標(biāo)準(zhǔn)編號:	GB/T 32914-2023
中文名稱:	信息安全技術(shù) 網(wǎng)絡(luò)安全服務(wù)能力要求
英文名稱:	Information security technology —Capability requirements of cybersecurity service
中標(biāo)分類:	L80    數(shù)據(jù)加密
行業(yè)分類:	GB    國家標(biāo)準(zhǔn)
發(fā)布機(jī)構(gòu):	國家市場監(jiān)督管理總局 國家標(biāo)準(zhǔn)化管理委員會
發(fā)布日期:	2023-9-7
實(shí)施日期:	2024-4-1
標(biāo)準(zhǔn)狀態(tài):	to be valid
替代舊標(biāo)準(zhǔn):	GB/T 32914-2016 信息安全技術(shù) 信息安全服務(wù)提供方管理要求
翻譯語言:	英文
文件格式:	PDF
中文字符數(shù):	16000 字
翻譯價格(元):	1120.0
交付時間:	付款后 1~3 個工作日

Information security technology – Capability requirements of cybersecurity service 1 Scope This document specifies the capability requirements of cybersecurity service, including general requirements and enhancement requirements. This document is applicable when it is used to guide cybersecurity service providers to carry out cybersecurity services and evaluate the capability level of cybersecurity service providers, and it can also provide reference for cybersecurity service acquirers to choose cybersecurity service providers. Note: The cybersecurity services mentioned in this document exclude the cybersecurity services involving state secrets. 2 Normative references The following documents contain requirements which, through reference in this text, constitute provisions of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. GB/T 20984 Information security technology - Risk assessment method for information security GB/T 22080 Information technology - Security techniques - Information security management systems - Requirements GB/T 25069 Information security technology - Glossary GB/T36959 Information security technology 0 Capability requirements and evaluation specification for assessment organization of classified protection of cybersecurity GB/T 39204-2022 Information security technology - Cybersecurity requirements for critical information infrastructure protection GB/T 42446 Information security technology - Basic requirements for competence of cybersecurity workforce GB/T 42461 Information security technology - Guidelines for cyber security service cost measurement Emergency Plan for Network Security Incidents of the People’s Republic of China (Publicized by Order No.4 [2017] of the Office of the Central Leading Group for Cyberspace Affairs on January 10, 2017). Regulations on the management of network product security vulnerabilities (Publicized by Order No.66 [2021] of the Ministry of Public Security, National Internet Information Office of the Ministry of Industry and Information Technology on July 12, 2021) Catalogue of key network equipment and special products for network security (first batch) (Publicized by Order No.01 [2017] of the Certification and Accreditation Administration, Ministry of Public Security, National Internet Information Office of the Ministry of Industry and Information Technology on June 1, 2017) 3 Terms and definitions For the purposes of this document, the terms and definitions given in GB/T 25069 and the following apply. 3.1 cybersecurity service service that ensures network operation security and network information security according to the service agreement and based on the resources of service personnel, technology, tools, management and funds Note 1: Common cybersecurity services include detection and evaluation, security operation and maintenance, security consultation, etc. Note 2: Cybersecurity services are usually carried out in the form of service items of both the seller and the buyer. Note 3: Assessment of classified protection of cybersecurity and security evaluation of commercial password application belong to specific types of detection and evaluation services. 3.2 cybersecurity service provider an organization that provides cybersecurity services (3.1) Note: It is called as "service provider” for short. 3.3 cybersecurity service acquirer an organization or individual that obtains external cybersecurity services (3.1) to meet network security needs and achieve its own business goals Note: It is called as "service acquirer" for short. 4 Overall requirements 4.1 The cybersecurity service provider shall meet the requirements of Clause 5 when providing cybersecurity services to the cybersecurity service acquirer. Cybersecurity service providers shall also meet the requirements of Clause 6 when providing cybersecurity services to service acquirers with higher requirements (such as party and government organs, key information infrastructure operators, etc.) for cybersecurity services. 4.2 The requirements for assessment organization of classified protection of cybersecurity shall comply with the provisions of GB/T36959. 4.3 The requirements of the security evaluation organization of commercial password application shall comply with the relevant laws, regulations and standards of national password management.

Foreword i 1 Scope 2 Normative references 3 Terms and definitions 4 Overall requirements 5 General requirements 5.1 Basic conditions 5.2 Organizational management 5.3 Project management 5.4 Supply chain management 5.5 Technical capability 5.6 Service tools 5.7 Remote services 5.8 Legal safeguards 5.9 Data security protection 5.10 Service sustainability 5.11 Special requirements for testing and evaluation services 5.12 Special requirements for security operation and maintenance services 6 Enhancement requirements 6.1 Basic conditions 6.2 Organizational management 6.3 Supply chain management 6.4 Technical capability 6.6 Service tools 6.6 Data security protection 6.7 Service sustainability 6.8 Special requirements for security operation and maintenance services Annex A (Informative) Types of common tools used in cybersecurity service Bibliography

前言 本文件按照GB/T 1.1- -2020(標(biāo)準(zhǔn)化工作導(dǎo)則 第 1部分:標(biāo)準(zhǔn)化文件的結(jié)構(gòu)和起草規(guī)則)的規(guī)定起草。 本文件代替GB/T 32914-2016 《信息安全技術(shù)信息安全服務(wù) 提供方管理要求》，與GB/T 32914- -2016相比,除結(jié)構(gòu)調(diào)整和編輯性改動外,主要技術(shù)變化如下: a) 將術(shù)語“信息安全服務(wù)”更改為“網(wǎng)絡(luò)安全服務(wù)" ,并更改了定義(見3.1,2016年版的3.1); b) 增加了總體要求(見第4章); . c) 將第5章、第6章內(nèi)容更改并合并為“第5章一般要求"(見第5章,2016年版的第5章、第6章); d)增加了“供應(yīng)鏈管理”要求(見 5.4); e) 增加了“遠(yuǎn)程服務(wù)”要求(見5.7); f) 增加了“法律保障”要求(見5.8); g) 增加了“數(shù)據(jù)安全保護(hù)”要求(見5.9); h)增加了“服務(wù) 可持續(xù)性”要求(見5.10); i) 增加了“檢測評估服務(wù)專項要求”內(nèi)容(見5.11); j) 增加了“安全運(yùn)維服務(wù)專項要求”內(nèi)容(見5.12); k) 增加了“增強(qiáng)要求”內(nèi)容(見第6章); I) 增加了“網(wǎng)絡(luò)安全服務(wù)使用的常見工具類型”內(nèi)容(見附錄A)。 請注意本文件的某些內(nèi)容可能涉及專利。本文件的發(fā)布機(jī)構(gòu)不承擔(dān)識別專利的責(zé)任。 本文件由全國信息安全標(biāo)準(zhǔn)化技術(shù)委員會(SAC/TC260)提出并歸口。 本文件及其所代替文件的歷次版本發(fā)布情況為: 2016年首次發(fā)布為GB/T 32914- 2016; 本次為第一次修訂 信息安全技術(shù)網(wǎng)絡(luò)安全服務(wù) 能力要求 1范圍 本文件規(guī)定了網(wǎng)絡(luò)安全服務(wù)的能力要求,包括-般要求和增強(qiáng)要求。 本文件適用于指導(dǎo)網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)開展網(wǎng)絡(luò)安全服務(wù),以及評價網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)的能力水平,也可為網(wǎng)絡(luò)安全服務(wù)需求方選擇網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)時提供參考。 注:本文件所述網(wǎng)絡(luò)安全服務(wù)不含涉及國家秘密的網(wǎng)絡(luò)安全服務(wù). 2 規(guī)范性引用文件 下列文件中的內(nèi)容通過文中的規(guī)范性引用而構(gòu)成本文件必不可少的條款。其中,注日期的引用文件,僅該日期對應(yīng)的版本適用于本文件;不注日期的引用文件,其最新版本(包括所有的修改單)適用于本文件。 GB/T 20984 信息安全技術(shù)信息安全風(fēng)險評估方法 GB/T 22080 信息技術(shù) 安全技術(shù)信息安全管理體系 要求 GB/T 25069 信息安全技術(shù) 術(shù)語 GB/T36959 信息安全技術(shù)網(wǎng)絡(luò)安全等級保護(hù)測評機(jī)構(gòu)能力要求和評估規(guī)范 GB/T 39204- 2022 信息安全技術(shù) 關(guān)鍵信息基礎(chǔ)設(shè)施安全保護(hù)要求 GB/T 42446 信息安全技術(shù)網(wǎng)絡(luò)安全從業(yè)人 員能力基本要求 GB/T 42461 信息安全技術(shù) 網(wǎng)絡(luò)安 全服務(wù)成本度量指南 國家網(wǎng)絡(luò)安全事件應(yīng)急預(yù)案(2017年1月10日中央網(wǎng)絡(luò)安全和信息化領(lǐng)導(dǎo)小組辦公室(2017)4號公布) 網(wǎng)絡(luò)產(chǎn)品安全漏洞管理規(guī)定(2021年7月12日工業(yè)和信息化部國家互聯(lián)網(wǎng)信息辦公室公安部[2021]66號公布) 網(wǎng)絡(luò)關(guān)鍵設(shè)備和網(wǎng)絡(luò)安全專用產(chǎn)品目錄(第一批)(2017年6月1日國家互聯(lián)網(wǎng)信息辦公室工業(yè)和信息化部公安部國家認(rèn)證認(rèn)可監(jiān)督管理委員會[2017]01號公布) 3 術(shù)語和定義 GB/T 25069界定的以及下列術(shù)語和定義適用于本文件。 3.1 網(wǎng)絡(luò)安全服務(wù)cybersecurity service 根據(jù)服務(wù)協(xié)議,基于服務(wù)人員、技術(shù).工具、管理和資金等資源,提供保障網(wǎng)絡(luò)運(yùn)行安全.網(wǎng)絡(luò)信息安全等服務(wù)的相關(guān)過程。 注1:常見的網(wǎng)絡(luò)安全服務(wù)包括檢測評估.安全運(yùn)維和安全咨詢等。. 注2:網(wǎng)絡(luò)安全服務(wù)通常以供需雙方的服務(wù)項目形式進(jìn)行。 注3;網(wǎng)絡(luò)安全等級保護(hù)測評、商用密碼應(yīng)用安全性評估屬于檢測評估服務(wù)中的特定類別服務(wù)。 3.2 網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)cybersecurity service provider 提供網(wǎng)絡(luò)安全服務(wù)(3.1)的組織。 注:簡稱"服務(wù)機(jī)構(gòu)". 3.3 網(wǎng)絡(luò)安全服務(wù)需求方cybersecurity service acquirer 獲取外部所提供的網(wǎng)絡(luò)安全服務(wù)(3.1),以滿足網(wǎng)絡(luò)安全需求,實(shí)現(xiàn)自身業(yè)務(wù)目標(biāo)的組織或個人。 注:簡稱“服務(wù)需求方"。 4 總體要求 4.1網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)向網(wǎng)絡(luò)安全服務(wù)需求方提供網(wǎng)絡(luò)安全服務(wù),應(yīng)滿足第5章的要求。網(wǎng)絡(luò)安全服務(wù)機(jī)構(gòu)向?qū)W(wǎng)絡(luò)安全服務(wù)有更高要求的服務(wù)需求方(如黨政機(jī)關(guān).關(guān)鍵信息基礎(chǔ)設(shè)施運(yùn)營者等)提供網(wǎng)絡(luò)安全服務(wù)時,還應(yīng)滿足第6章的要求。 4.2網(wǎng)絡(luò)安全等級保護(hù)測評機(jī)構(gòu)的要求應(yīng)符合GB/T36959的規(guī)定. 4.3商用密碼應(yīng)用安全性評估機(jī)構(gòu)的要求應(yīng)符合國家密碼管理有關(guān)法律法規(guī)和標(biāo)準(zhǔn)規(guī)范的規(guī)定.