GY/T 337-2020Guidelines for the Classification of Radio and Television Network Security Level Protection (English PDF)

4.1 Safety protection level

According to the degree of importance of the protection object in national security, economic construction, and social life, and once destroyed or lost function or after data has been tampered with, leaked, lost, or damaged, it will affect national security, social order, public interest, citizens, legal persons, and other organizations.

Factors such as the degree of infringement of the legitimate rights and interests of the people, the level of protection of the objects of protection is divided into the following five levels.

a) At the first level, if the objects of hierarchical protection are damaged, it will damage the legal rights and interests of related citizens, legal persons and other organizations, but Do not endanger national security, social order and public interests;

b) The second level, after the damage of the hierarchical protection object, it will cause serious damage to the lawful rights and interests of related citizens, legal persons and other organizations or particularly serious damage, or harm to social order and public interests, but does not endanger national security;

c) The third level, after the hierarchical protection object is damaged, it will cause serious harm to social order and public interests, or to national security Cause harm

d) At the fourth level, if the objects of hierarchical protection are damaged, they will cause particularly serious harm to social order and public interests, or harm the country.

Safety caused serious harm;

e) The fifth level, the damage to the object of grade protection will cause particularly serious harm to national security.

4.2 Grading elements

4.2.1 Overview of grading elements

The grading elements of graded protection objects include.

a) The object of the infringement;

b) The degree of infringement on the object.

4.2.2 Infringed object

The objects that are infringed when the objects of hierarchical protection are destroyed include the following three aspects.

a) The legitimate rights and interests of citizens, legal persons and other organizations;

b) Social order and public interest;

c) National security.

Violation of the legitimate rights and interests of citizens, legal persons and other organizations refers to the social rights enjoyed by citizens, legal persons and other organizations that are protected by law and interests are harmed.

Matters that violate social order include the following.

-Affect the production order, teaching and research order, medical and health order of state agencies, enterprises, institutions, and social organizations;

-Affect the order of activities in public places and the order of public transportation;

-Affect the life order of the people;

--Other matters affecting social order.

Matters that violate the public interest include the following.

-Influencing members of society to use public facilities;

-Influencing members of society to obtain public data resources;

--Influencing social members to receive public services, etc.;

--Other matters that affect the public interest.

Matters that violate national security include the following.

-Affect the stability of the state power and the integrity of territorial sovereignty and maritime rights and interests;

-Affect national unity, ethnic unity and social stability;

-Affect the national socialist market economic order and cultural strength;

--Other matters affecting national security.

4.2.3 Degree of infringement on the object

The degree of infringement on the object is comprehensively determined by the different external manifestations of the objective aspects. Because the infringement of the object is through the protection of the class object the destruction of the object is realized, so the violation of the object is externally manifested as the destruction of the hierarchical protection object, through the violation method, the consequences of the violation and the violation Describe the degree.

The degree of infringement on the object after the object of hierarchical protection is destroyed is divided into the following three types.

a) cause general damage;

b) cause serious damage;

c) Cause particularly serious damage.

The description of the three levels of infringement is as follows.

a) General damage. job functions are partially affected, business capabilities are reduced, but the performance of main functions is not affected, and there are minor damages.

Legal issues, low property losses, limited social adverse effects, and low damage to other organizations and individuals;

b) Severe damage. work functions are severely affected, business capabilities are significantly reduced and the execution of main functions is severely affected.

Legal issues, high property losses, large-scale social adverse effects, and high damages to other organizations and individuals;

c) Particularly severe damage. work functions are particularly severely affected or incapacitated, business capacity is severely reduced or functions cannot be performed Business, there are extremely serious legal problems, extremely high property losses, large-scale social adverse effects, and other organizations and individuals Causes very high damage.

4.2.4 The relationship between grading elements and safety protection levels See Table 1 for the relationship between grading elements and safety protection levels.

4.3 Rating process

The grading process of grading protection objects is as follows.

a) Determine the grading object;

b) Initially determine the grade;

c) Expert review;

d) Approval by the competent authority;

e) Record and review by public security organs.

The security protection level is preliminarily determined as the second and above level protection object, and its network operator organizes an expert evaluation based on this document.

Review, approval by the competent authority, and record review, and finally determine its safety protection level. The safety protection level is initially determined as the first level protection Target, its network operator can refer to this document to determine the final security protection level on its own, without expert review, approval and preparation by the competent authority Case review.

5.1 Information System

5.1.1 Basic characteristics of the grading object

The information system that is the target of grading should have the following basic characteristics.

a) Have a definite main security responsibility subject;

b) To carry relatively independent business applications;

c) Contain multiple resources that are related to each other.

5.1.2 Cloud computing platform/system

In the cloud computing environment, for units that build public clouds, the business system on the cloud service client side and the cloud computing platform on the cloud service provider side must be separate as a separate grading object, the cloud computing platform/system is divided into different grading objects according to different service modes. Rent public cloud services the business system that it uses running on the cloud computing platform will be graded. Units using private cloud, according to the business system carried the highest level of the private cloud is rated, and the business system running on the private cloud can be independently rated; if the private cloud carries a single business System, and the private cloud and business system are operated and maintained by the same security responsible entity, and can be combined and rated.

5.1.3 Systems using mobile internet technology

The system using mobile internet technology mainly includes characteristic elements such as mobile terminals, mobile applications, and wireless networks.

Establish a grade or grade together with the related business system, and each element is not graded separately.

5.2 Radio and television network facilities

Network facilities such as radio and television transmission networks should be divided into different types according to factors such as the subject of security responsibility, business type, or service area.

The rating object. When the subject of security responsibility is the same, the cross-regional private network can be rated as a whole object; when the subject of security responsibility is not at the same time, it needs to be divided into several grading objects according to the main body of security responsibility and service area.

5.3 Data Resources

Data resources can be graded individually. When the subjects of security responsibility are the same, big data and big data platforms/systems should be defined as a whole object.

Level; when the security responsibility subjects are different, big data and big data platforms/systems should be independently rated.

5.4 Classification of protection objects of radio and television network security levels

According to the actual situation of the radio and television industry, in accordance with the basic characteristics of the grading object, comprehensively consider the responsible unit, business type and industry the importance of services and other factors, the security level protection objects of the radio and television network are classified according to the type of organization and the type of business carried, and should be used Recommendations in Appendix A.

For relatively large network facilities and information systems, in order to reflect the principle of hierarchical protection and optimizing the allocation of information security resources, the it is divided into multiple rating objects. If the responsibility boundaries of the hierarchical protection objects are consistent and the business relevance is relatively large, multiple departments in Appendix A can also be the system is merged into one level protection object for grading.

6.1 Determine the subject of infringement

6.1.1 Objects that are infringed when the rating object is destroyed

The security of grading objects mainly includes business information security and system service security. The security protection level is determined by business information security and system...