Valid

JR/T 0205-2020Distributed database technology financial application specification Disaster recovery requirements (English PDF)

Preview PDF

This is a limited preview

Buy now to download the full PDF (9 pages)

Need quotation for your management?

Get a formal quotation for JR/T 0205-2020 in 30 minutes.

Issued by

People's Bank of China

Level / Type

National · Recommended

Issue date

November 26, 2020

Implementation date

November 26, 2020

Scope

JR/T 0205-2020 (Distributed database technology financial application specification Disaster recovery requirements) is available as an English-translated PDF.

JR/T 0205-2020 — This document specifies the disaster recovery requirements for distributed transaction databases in the financial sector, covering disaster tolerance grading, disaster preparedness technical requirements, and disaster recovery requirements.

Preparation management process. This document is applicable to the research and development, testing, evaluation, application, operation and maintenance and management of distributed transaction databases in the financial field.

Found what you need?

Document preview — JR/T 0205-2020

National Standard of the People's Republic of China

Classification: A 11

Issued by: People's Bank of China

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviations
5 Overview
6 Classification of disaster tolerance
6.1 Risk and business impact analysis
6.2 Classification of disaster tolerance

Foreword

This document starts from the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" grass.

This document was submitted by the People's Bank of China. Please note that some of the contents of this document may involve patents. The issuing agency of this document is not responsible for Don't be responsible for these patents.

This document is under the jurisdiction of the National Financial Standardization Technical Committee (SAC/TC 180).

Introduction

With the transformation and upgrading of the distributed architecture in the financial field, the application of distributed database technology in the financial field has gradually deepened. Distributed for the specification Application of database technology in the financial field, strengthen the technical support of distributed database technology for financial services, and improve the performance of distributed database technology this document is specially prepared for business continuity and information security assurance capabilities.

This document is one of the distributed database technology financial application series standards. The distributed database technology financial application series standards include.

-"Technical Framework of Distributed Database Technology Financial Application Specification";

-"Distributed Database Technology Financial Application Specification Security Technical Requirements";

-"Disaster Recovery Requirements for Distributed Database Technology Financial Application Specification".

Distributed database technology financial application specification disaster recovery requirements

1 Scope

This document specifies the disaster recovery requirements for distributed transaction databases in the financial sector, covering disaster tolerance grading, disaster preparedness technical requirements, and disaster recovery requirements.

Preparation management process.

This document is applicable to the research and development, testing, evaluation, application, operation and maintenance and management of distributed transaction databases in the financial field.

2 Normative references

The contents of the following documents constitute the indispensable clauses of this document through normative references in the text. Among them, dated reference documents, Only the version corresponding to that date is applicable to this document; for undated references, the latest version (including all amendments) is applicable to this document file.

GB/T 20988-2007 Information Security Technology Information System Disaster Recovery Specification GB/T 22240-2008 Information Security Technology Information System Security Level Protection Rating Guidelines GB/T 30146-2013 Public safety business continuity management system requirements JR/T 0044-2008 Banking Industry Information System Disaster Recovery Management Specification JR/T 0203-2020 Distributed database technology financial application specification technical architecture

3 Terms and definitions

The terms and definitions defined by JR/T 0203-2020 and the following are applicable to this document.

Disaster

Due to man-made or natural reasons, the information system is seriously malfunctioning, paralyzed, or its data is severely damaged, so that the information system supports the business Sudden event where the function is suspended or the service level reaches an unacceptable level and lasts for a specific period of time.

[Source. JR/T 0044-2008, 3.2] 3.2 Disaster recovery in order to restore the information system from the non-operational or unacceptable state caused by the disaster to the normal operational state, and to support the Activities and processes designed to restore business functions from an abnormal state caused by a disaster to an acceptable state.

[Source. JR/T 0044-2008, 3.3] 3.3 Disaster recovery capability the ability to use disaster recovery resources and disaster recovery plans to recover and continue operations in a timely manner after a disaster occurs.

Disaster recovery plan Documents that define the tasks, actions, data, and resources required in the disaster recovery process of an information system.

Note. It is used to guide relevant personnel to restore the key business functions supported by the information system within the predetermined disaster recovery target.

[Source. JR/T 0044-2008, 3.14] 3.5 Risk analysis Determine the risks that affect the normal operation of the information system, evaluate the functions that are essential to the unit's business operations, and define the control to reduce potential risks the flow of the means.

Note. Risk analysis often involves the assessment of the probability of occurrence of special events.

[Source. JR/T 0044-2008, 3.6] 3.6 Business impact analysis Analyze business functions and related information system resources, evaluate the impact of specific disasters on each business function, and determine the acceptable level of the information system RTO and RPO goals.

[Source. JR/T 0044-2008, 3.7] 3.7 Business continuity After an interruption event occurs, the organization's ability to continuously deliver products or provide services at a predetermined acceptable level.

[Source. GB/T 30146-2013, 3.3] 3.8 Recovery time objective; RTO After a disaster, the time required for the information system to recover from a standstill.

[Source. JR/T 0044-2008, 3.17] 3.9 Recovery point objective; RPO After a disaster, the data must be restored to the point in time required.

[Source. JR/T 0044-2008, 3.18] 3.10 System availability on the premise that the required external resources are guaranteed, the distributed transaction database is under the specified conditions and at the specified time or time interval the ability to be in a state where the specified functions can be performed within (excluding the planned service interruption time).

Note. Generally, it is measured by the allowable unplanned annual service interruption time and the availability of at least "n nines".

3.11

Production system

The information system that supports the production and operation of the unit under normal circumstances. Including main data, main data processing system and main network.

[Source. JR/T 0044-2008, 3.9] 3.12 Production center the data center where the production system is located.

[Source. JR/T 0044-2008, 3.10] 3.13 Data center in the same city Able to withstand data that is simultaneously affected by disasters such as power supply interruption, flooding, fire, network failure, hardware damage, traffic interruption, etc.

heart.

Note. Generally, the distance from the production center is within tens of kilometers.

3.14

Data center in the different city Data centers that can withstand the simultaneous impact of large-scale regional disasters such as wars, floods, tsunamis, typhoons, and earthquakes.

Note. Generally, the distance from the production center is more than hundreds of kilometers.

3.15

Exercise

Exercises based on disaster recovery plans.

Note. Forms include tabletop exercises, simulation exercises, actual combat exercises, etc.

4 Abbreviations

The following symbols and abbreviations apply to this document.

RPO. Recovery Point Objective RTO. Recovery Time Objective

5 Overview

In recent years, the application of distributed transaction database technology in the financial field has continued to deepen, profoundly affecting and changing the technical architecture, Service models and business processes have also brought new challenges to disaster recovery. Distributed transaction database in disaster recovery impact assessment, key There are many differences between the indicators, technical requirements, and organization and management from the traditional structure, which should be focused on and properly dealt with. To protect the application industry Business continuity, to ensure that the reliability of data meets the requirements of management specifications, and the possible impact of specific business failures or disasters should be evaluated.

According to different disaster recovery levels, determine disaster recovery goals, design and implement corresponding detection mechanisms and recovery methods.

6 Classification of disaster tolerance

6.1 Risk and business impact analysis

Financial institutions should conduct detailed risk analysis on distributed transaction databases based on business continuity goals and business development plans. In the wind in the process of risk analysis, we should focus on defining the objectives and scope of risk analysis according to different business scenarios, using appropriate analysis methods, and Conduct an in-depth analysis of the threats faced to assess the probability of occurrence of various risks and possible losses.

In the application scenario of distributed transaction database in the financial field, risk analysis should focus on the possible introduction of distributed transaction database technology.

The new risks, threats, vulnerabilities and damages that are developed, including but not limited to the following.

a) Unpredictable regional local disasters, such as fires, explosions, power outages in all buildings, and communications in the building where the production center is located Paralyzed and so on.

b) Natural disasters such as severe typhoons, earthquakes, and floods.

c) Information leakage that may be caused by improper access control.

d) Misoperation of system personnel causes unexpected downtime or loss of key data.

e) System interruption caused by performance bottlenecks such as hardware equipment and network.

f) Frequent hacker attacks, virus intrusions, spam, network and system vulnerabilities cause security risks.

g) Issues that may be caused by system failures, upgrades, etc. are sent in groups.

h) Adapt to the ever-changing standards and regulations of the financial industry and the government.

After rigorous risk analysis, the business impact that the risk may cause should be studied and judged. Distributed transaction database in the financial field in the use scenario, when analyzing the business impact, it first needs to be based on regulatory requirements, business nature, business service scope, and data concentration process.

Analysis of business functions based on factors such as business time sensitivity, functional relevance, etc., and on this basis, assess the possible impact of business interruption Response, determine the disaster recovery goals and recovery priorities.

In the application scenario of distributed transaction database in the financial field, the content of business impact analysis should include but not limited to the following aspects.

a) Use a quantitative method to assess the direct or indirect economic loss that may be caused by the interruption of business functions, including.

--direct economic loss.

b) Use non-quantitative methods to assess the possible impact of business function interruption, including.

--social influence.

--Legal influence.

--Credit impact.

--Brand influence.

6.2 Classification of disaster tolerance

According to the relevant requirements of GB/T 20988-2007, GB/T 22240-2008, JR/T 0044-2008, according to the carried business the scope of influence and the degree of harm of system failure or paralysis divide the requirements for disaster tolerance of distributed transaction databases.

Combining the characteristics of the financial field, the impact of the failure or paralysis of the distributed transaction database is divided into 4 levels.

a) Internal auxiliary management. internal management matters that have not directly affected the economic benefits and social reputation of financial institutions.

b) Internal operation management. internal management matters that have a direct impact on the economic benefits and social reputation of financial institutions.

c) Financial rights and interests of citizens, legal persons and other organizations, including.

-Citizens, legal persons and other organizations' property security rights, the right to know, the right to fair transactions, the right to claim compensation in accordance with the law, and the right to information security.

--Other matters that affect the financial rights and interests of citizens, legal persons and other organizations.

d) National financial stability and financial order, including.

--The economic and financial interests of the country in foreign activities.

--Formulation and implementation of national financial policies.

--Precautions against national financial risks.

--National financial management activities.

- Stable operation of most key financial institutions, financial markets and their infrastructure.

--Other matters that affect the country's financial stability and financial order.

The hazard degree of the failure or paralysis of the distributed transaction database is divided into three categories.

a) Smaller impact. Refers to the partial impact of the job function, the reduction of business ability but does not affect the execution of the main function, and the There are lesser legal issues, lower property losses, etc.

b) General impact. refers to the general impact of the job function, the significant decline in business capabilities and the impact of the implementation of the main functions, triggering General legal issues, high property losses, etc.

c) Severe impact. Refers to the work function is severely affected or incapacitated, the business capacity is severely reduced or the function cannot be performed.

OK, there are serious legal issues, etc.

According to the importance of the business system of the distributed transaction database applied to the financial field, the scope of influence of failure or paralysis, and the risk the level of disaster tolerance is divided into 6 levels, as shown in Table 1.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 9 pages — is available in the English PDF.

Referenced standards

Normative references

How to Download JR/T 0205-2020

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.