GB/T 30283-2022 English PDFUS$559.00 ยท In stock
Delivery: <= 5 days. True-PDF full-copy in English will be manually translated and delivered via email. GB/T 30283-2022: Information security technology - Information security service - Classification and code Status: Valid GB/T 30283: Historical versions
Basic dataStandard ID: GB/T 30283-2022 (GB/T30283-2022)Description (Translated English): Information security technology - Information security service - Classification and code Sector / Industry: National Standard (Recommended) Classification of Chinese Standard: L80 Word Count Estimation: 28,263 Issuing agency(ies): State Administration for Market Regulation, China National Standardization Administration GB/T 30283-2022: Information security technology - Information security service - Classification and code---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order. ICS 35.030 CCSL80 National Standards of People's Republic of China Replacing GB/T 30283-2013 1 Scope This document describes the classification and codes of information security services, mainly including information security consulting, information security design and development, and information security services. Information security integration, information security operation, information security processing and storage, information security evaluation and certification, and other seven aspects. This document is applicable to information security service providers and information security service demanders, and can also be used as a reference for other relevant parties. 7 Information Security Consulting Services7.1 Information security planning consultation The information security planning consultation is mainly aimed at the security requirements of the demand side information system and its supported business and management. Investment budget, information security status and development trend, based on the use of resources and technology by personnel, put forward security planning objectives of the demand side through the specified process Design and plan content from the two dimensions of management and technology to form a set of guiding documents, systematically guide the information security construction of the demand side, and meet the needs of its customers. The need for sustainable development. Information security planning consulting usually involves multidisciplinary knowledge, engineering practice experience, modern science and management technology, and is Provide support in the development and utilization of information security resources, engineering construction, personnel training, management system construction, technical support, etc. Any service whose main service content is consistent with the above description can be classified into this category. 7.2 Information Security Design Consulting The information security design consultation is mainly aimed at the security protection requirements of the information system. The supplier implements the security plan of the demand side, and designs the overall security develop the information security construction plan and implementation plan, and form the security strategy, security technology system structure, security management The design of the system structure, etc., guides the specific realization of the information security protection of the demand side. Information security design can generally be divided into top-level design, summary design and Different service deliverables such as detailed design. Any service whose main service content is consistent with the above description can be classified into this category. 7.3 Information Security Management System Consulting The information security management system consultation is mainly aimed at the needs of the information security management system of the buyer, and the supplier combines the needs and goals of the buyer, security Security requirements, adopted process, scale and structure, by determining the scope and policy of the information security management system, clarifying responsibilities, authorities and roles, adopting Use the method of risk assessment to plan and implement the construction tasks of the management system, implement internal audit and management review and other processes, and assist the demand side to establish and implement Present, maintain, and continuously improve the information security management system. An information security management system is part of an organization's processes and overall management structure and is Integrated in it, covering the documented information required by the relevant standards, should describe the protected assets, risk management methods, control objectives and control methods, and the degree of assurance required. Any service whose main service content is consistent with the above description can be classified into this category. 7.4 Information Security Engineering Supervision Information security project supervision is mainly aimed at engineering activities involving information security in various information system projects on the demand side. The quality supervision unit (supplier) according to the entrustment of the buyer, in each stage of project construction planning, design, deployment and implementation (tendering, design, implementation, acceptance) Implement control and management, provide relevant suggestions and opinions, and ensure the realization of the supervision objectives and completion of the supervision content at each stage. Information Security Engineering Supervisor Management may also include the supervision of information security services in the information system operation and maintenance phase. Any service whose main service content is consistent with the above description can be classified into this category. 7.5 Information Security Test Evaluation 7.5.1 Information security testing Information security testing is mainly aimed at the security attributes of the tested objects such as information systems, software and hardware products. Next, according to the authorization of the purchaser, according to the workflow of test preparation, test implementation, test analysis, test result feedback, etc., select the applicable method/tool It can dynamically analyze the test data, discover the potential safety hazards of the tested object, and verify the compliance and effectiveness of the security measures of the tested object. Propose security rectification suggestions. Information security testing usually includes information system security testing, APP security testing, vulnerability security scanning, baseline configuration Configuration verification, penetration testing, source code auditing, etc. Information security testing tools should meet the requirements of relevant national standards to ensure reliability and security. Any service whose main service content is consistent with the above description can be classified into this category. 7.5.2 Information Security Risk Assessment Information security risk assessment is mainly aimed at the assessed objects such as business, information system, basic network and platform, and data resources, and shall be determined by the supplier. Determine the work form of risk assessment, and follow the risk assessment process, covering risk assessment preparation, asset identification, threat identification, vulnerability identification, existing Security measures confirmation, risk analysis, risk treatment and other links, to identify, analyze and evaluate the risks faced, formulate and propose risk prevention measures. Risky security policies and corrective measures. Information security risk assessment usually runs through the life cycle stages of planning, design, implementation, operation, and disposal of the assessed object. 7.5.3 Other information security testing and evaluation services Other information security testing and evaluation services that do not belong to the above service subcategories. 7.6 Information Security Training 7.6.1 Information Security Awareness Training Information security awareness training is mainly aimed at all personnel on the demand side, combined with the organization's information security management system, using promotional materials (such as Newsletters, short films, etc.), publicity weeks, online media and other ways to convey basic knowledge about information security and evaluate the training effect To ensure that trainers establish the concept of information security, improve awareness of information security risks, and enhance the sense of responsibility for information security. Information Security Awareness Training Training usually provides a relatively basic training service. Any service whose main service content is consistent with the above description can be classified into this category. 7.6.2 Information Security Basic Training Information security basic training is mainly aimed at technical personnel and managers related to the design, development, implementation and operation and maintenance of information systems on the demand side Instruct staff, adopt case teaching, classroom lectures, etc., to pass on the basic knowledge about information security, and evaluate the training effect to ensure that the training The subjects master the theoretical knowledge and basic skills of information security related to their own work, and perform information security responsibilities. Information Security Basic Training Pass What is often provided is a customized service based on roles and responsibilities. Any service whose main service content is consistent with the above description can be classified into this category. 7.6.3 Information security professional training Information security professional training is mainly aimed at information security professionals, full-time personnel and senior managers of the demand side. The talent training plan adopts on-the-job training, job training, skills assessment, multi-disciplinary seminars, etc. to teach professional knowledge about information security. knowledge, and evaluate the training effect, to ensure that the trainees have a comprehensive understanding of the information security knowledge system, and master information security professional knowledge and expertise. professional skills and improve the professional quality of information security. Any service whose main service content is consistent with the above description can be classified into this category. 7.6.4 Other information security training services Other information security training services that do not belong to the above service subcategories. 7.7 Other Information Security Consulting Services Other information security consulting services that do not belong to the category of the above services.8 Information Security Design and Development Services8.1 Information security system design The information security system design is mainly aimed at the security needs that the buyer cannot meet by purchasing the existing information security system or products. The supplier shall design the information security system according to the process of demand analysis, outline design and detailed design, which may be proposed in accordance with GB/T 38674-2020 According to the requirements of the general framework for application software security programming, combined with the characteristics of the demand-side application environment, the security protection design requirements are proposed to guide Subsequent information security development (see 8.2). Information security system design generally includes security implementation technical framework design, security function design, performance requirement design, etc. Any service whose main service content is consistent with the above description can be classified into this category. 8.2 Information security development Information security development is mainly aimed at the security needs that the buyer cannot meet by purchasing existing information security systems or products. On the basis of information security system design (see 8.1), according to the confirmation of security requirements, the determination of security baseline requirements, the confirmation of design requirements, the security policy Software security development process development information such as strategy formulation, threat modeling, secure coding specification design, incident response plan formulation, and final security assessment security systems or products, and in accordance with the requirements of GB/T 38674-2020 on the general framework for application software security programming Measures to ensure the security of information security systems or products to meet the specific security requirements of the buyer and minimize the risk of information security system or product safety defects. Information security development can also be based on existing information security systems or products for secondary development. Any service whose main service content is consistent with the above description can be classified into this category. 8.3 Other information security design and development services Other information security design and development services that do not belong to the above services.9 Information security integration service9.1 Information security hardware integration Information security hardware integration is mainly aimed at the information security hardware equipment purchased or leased by the demand side, and the supplier shall integrate the system according to the established system integration. Create a plan (including design plan and implementation plan, etc.), specify the integrated deployment method, and build, install and configure, function debug, and perform according to the deployment environment. Work process specifications such as performance testing can be used to carry out integration and deployment work to ensure the safe interconnection of various subsystems. Information Security Hardware Integration It often covers the processes of information security requirements analysis, planning and design, equipment procurement, integrated deployment, delivery and acceptance, etc. Among them, the integrated deployment environment generally has The following types. deployed in the local computer room of the demand side, deployed in the hosting data center, deployed on the virtual resources of the cloud platform, or a mixed deployment of the previous forms. Any service whose main service content is consistent with the above description can be classified into this category. 9.2 Information security software integration Information security software integration is mainly aimed at information security software and systems (including software components) purchased or leased by the buyer, and the supplier shall The software integration plan (including design plan and implementation plan, etc.) that has been formulated, the deployment and installation method is specified, and the software set is built according to the deployment environment. Implementation (including on-site system development), on-site deployment, evaluation and improvement and other workflow specifications to carry out integrated deployment work to ensure information security software software and systems to achieve safe and efficient applications. Information security software integration usually covers the process of information security requirements analysis, design, implementation and operation, testing and improvement, and acceptance. Any service whose main service content is consistent with the above description can be classified into this category. 9.3 Other information security integration services Other information security integration services that do not belong to the above services. 10 Information security operation service 10.1 Information Security Monitoring Information security monitoring is mainly aimed at monitoring the environment, network, equipment, systems, applications, and information flowing between different regions of the information system. The supplier uses monitoring tools, platforms, or sensing node devices to monitor the information security events and operating status of the monitored objects on-site or remotely. Monitoring and perception of state, vulnerability and threat, so as to detect abnormal situations or behaviors such as threats, alarms and events in a timely manner. Information security monitoring can be Coordinated implementation of information security reporting (see 10.5), emergency response (see 10.7) and investigation and evidence collection (see 10.9). Information security monitoring should usually also implement Realize or improve the monitoring of new network attack behaviors (such as APT attacks). Any service whose main service content is consistent with the above description can be classified into this category. 10.2 Information Security Inspection The information security inspection is mainly aimed at the information security self-inspection requirements of the buyer. The supplier is entrusted by the buyer and combines the security characteristics of the inspection object In accordance with the inspection preparation, inspection implementation, inspection result analysis, inspection report preparation, inspection Through personnel interviews, document review, technical verification, testing and other means to assist the demand side in discovering possible problems Information security issues. Information security inspection is usually implemented in conjunction with information security test assessment (see 7.5) and information security monitoring (see 10.1), and ensure that no additional risks are introduced. Any service whose main service content is consistent with the above description can be classified into this category. Note 1.Information security inspection is divided into supervisory inspection, self-inspection and entrusted inspection. Supervision and inspection refers to the organization of the higher management department or the relevant functional departments of the state according to the inspections carried out by law. Self-inspection refers to the inspection of the information security status of the unit initiated by the information system owner, operation or use unit. Committee Entrusted inspection refers to the inspection carried out by an institution approved by the relevant competent authority if the inspected unit or the organizational department of the supervision and inspection does not have the inspection ability. 10.3 Threat information sharing Threat information sharing is mainly aimed at the demand side who needs and uses network security threat information. Collect large-scale and multi-channel network security threat data, conduct in-depth integration, merging and analysis, and form network security threat information. Manually or automatically processed into structured information, a general model is used to achieve a unified description of network security threat information, and batches are delivered to the required information. In order to realize the rapid transmission of massive network security threat information across organizations, and then support the response to complex network security threats. network security The description of full threat information usually consists of elements such as observable data, attack indicators, security events, attack activities, threat subjects, attack targets, attack methods, and countermeasures. Any service whose main service content is consistent with the above description can be classified into this category. 10.4 Information Security Analysis Information security analysis is mainly aimed at the information system of the demand side. The supplier collects and processes various types of data such as logs, traffic, performance, and vulnerabilities. Using multiple types of professional intelligent analysis engines, AI detection models and information resource libraries to identify security threats such as network attacks, malware, and information leakage threats, and suggest solutions or measures to be taken. Information security analysis can be related to information security reporting (see 10.5), emergency response (see 10.7) and investigation and evidence collection (see 10.9) are i......Tips & Frequently Asked Questions:Question 1: How long will the true-PDF of GB/T 30283-2022_English be delivered?Answer: Upon your order, we will start to translate GB/T 30283-2022_English as soon as possible, and keep you informed of the progress. The lead time is typically 3 ~ 5 working days. The lengthier the document the longer the lead time.Question 2: Can I share the purchased PDF of GB/T 30283-2022_English with my colleagues?Answer: Yes. The purchased PDF of GB/T 30283-2022_English will be deemed to be sold to your employer/organization who actually pays for it, including your colleagues and your employer's intranet.Question 3: Does the price include tax/VAT?Answer: Yes. Our tax invoice, downloaded/delivered in 9 seconds, includes all tax/VAT and complies with 100+ countries' tax regulations (tax exempted in 100+ countries) -- See Avoidance of Double Taxation Agreements (DTAs): List of DTAs signed between Singapore and 100+ countriesQuestion 4: Do you accept my currency other than USD?Answer: Yes. If you need your currency to be printed on the invoice, please write an email to Sales@ChineseStandard.net. In 2 working-hours, we will create a special link for you to pay in any currencies. Otherwise, follow the normal steps: Add to Cart -- Checkout -- Select your currency to pay.Question 5: Should I purchase the latest version GB/T 30283-2022?Answer: Yes. Unless special scenarios such as technical constraints or academic study, you should always prioritize to purchase the latest version GB/T 30283-2022 even if the enforcement date is in future. Complying with the latest version means that, by default, it also complies with all the earlier versions, technically. |
