GB/T 45406-2025 Security technical requirements for critical network devices -Programmable logic controller (PLC)
1 Scope
This document specifies the security functional requirements and security assurance requirements for programmable logic controllers (PLCs) designated as critical network devices.
This document is applicable to the research and development, testing, and other work concerning PLCs designated as critical network devices.
Note: Critical network devices refer to devices whose performance indicators or specifications fall within the scope specified in the Catalogue of critical network devices and specialized cybersecurity products.
2 Normative references
The following documents contain provisions which, through reference in this text, constitute provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
GB/T 25069-2022 Information security techniques - Terminology
GB 40050-2021 Critical network devices security common requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in GB/T 25069-2022 and the following apply.
3.1
programmable logic controller; PLC
digitally operating electronic system, designed for industrial control, which uses a programmable memory for the internal storage of user-oriented instructions for implementing specific functions such as logic, sequencing, timing, counting and arithmetic, to control, through digital or analogue inputs and outputs (I/O), various types of machines or processes
[Source: GB/T 15969.1-2007, 3.5, modified]
Contents
Foreword II
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviations
5 General
6 Security functional requirements
6.1 General requirements
6.2 Device identification
6.3 Redundancy, backup recovery and anomaly testing
6.4 Vulnerability and malicious program prevention
6.5 Pre-installed software startup and update
6.6 User identification and authentication
6.7 Access control
6.8 Log audit
6.9 Communication
6.10 Data
7 Security assurance requirements
7.1 General requirements
7.2 Supply chain
7.3 Design and development
7.4 Production and delivery
7.5 User data protection
Bibliography
GB/T 45406-2025 Security technical requirements for critical network devices -Programmable logic controller (PLC)
1 Scope
This document specifies the security functional requirements and security assurance requirements for programmable logic controllers (PLCs) designated as critical network devices.
This document is applicable to the research and development, testing, and other work concerning PLCs designated as critical network devices.
Note: Critical network devices refer to devices whose performance indicators or specifications fall within the scope specified in the Catalogue of critical network devices and specialized cybersecurity products.
2 Normative references
The following documents contain provisions which, through reference in this text, constitute provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
GB/T 25069-2022 Information security techniques - Terminology
GB 40050-2021 Critical network devices security common requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in GB/T 25069-2022 and the following apply.
3.1
programmable logic controller; PLC
digitally operating electronic system, designed for industrial control, which uses a programmable memory for the internal storage of user-oriented instructions for implementing specific functions such as logic, sequencing, timing, counting and arithmetic, to control, through digital or analogue inputs and outputs (I/O), various types of machines or processes
[Source: GB/T 15969.1-2007, 3.5, modified]
Contents of GB/T 45406-2025
Contents
Foreword II
1 Scope
2 Normative references
3 Terms and definitions
4 Abbreviations
5 General
6 Security functional requirements
6.1 General requirements
6.2 Device identification
6.3 Redundancy, backup recovery and anomaly testing
6.4 Vulnerability and malicious program prevention
6.5 Pre-installed software startup and update
6.6 User identification and authentication
6.7 Access control
6.8 Log audit
6.9 Communication
6.10 Data
7 Security assurance requirements
7.1 General requirements
7.2 Supply chain
7.3 Design and development
7.4 Production and delivery
7.5 User data protection
Bibliography
