HOME   Cart(0)   Quotation   About-Us Policy PDFs Standard-List
www.ChineseStandard.net Database: 189759 (19 Oct 2025)

GB/T 20986-2023 English PDF

US$519.00 · In stock
Delivery: <= 5 days. True-PDF full-copy in English will be manually translated and delivered via email.
GB/T 20986-2023: Information security technology - Guidelines for category and classification of cybersecurity incidents
Status: Valid
Standard IDContents [version]USDSTEP2[PDF] delivered inStandard Title (Description)StatusPDF
GB/T 20986-2023English519 Add to Cart 5 days [Need to translate] Information security technology - Guidelines for category and classification of cybersecurity incidents Valid GB/T 20986-2023

PDF similar to GB/T 20986-2023


Standard similar to GB/T 20986-2023

GB/T 37470   GB/T 37521.1   GB/T 37230   GB/T 35624   GB/T 33744   

Basic data

Standard ID GB/T 20986-2023 (GB/T20986-2023)
Description (Translated English) Information security technology - Guidelines for category and classification of cybersecurity incidents
Sector / Industry National Standard (Recommended)
Classification of Chinese Standard A90
Classification of International Standard 35.030
Word Count Estimation 25,232
Date of Issue 2023-05-23
Date of Implementation 2023-12-01
Older Standard (superseded by this standard) GB/Z 20986-2007
Issuing agency(ies) State Administration for Market Regulation, China National Standardization Administration

GB/T 20986-2023: Information security technology - Guidelines for category and classification of cybersecurity incidents


---This is a DRAFT version for illustration, not a final translation. Full copy of true-PDF in English version (including equations, symbols, images, flow-chart, tables, and figures etc.) will be manually/carefully translated upon your order.
ICS 35:030 CCSA90 National Standards of People's Republic of China Replacing GB /Z 20986-2007 Information Security Technology Guidelines for Classifying and Grading Network Security Incidents Released on 2023-05-23 2023-12-01 implementation State Administration for Market Regulation Released by the National Standardization Management Committee

table of contents

Preface III Introduction V 1 Scope 1 2 Normative references 1 3 Terms and Definitions 1 4 Abbreviations 2 5 Classification of network security incidents 2 5:1 Classification method 2 5:2 Event Category 2 6 Classification of network security incidents6 6:1 Grading method 6 6:2 Event Level 7 6:3 Event classification process 8 Appendix A (Informative) Network Security Event Category and Level Correlation 10 Appendix B (Normative) Network Security Event Classification Code 12 Reference 16 index 17

foreword

This document is in accordance with the provisions of GB/T 1:1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting: This document replaces GB /Z 20986-2007 "Guidelines for Classification and Grading of Information Security Technology Information Security Incidents", and GB /Z 20986- Compared with:2007, except for structural adjustment and editorial changes, the main technical changes are as follows: a) Changed from the guiding technical document GB /Z to the recommended national standard GB/T ; b) Changed the expression of "scope" (see Chapter 1, Chapter 1 of the:2007 edition); c) In "Terms and Definitions", the definition of "information system" was changed (see 3:1, 2:1 of the:2007 edition), and "data, network security Security and network security incidents" (see 3:1~3:4); d) Changed the "Abbreviation", deleted the content of the original abbreviation (see Chapter 3 of the:2007 edition), and added a new abbreviation "APT, BGP, DDOS, DNS, IP, WLAN” etc: (see Chapter 4); e) In "Classification of Network Security Events", the expression of "Classification Method" has been changed, and the classification of network security events has been increased from 7 categories to Class 10 (see 5:1, 4:1 of the:2007 edition): 1) In the "malicious program event", 3 events of "malicious code host site event, ransomware event, and mining virus event" were added event subclasses (see 5:2:1, 4:2:1 of the:2007 edition); 2) Added "backdoor implantation events, credential attack events, web page tampering events, dark link implantation events" in "cyber attack events" events, domain name hijacking events, domain name transfer events, DNS pollution events, WLAN hijacking events, traffic hijacking events, BGP Hijacking attack event, broadcast fraud event, lost host event, supply chain attack event, APT event" 14 event sub- class (see 5:2:2, 4:2:2 of the:2007 edition); 3) Change the name of "Information Destruction Event" to "Data Security Event", and change the event subcategory to "Data Tampering Event, Data Fake Event" Incidents of fraud, data leaks, data theft, data loss", added "social engineering incidents, data interception event, location detection event, data poisoning event, data abuse event, and privacy violation event” (see 5:2:3, 4:2:3 of the:2007 edition); 4) In "Information Content Security Incidents", the number of incident subcategories has been increased from 4 to 8, and the name has been changed to "Reactionary Propaganda Incidents, Violence and Terrorism Incidents" Publicity incidents, pornography incidents, false information dissemination incidents, rights infringement incidents, information spamming incidents, network fraud incidents documents and other information content security incidents” (see 5:2:4, 4:2:4 of the:2007 edition); 5) In "Equipment and Facility Failure Events", the number of event subcategories is increased from 4 to 5, and the name is changed to "Technical Failure Events, Supporting Facility failure events, physical damage events, radiation interference events, and other equipment and facility failure events" (see 5:2:5,:2007 version 4:2:5); 6) Added the category of "violation operation events", including "authority abuse events, authorization forgery events, behavior denial events, intentional violations Operation events, misoperation events, personnel usability damage events, unauthorized resource use events, copyright violation events, etc: Operation violation event" 9 event subcategories (see 5:2:6); 7) The category of "potential security incidents" has been added, including "network vulnerability incidents, network configuration compliance defect incidents, and other potential security incidents": Event" 3 event subclasses (see 5:2:7); 8) Added "abnormal behavior events" category, including "abnormal access events, traffic abnormal events and other abnormal behavior events" 3 event subclasses (see 5:2:8); 9) Change "catastrophic event" to "force majeure event", including "natural disaster event, accident disaster event, public health event events, social security events, and other force majeure events" (see 5:2:9, 4:2:6 of the:2007 edition); f) In "Classification of Network Security Events", change "Information System" to "Event Affected Objects": 1) Changed the expression of "grading method" (see 6:1, 5:1 of the:2007 edition); 2) Added descriptions of 3 important levels of "Event Affected Objects" (see 6:1:2); 3) Change "system loss" to "business loss", and "system critical data" to "important data/sensitive personal information Information" (see 6:1:3, 5:1:3 of the:2007 edition); 4) Change "Social Impact" to "Social Harm" (see 6:1:4, 5:1:4 of the:2007 edition); 5) Changed the expression of "event level" (see 6:2:1~6:2:5, 5:2 of the:2007 edition); 6) Added "event grading process" (see 6:3); g) In order to facilitate applications such as information reporting, event research and judgment, "Appendix B" is added, and event classification codes are given: Please note that some contents of this document may refer to patents: The issuing agency of this document assumes no responsibility for identifying patents: This document is proposed and managed by the National Information Security Standardization Technical Committee (SAC/TC260): This document was drafted by: Beijing Times Newway Information Technology Co:, Ltd:, Institute of Software, Chinese Academy of Sciences, China Three Gorges Corporation Co:, Ltd:, Hangzhou Anheng Information Technology Co:, Ltd:, Beijing Tianrongxin Network Security Technology Co:, Ltd:, Venustech Information Technology Group Co:, Ltd:, Shaanxi Provincial Network and Information Security Evaluation Center, Beijing Dongfangtong Network Communication Technology Co:, Ltd:, Beijing Shenzhou Green League Technology Co:, Ltd: Co:, Ltd:, State Grid Smart Grid Research Institute Co:, Ltd:, China Software Evaluation Center, China Information Security Evaluation Center, the Third Research Institute of the Ministry of Public Security Institute, National Computer Network Emergency Technology Coordination Center, China Southern Power Grid Digital Grid Research Institute Co:, Ltd:, OPPO Guangdong Mobile Communications Ltd: The main drafters of this document: Wang Lianqiang, Wang Xinjie, Guo Qiquan, Huang Xiaosu, Yang Yuzhong, Yan Ruotong, Yu Zhengchen, Ren Juanjuan, Xia Yu, Ren Bin, Lian Yifeng, Zhang Haixia, Huang Kezhen, Li Yangzhao, Li Qi, Liang Wei, Yang Jian, Liu Shupeng, Wei Yufeng, Cui Tingting, Li Wenjin, Zhang Daojuan, Li Jing, Shang Ke, Qu Jie, Guo Jing, Zuo Xiaodong, Wang Jian, Wang Xiaopu, Yu Guoping, He Yu, Wang Yuanrong, Lu Ming, Gao Qi, Zhu Jianxing: The release status of previous versions of this document and the documents it replaces are as follows: ---It was first released as GB /Z 20986-2007 in:2007; --- This is the first revision:

Introduction

The prevention and disposal of network security incidents is an important link in the national network security system, and it is also an important work content: network The classification and grading of security incidents is one of the foundations for quickly and effectively handling network security incidents: The purpose of this document is to: a) Facilitate the collection and analysis of security incident data; b) facilitate the identification of the severity of security incidents; c) facilitate the exchange and sharing of security incident information; d) facilitate automated reporting and response to security incidents; e) Improve the efficiency and effectiveness of security incident notification and emergency response: In Appendix A, the relationship between security event classification and security event classification is given: Information Security Technology Guidelines for Classifying and Grading Network Security Incidents

1 Scope

This document describes the classification and grading methods of network security incidents, defines the categories and levels of network security incidents, and specifies the network security Full event classification code: This document is applicable to network operators and relevant departments to carry out research and judgment of network security incidents, information notification, monitoring and early warning and emergency response, etc: Activity:

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text: Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document: GB/T 22240-2020 Information Security Technology Network Security Classified Protection Grading Guide GB/T 25069-2022 Information Security Technical Terminology

3 Terms and Definitions

The following terms and definitions defined in GB/T 25069-2022 apply to this document: 3:1 information system information system A collection of applications, services, information technology assets, or other information processing components: Note: Information systems are usually composed of computers or other information terminals and related equipment, and carry out information processing or processing according to certain application objectives and rules: program control: [Source: GB/T 25069-2022, 3:696, modified] 3:2 data data Any record of information, electronic or otherwise: 3:3 cybersecuritycybersecurity By taking necessary measures to prevent attacks, intrusions, interference, destruction, illegal use and accidents on the network, the network is in a stable state: Determine the state of reliable operation, and the ability to ensure data integrity, confidentiality, and availability: [Source: GB/T 22239-2019, 3:1] 3:4 The network and Events in which an information system or its data and business applications cause harm and negatively impact the country, society, and economy:

Tips & Frequently Asked Questions:

Question 1: How long will the true-PDF of GB/T 20986-2023_English be delivered?

Answer: Upon your order, we will start to translate GB/T 20986-2023_English as soon as possible, and keep you informed of the progress. The lead time is typically 3 ~ 5 working days. The lengthier the document the longer the lead time.

Question 2: Can I share the purchased PDF of GB/T 20986-2023_English with my colleagues?

Answer: Yes. The purchased PDF of GB/T 20986-2023_English will be deemed to be sold to your employer/organization who actually pays for it, including your colleagues and your employer's intranet.

Question 3: Does the price include tax/VAT?

Answer: Yes. Our tax invoice, downloaded/delivered in 9 seconds, includes all tax/VAT and complies with 100+ countries' tax regulations (tax exempted in 100+ countries) -- See Avoidance of Double Taxation Agreements (DTAs): List of DTAs signed between Singapore and 100+ countries

Question 4: Do you accept my currency other than USD?

Answer: Yes. If you need your currency to be printed on the invoice, please write an email to [email protected]. In 2 working-hours, we will create a special link for you to pay in any currencies. Otherwise, follow the normal steps: Add to Cart -- Checkout -- Select your currency to pay.