 |
|
Standard
| GB/T 41400-2022 Information security technology—Information security protection capability maturity model of industrial control systems (English) |
|
|
|
|
|
|
|
|
Detail of GB/T 41400-2022
| Standard No. |
|
| English Name |
|
| Chinese Name |
|
| Chinese Classification |
|
| Professional Classification |
|
| ICS Classification |
|
| Issued by |
|
| Issued on |
|
| Implemented on |
|
| Status |
|
| Superseded by |
|
| Superseded on |
|
| Abolished on |
|
| Superseding |
|
| Language |
|
| File Format |
| Word Count |
| Translation Price(USD) |
|
| Keywords |
|
Introduction of GB/T 41400-2022
本文件给出了工业控制系统信息安全防护能力成熟度模型，规定了核心保护对象安全和通用安全的成熟度等级要求，提出了能力成熟度等级核验方法。本文件适用于工业控制系统设计、建设、运维等相关方进行工业控制系统信息安全防护能力建设，以及对组织工业控制系统信息安全防护能力成熟度等级进行核验。
Contents of GB/T 41400-2022
前言 Foreword v
1 范围 Scope
2 规范性引用文件 Normative references
3 术语和定义 Terms and definitions
4 缩略语 Abbreviations
5 工业控制系统信息安全防护能力成熟度模型 Information security protection capability maturity model of industrial control system
5.1 能力成熟度模型架构 Architecture of capability maturity model
5.2 能力要素维度 Dimensions of capability elements
5.2.1 能力构成 Capability composition
5.2.2 机构建设 Organization building
5.2.3 制度流程 System process
5.2.4 技术工具 Technical tools
5.2.5 人员能力 Personnel ability
5.3 能力成熟度等级维度 Dimension of capability maturity levels
5.4 能力建设过程维度 Dimension of capability building process
5.4.1 PA体系 PA system
5.4.2 编码规则 Encoding rule
5.4.3 关系描述 Relationship description
6 核心保护对象安全 Core protected object security
6.1 工业设备安全 Industrial equipment security
6.1.1 PA01控制设备安全 PA01 control equipment security
6.1.2 PA02现场测控设备安全 PA02 data acquisition and control field device security
6.1.3 PA03设备资产管理 PA03 equipment asset management
6.1.4 PA04存储媒体保护 PA04 storage media protection
6.2 工业主机安全 Industrial host security
6.2.1 PA05专用安全软件 PA05 special security software
6.2.2 PA06漏洞和补丁管理 PA06 vulnerability and patch management
6.2.3 PA07外设接口管理 PA07 peripheral interface management
6.3 工业网络边界安全 Industrial network boundary security
6.3.1 PA08安全区域划分 PA08 secure area division
6.3.2 PA09网络边界防护 PA09 network boundary protection
6.3.3 PA10远程访问安全 PA10 remote access security
6.3.4 PA11身份认证 PA11 identity authentication
6.4 工业控制软件安全 Industrial control software security
6.4.1 PA12安全配置 PA12 security configuration
6.4.2 PA13配置变更 PA13 configuration change
6.4.3 PA14账户管理 PA14 account management
6.4.4 PA15口令保护 PA15 password protection
6.4.5 PA16安全审计 PA16 security audit
6.5 工业数据安全 Industrial data security
6.5.1 PA17数据分类分级管理 PA17 data classification and grading management
6.5.2 PA18差异化防护 PA18 differentiated protection
6.5.3 PA19数据备份与恢复 PA19 data backup and recovery
6.5.4 PA20测试数据保护 PA20 test data protection
7 通用安全 General security
7.1 安全规划与架构 Security planning and architecture
7.1.1 PA21安全策略与规程 PA21 security policies and procedures
7.1.2 PA22安全机构设置 PA22 security authority setup
7.1.3 PA23安全职责划分 PA23 division of security duty
7.2 人员管理与培训 Personnel management and training
7.2.1 PA24人员安全管理 PA24 personnel security management
7.2.2 PA25安全教育培训 PA25 security education and training
7.3 物理与环境安全 Physical and environmental security
7.3.1 PA26物理安全防护 PA26 physical security protection
7.3.2 PA27应急电源 PA27 emergency power source
7.3.3 PA28物理防灾 PA28 physical disaster prevention
7.3.4 PA29环境分离 PA29 environmental separation
7.4 监测预警与应急响应 Monitoring, warning and emergency response
7.4.1 PA30工业资产感知 PA30 industrial asset sensing
7.4.2 PA31风险监测 PA31 risk monitoring
7.4.3 PA32威胁预警 PA32 threat warning
7.4.4 PA33应急预案 PA33 contingency plan
7.4.5 PA34应急演练 PA34 emergency drill
7.5 供应链安全保障 Supply chain security assurance
7.5.1 PA35产品选型 PA35 product selection
7.5.2 PA36供应商选择 PA36 supplier selection
7.5.3 PA37采购交付 PA37 procurement and delivery
7.5.4 PA38合同协议控制 PA38 contract agreement control
7.5.5 PA39源代码审计 PA39 source code audit
7.5.6 PA40升级安全保障 PA40 upgrade security assurance
8 能力成熟度等级核验方法 Verification method of capability maturity levels
8.1 工业设备安全 Industrial equipment security
8.1.1 PA01控制设备安全 PA01 control equipment security
8.1.2 PA02现场测控设备安全 PA02 data acquisition and control field device security
8.1.3 PA03设备资产管理 PA03 equipment asset management
8.1.4 PA04存储媒体保护 PA04 Storage media protection
8.2 工业主机安全 Industrial host security
8.2.1 PA05专用安全软件 PA05 special security software
8.2.2 PA06漏洞和补丁管理 PA06 vulnerability and patch management
8.2.3 PA07外设接口管理 PA07 peripheral interface management
8.3 工业网络边界安全 Industrial network boundary security
8.3.1 PA08安全区域划分 PA08 secure area division
8.3.2 PA09网络边界防护 PA09 network boundary protection
8.3.3 PA10远程访问安全 PA10 remote access security
8.3.4 PA11身份认证 PA11 identity authentication
8.4 工业控制软件安全 Industrial control software security
8.4.1 PA12安全配置 Security configuration
8.4.2 PA13配置变更 PA13 configuration change
8.4.3 PA14账户管理 PA14 account management
8.4.4 PA15口令保护 PA15 password protection
8.4.5 PA16安全审计 PA16 security audit
8.5 工业数据安全 Industrial data security
8.5.1 PA17数据分类分级管理 PA17 data classification and grading management
8.5.2 PA18差异化防护 PA18 differentiated protection
8.5.3 PA19数据备份与恢复 PA19 data backup and recovery
8.5.4 PA20测试数据保护 PA20 test data protection
8.6 安全规划与架构 Security planning and architecture
8.6.1 PA21安全策略与规程 PA21 security policies and procedures
8.6.2 PA22安全机构设置 PA22 security authority setup
8.6.3 PA23安全职责划分 PA23 division of security duties
8.7 人员管理与培训 Personnel management and training
8.7.1 PA24人员安全管理 PA24 personnel security management
8.7.2 PA25安全教育培训 PA25 security education and training
8.8 物理与环境安全 Physical and environmental security
8.8.1 PA26物理安全防护 PA26 physical security protection
8.8.2 PA27应急电源 PA27 emergency power supply
8.8.3 PA28物理防灾 PA28 physical disaster prevention
8.8.4 PA29环境分离 PA29 environmental separation
8.9 监测预警与应急响应 Monitoring, warning and emergency response
8.9.1 PA30工业资产感知 PA30 industrial asset sensing
8.9.2 PA31风险监测 PA31 risk monitoring
8.9.3 PA32威胁预警 PA32 threat warning
8.9.4 PA33应急预案 PA33 contingency plan
8.9.5 PA34应急演练 PA34 emergency drill
8.10 供应链安全保障 Supply chain security assurance
8.10.1 PA35产品选型 PA35 product selection
8.10.2 PA36供应商选择 PA36 supplier selection
8.10.3 PA37采购交付 PA37 procurement and delivery
8.10.4 PA38合同协议控制 PA38 contract agreement control
8.10.5 PA39源代码审计 PA39 source code audit
8.10.6 PA40升级安全保障 PA40 upgrade security assurance
附录A （资料性） 能力成熟度等级描述与GP Annex A (Informative) Capability maturity level description and GP
附录B （资料性） 能力成熟度模型使用方法 Annex B (Informative) Use method of capability maturity model
附录C （资料性） 能力成熟度等级核验流程 Annex C (Informative) Verification process of capability maturity level