| Standard ID | Contents [version] | USD | STEP2 | [PDF] delivered in | Standard Title (Description) | Status | PDF |
| GA/T 483-2004 | English | RFQ |
ASK
|
6 days [Need to translate]
|
Engineering management requirement in computer information system classified security protection
| Obsolete |
GA/T 483-2004
|
PDF similar to GA/T 483-2004
Basic data | Standard ID | GA/T 483-2004 (GA/T483-2004) | | Description (Translated English) | Engineering management requirement in computer information system classified security protection | | Sector / Industry | Public Security (Police) Industry Standard (Recommended) | | Classification of Chinese Standard | A90 | | Classification of International Standard | 35.020 | | Word Count Estimation | 35,317 | | Date of Issue | 2004-03-29 | | Date of Implementation | 2004-03-29 | | Quoted Standard | GB 17859-1999; GA/T 390-2002; GA/T 391-2002 | | Summary | This standard specifies the requirements for the management of computer information system security engineering (hereinafter referred to as information security engineering), and is the guiding document for the implementation of security engineering by Party A, Party B and the third parties involved in the information security project. Based on the establishment of safety project safety engineering management system. This standard is divided according to GB 17859-1999 five security levels, provides for different security levels of computer information systems for project implementation using different security requirements. This standard is in accordance with the requirements of GB 17859-1999 five security levels for information security, computer information system development and integration of project management, security services and security engineering organizations can also refer to the use of organizations. This standard applies to safety systems | GA/T 483-2004: Engineering management requirement in computer information system classified security protection
---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order.
Engineering management requirement in computer information system
ICS 35.020
A90
People's Republic of China Public Safety Industry Standard
Computer information system security level protection
Engineering management requirements
Released on.2004-03-29
Implementation of.2004-03-29
Ministry of Public Security
Content
Foreword III
Introduction IV
1 Scope 1
2 Normative references 1
3 Terms and Definitions 1
4 Safety Engineering System 2
4.1 Overview 2
4.2 Safety Engineering Objective 3
4.3 Basic Model 3
5 Qualification Assurance Requirements 3
5.1 System Integration Qualification Requirements 3
5.2 Personnel qualification requirements 3
5.3 Third Party Service Requirements 3
5.4 Safety Product Requirements 4
5.5 Project Supervision Requirements 4
5.6 Password Management Requirements 4
5.7 Other requirements 4
6 Organizational Security Requirements 4
6.1 Defining the system engineering process of the organization 4
6.2 Improving the system engineering process of the organization 4
6.3 Management Series Product Evolution 5
6.4 Management System Engineering Support Environment 5
6.5 Training 6
6.6 Coordination with suppliers 6
7 Project Implementation Requirements 7
7.1 Management Security Control 7
7.2 Assessment Impact 7
7.3 Assessing security risks 8
7.4 Assessing threats 8
7.5 Assessing vulnerability 9
7.6 Establishing assurance arguments 9
7.7 Coordination Security 10
7.8 Monitoring security posture 11
7.9 Providing secure input 11
7.10 Specifying security requirements 12
7.11 Verifying and verifying security 13
8 Project implementation requirements 13
8.1 Summary 13
8.2 Quality Assurance 13
8.3 Management Configuration 14
8.4 Managing Project Risks 15
8.5 Monitoring technical activities 15
8.6 Planned Technical Activities 16
9 Requirements for engineering management classification 17
9.1 Level 1 17
9.2 Second level 18
9.3 Third level 20
9.4 fourth level 22
9.5 Level 5 23
9.6 Security protection level division security function requirements comparison table 24
Appendix A (informative) Level requirements comparison table 25
Reference 30
Foreword
GB 17859-1999 "Computer Information System Security Protection Level Division Guidelines" is the information security level of China's computer information system
The important criteria for management were released on September 13,.1999. In order to promote the safe and orderly management of computer information system security level
Developed and developed a series of related standards, including.
--- Computer information system security level protection technical requirements series of standards;
--- Computer Information System Security Level Protection Evaluation Criteria Series Standards;
--- Computer information system security level protection project management requirements;
--- Computer information system security level protection management requirements.
This standard is one of the above related series of standards.
A comparison of the level requirements is given in Appendix A of this standard.
Appendix A of this standard is an informative annex.
This standard was proposed by the Public Information Network Security Supervision Bureau of the Ministry of Public Security.
This standard is under the jurisdiction of the Information System Security Standardization Technical Committee of the Ministry of Public Security.
This standard was drafted. Public Information Network Security Supervision Bureau of the Ministry of Public Security, the 30th Research Institute of China Electronics Technology Group, Shanghai Sanwei
Information Security Co., Ltd.
The main drafters of this standard. Zhang Jianjun, Wei Zhong, Ye Ming, Chen Kejun, Qing Yu, Wu Xiaoxing.
Introduction
The information system security level protection project referred to in this standard refers to the computer according to GB 17859-1999 and its related supporting standards.
Requirements for information system security level management, new construction and expansion of information network systems, information application systems and information resource development projects
upgrade.
This standard is not only a guide for the implementation of computer information system security level protection engineering, but also the implementation of computer information system security.
The basis of the grade protection project and the establishment of the project implementation guarantee system, and also the corresponding national competent authority for computer information system security workers.
The basis for the grade review. This standard can be used as a reference for the construction of safety protection projects by Party A, Party B and third parties.
Basis and reference for laws, regulations, and standards related to the quality of safety protection projects.
Computer information system security level protection
Engineering management requirements
1 Scope
This standard specifies the requirements for the management of computer information system security engineering (hereinafter referred to as information security engineering), which is for information security engineering.
The guiding documents for the implementation of safety engineering by Party A, Party B and third parties involved in the project, the parties can establish the safety of the safety project based on this.
Engineering management system.
This standard specifies five computer protection letters for different security protection levels according to the five security protection levels divided by GB 17859-1999.
The system implements different safety requirements for project implementation.
This standard applies to the computer information system related to information security in accordance with the requirements of the five security protection levels of GB 17859-1999.
System development and integrated engineering management can also be used for organizations that provide security services and security engineering organizations.
This standard applies to engineering management of institutions and developers of security systems, integrators, providers of security services, and organizations of security engineering.
The merchant can also refer to the use.
2 Normative references
The terms in the following documents become the terms of this standard by reference to this standard. All dated references, followed by all
Modifications (not including errata content) or revisions do not apply to this standard, however, parties to agreements based on this standard are encouraged to study
Is it possible to use the latest version of these files? For undated references, the latest edition applies to this standard.
GB 17859-1999 Computer Information System Security Protection Level Division Guidelines
GA/T 390-2002 Computer Information System Security Level Protection General Technical Requirements
GA/T 391-2002 Computer Information System Security Level Protection Management Requirements
3 Terms and definitions
The following terms and definitions apply to this standard.
3.1
Confidentiality, integrity and availability of information.
3.2
The investor (or owner) of the information system security project represents the demand side of the information system security engineering construction.
3.3
Entity that undertakes the construction of information system security engineering, through its own efforts, builds information system security engineering to meet the information system construction
Security needs.
3.4
An organization or institution that is independent of both Party A and Party B.
3.5
|