industrial Information Security Development Research Institute Research Center, Shenyang Institute of Automation, Chinese Academy of Sciences, Shenyang Institute of Computing Technology, Chinese Academy of Sciences, Xuji Group Co., Ltd., China National Railway Group Co., Ltd., China General Nuclear Power Corporation, China Three Gorges Corporation, China National Offshore Oil Corporation Co., Ltd., China Shipbuilding Industry Corporation, State Grid Fujian Electric Power Co., Ltd., Beijing Sifang Relay Automation Co., Ltd., China Railway Research Institute Group Co., Ltd., Dongfang Electronics Co., Ltd., Beijing Hollysys Intelligent Technology Co., Ltd., Zhejiang University, State Grid Corporation of East China Branch, State Grid Jiangxi Electric Power Co., Ltd. Electric Power Research Institute, Beijing Qixingchen Information Security Technology Co., Ltd. Company, Guoneng Zhishen Control Technology Co., Ltd., China Electricity Council Technology Development Service Center, Shanghai Electric Power University, Hangzhou Silan Microelectronics Subsidiary Co., Ltd., Hunan Qilin Xin'an Technology Co., Ltd., Beijing Xinda Explorer Technology Co., Ltd., Qingdao Haier Technology Co., Ltd. Company, Qi Anxin Technology Group Co., Ltd. The main drafters of this document. Xin Yaozhong, Yu Yong, Li Bing, Hu Hongsheng, Xu Haiming, Yisu, Zhu Shishun, Guo Jiancheng, Nan Guilin, Tao Hongzhu, Sun Wei, Tao Wenwei, Guo Sen, Li Jingchun, Guo Qiquan, Liu Xiangang, Li Bin, Zhu Guobang, Zhang Tao, Fan Chunling, Shi Congcong, Li Ming, Guo Qian, Bi Lidong, Wang Yumin, Chen Xuehong, Ma Yue, Yang Weiyong, Gao Kunlun, Deng Zhaoyun, Zhang Xiaojian, Wang Changbao, Yu Pengfei, Ma Xiao, Li Ling, Liang Shouyu, Shang Wenli, Yang Hao, Yin Zhenyu, Cao Wantian, Mao Jiang, Shi Yanping, Zheng Sheng, Zou Lailong, Mao Yunping, Wang Qiang, Ren Yanming, Wang Yong, Wang Wanqi, Zhang Yan, Ci Guoxing, Feng Dongqin, Zhang Liang, Yang Ruxia, Meng Yahui, Zhu Jingling, Liu Sen, Zhu Yiming, Zhao Guanghuan, Chen Songzheng, Liu Wenqing, Xie Dong, Xu Zhifang, Zuo Yingnan. Information Security Technology Guidelines for Network Security Protection of Important Industrial Control Systems

1 Scope

GB/Z 41288-2022 is the Chinese national standard on information security techonology - guidelines of cyber security protection for important industrial control system, in the field of information technology. The /Z suffix marks it as a guiding technical document: it does not prescribe requirements that can be certified against, but sets out the technique, the method or the state of the art that the standards bodies recommend following. It was issued on 9 March 2022 by the State Administration for Market Regulation; Standardization Administration of China. As a guiding technical document it carries no separate date of entry into force: it applies from publication. Classification: ICS 35.030, CCS L80. This page is published from the official record of the standard held by the Chinese standards administration: the identification, the dates, the classification and the issuing body are taken from there. The clause text, the tables and the numeric limits are in the document itself, which is delivered complete in English translation.

2 Security Functional Components

GB/T 20272 Information Security Technology Operating System Security Technical Requirements

GB/T 20984 Information Security Technology Information Security Risk Assessment Specification

GB/T 21028 Information Security Technology Server Security Technical Requirements

GB/T 21050 Information Security Technology Network Switch Security Technical Requirements

GB/T 22239 Basic requirements for classified protection of information security technology network security

GB/T 25068.3 Information Technology Security Technology IT Network Security Part

GB/T 31504 Information Security Technology Authentication and Authorization Digital Identity Information Service Framework Specification

GB/T 32919 Information Security Technology Industrial Control System Security Control Application Guide

GB/T 36323 Basic Requirements for Safety Management of Information Security Technology Industrial Control System

GB/T 36324 Information Security Classification Specification for Information Security Technology Industrial Control System

GB/T 36466 Implementation Guide for Risk Assessment of Information Security Technology Industrial Control System

GB/T 36572 Guidelines for Network Security Protection of Electric Power Monitoring System

GB/T 37092 Information Security Technology Cryptographic Module Security Requirements

GB/T 37962 Information Security Technology Industrial Control System Product Information Security General Evaluation Criteria

GB/T 37980 Information Security Technology Industrial Control System Safety Inspection Guide

3 Internet Communication Security Using Security Gateways Protect

GB/T 25069 Information Security Technical Terminology GB /Z 25320 (all parts) Power system management and its information exchange data and communication security

GB/T 30976.1 Industrial Control System Information Security Part