This book introduces the China Cybersecurity Classified Protection System CCPS, covering its development, interpretation of the Cybersecurity Law of the People’s Republic of China, the underlying standards, and procedures in practice such as cybersecurity system classification level determination, registration, development and improvement, evaluation, supervision and inspection.
In this book, we analyze the implementation and practice of cybersecurity protection in China, and provide an interpretation of the existing cybersecurity related laws, regulations and standards. The purpose of this book is to serve the training and implementation needs of foreign organizations, including companies along the Belt and Road Initiatives, in establishing their cybersecurity protection in line with the requirements of China Cybersecurity Classified Protection System.
關於作者：
Mr. Guo Qiquan，chief engineer and vice director at the Cybersecurity Protection Bureau of the Ministry of Public Security, P. R. China. Mr. Wang Xinjie, general manager of Beijing Powertime Co., Ltd. He has been engaged in network and information security since 1999 and has specialized in in information security management systems consulting and auditing, information system auditing, information security risk management and business continuity management. Since 2002, he has been engaged in the Chinese mirror committee to ISOIEC JTC1SC27, SACTC 260. As a member of TC 260 has been involved in the development of many Chinese information security national standards. He has been actively involved in the work of SC27WG1 since 2007, and he is currently the member of the SC27AG01Management Advisory Group. During this time, he has taken part in all of the working group meetings of WG1 including many of the SC27 Plenary meetings, giving him a broader management perspective of the sub-committee and its technical work. His technical work in WG1 has included the work on the ISOIEC 27000 family of standards, such ISOIEC 27001, ISOIEC 27002 and ISOIEC 27005. In 2007, he was the co-editor of ISOIEC 27007. He established and currently runs the China authorized agency of ISC2, and is also a member of RAISE Regional Asia Information Security Exchange Forum
目錄：
Table of Contents
Part Ⅰ Interpretation of Cybersecurity Classified
Protection System of China 1
Chapter 1 Development of China Cybersecurity Classified Protection System 2
1.1 Establishment of Computer Information Systems Security Protection System 2
1.2 Establishment of Information Security Classified Protection System 3
1.3 Establishment of Cybersecurity Classified Protection System 5
Chapter 2 Interpretation of the Cybersecurity Law 6
2.1 Cybersecurity Obligations and Primary Tasks 6
2.2 Division of Responsibilities and Related Obligations 12
2.3 National Cybersecurity Classified Protection System 14
2.4 Basic Responsibilities and Obligations of Network Operators 15
2.5 Operation Security of Critical Information Infrastructure 19
2.6 Network Data and Information Security 25
2.7 Monitoring, Early Warning, and Emergency Response 28
2.8 Acts Prohibited and Legal Responsibility 32
Chapter 3 Interpretation of Cybersecurity Classified Protection System of China 47
3.1 Policies on Cybersecurity Classified Protection 47
3.1.1 General Policy Documents 47
3.1.2 Policy Document of Classified Protection Specific Stages 48
3.2 Basic Concept of Cybersecurity Classified Protection 50
3.2.1 Legal Basis for Carrying Out Cybersecurity Classified Protection 50
3.2.2 Policy Basis for Carrying Out Cybersecurity Classified Protection 51
3.2.3 What is Cybersecurity Classified Protection 54
3.2.4 Division and Supervision of Security Protection Levels 56
3.2.5 Critical Information Infrastructure Protection 58
3.3 Main Contents of the Cybersecurity Classified Protection System 59
3.3.1 Organization Structure of Cybersecurity Classified Protection 59
3.3.2 Main Stages and Basic Requirements of Classified Protection 61
3.3.3 Security Management of Evaluation 65
3.3.4 Network Products and Security Service Requirements 66
Table of Contents
Interpretation and Implementation of Cybersecurity Classified Protection System in China
viii
3.3.5 Monitoring, Early Warning and Information Reporting 66
3.3.6 Data Security Protection 68
3.3.7 Emergency Disposal Requirements 68
3.3.8 Evaluation Requirements 69
3.3.9 Risk Control of New Technology and New Application 69
3.3.10 Supervision and Administration of Cybersecurity Classified Protection Practices 69
Chapter 4 Interpretation of Cybersecurity Classified Protection Standards of China 72
4.1 Cybersecurity Classified Protection Standards Framework 72
4.2 Relationship between Relevant Standards and Different Stages of Classified Protection 73
4.2.1 Basic Standards 73
4.2.2 Classification 73
4.2.3 Security Requirements 74
4.2.4 Methodology and Guidance 75
4.2.5 Status Analysis 76
4.3 Issues Need Attentions for the Application of Relevant Standards 77
4.4 Brief Description of Main Standards on Cybersecurity Classified Protection 77
4.4.1 Classified Criteria for Security Protection of Computer Information System
GB 17859—1999 78
4.4.2 Implementation Guide for Classified Protection of Cybersecurity GBT 25058—2019 78
4.4.3 Testing and Evaluation Process Guide for Classified Protection of Cybersecurity
GBT 28449—2018 79
Part Ⅱ Implementation of Cybersecurity Classified Protection
System of China 81
Chapter 5 Classification of Cybersecurity Classified Protection 82
5.1 Classification of Security Protection Levels 82
5.1.1 Principle of Classification 82
5.1.2 Security Protection Levels of Network 82
5.1.3 Classification Factors of Cybersecurity Protection Level 83
5.1.4 Protection and Supervision of the Five Levels 84
5.2 Procedures of Classification 84
5.2.1 Determine the Classification Object 85
5.2.2 Determine the Security Protection Level of Network 87
5.2.3 Expert Reviews of Cybersecurity Protection Level 88
5.2.4 Examination of Cybersecurity Protection Level 88
5.2.5 Public Security Authorities Examine the Security Protection Level of Network 89
Table of Contents
ix
5.3 How to Determine the Security Protection Level of Network 89
5.3.1 How to Understand the Five Security Protection Levels of Network 89
5.3.2 General Process of Network Classification 90
Chapter 6 Registration of Cybersecurity Classified Protection 92
6.1 Registration and Acceptance 92
6.2 Public Security Authorities Accept Network Registration 94
6.3 Treatment for Inaccurate Level and Non-registration 95
6.4 Public Security Authorities’ Guidance on Network Classification and Registration 95
Chapter 7 Development and Improvement of Cybersecurity Classified Protection 96
7.1 Objective and Content 96
7.1.1 Objective 96
7.1.2 Scope and Characteristics 96
7.1.3 Contents 97
7.1.4 Cybersecurity Protection Capability Objective 99
7.2 Methods and Processes 101
7.2.1 Methods 101
7.2.2 Processes 102
7.3 Security Management System Development 103
7.3.1 Implementing Cybersecurity Responsibility System 103
7.3.2 Cybersecurity Management Status Analysis 103
7.3.3 Formulating Security Management Strategy and System 104
7.3.4 Conducting Security Management Measures 104
7.3.5 Security Self-Inspection and Adjustment 107
7.4 Security Technology Measures Development 107
7.4.1 Security Protection Technology Status Analysis of Network 107
7.4.2 Designing of Cybersecurity Technology Development and Improvement Plan 108
7.4.3 Implementation and Management of Security Development and Improvement Engineering 110
7.4.4 Elements of Cybersecurity Development and Improvement Plan 111
7.5 Selection and Use of Information Security Products 112
7.5.1 Selecting the Information Security Products Licensed for Sale 112
7.5.2 Multilevel Testing and Use of Products 112
7.5.3 Issues Related to Information Security Products Used in Networks at or Above Level Ⅲ 113
7.5.4 Issues Related to the Commercial Cryptography Products Used in Networks at
or above Level Ⅲ 114
7.6 Selecting the Development Service Organization of Cybersecurity Classified Protection 115
Chapter 8 Level Evaluation of Cybersecurity Classified Protection 117
8.1 Overview of Level Evaluation 117
Interpretation and Implementation of Cybersecurity Classified Protection System in China
x
8.1.1 Basic Connotation of Level Evaluation 117
8.1.2 Goals of Level Evaluation 118
8.1.3 When Should We Carry Out Level Evaluation 118
8.1.4 Business Scope of Level Evaluation Organizations 119
8.1.5 Standards of Level Evaluation 119
8.1.6 Development of Level Evaluation Business 120
8.1.7 Notes on the Application of Level Evaluation Standards 123
8.2 Management and Supervision of Level Evaluation Organizations and Personnel 123
8.2.1 Why Need to Develop the Level Evaluation System 123
8.2.2 Management of Evaluation Organizations and Personnel 124
8.2.3 Business Scope and Work Requirements of Evaluation Organizations 125
8.3 Risk Control of Level Evaluation 125
8.3.1 Existing Risks 125
8.3.2 Risk Aversion 126
8.4 Evaluation Reports 127
Chapter 9 Supervision and Inspection of Cybersecurity Classified Protection 128
9.1 Regular Self-Inspection and Supervision 128
9.1.1 Regular Self-inspection of Registration Organizations 128
9.1.2 Supervision and Inspection of Industry Competent Departments 128
9.2 Supervision and Inspection of Public Security Authorities 129
9.2.1 Principles and Methods 129
9.2.2 Main Contents of Inspection 129
9.2.3 Inspection and Improvement Requirements 130
9.2.4 Inspection Requirements 130
9.2.5 Incidents Investigation 131
9.3 Supervision and Management of Network Service Organizations 131
Part Ⅲ Appendices 133
Appendix A Cybersecurity Law of the People’s Republic of China 134
Appendix B The Cryptography Law of the People’s Republic of China 150
Appendix C Regulations of the People’s Republic of China on the Protection of Computer
Information System Security 159
Appendix D Administration Measures for Information Security Classified Protection 163
Appendix E Regulations for the Cybersecurity Classified Protection 176
Appendix F Specifications on Information Security Classified Protection Inspection of
Public Security Authorities Trial 194
Table of Contents
xi
Appendix G Administration Measures for Cybersecurity Classified Protection
Evaluation Organizations 200
Appendix H Interpretation of Classification Guide for Classified Protection of
Cybersecurity GBT 22240—2020 211
Appendix I Interpretation of Baseline for Classified Protection of Cybersecurity
GBT 22239—2019 218
Appendix J Interpretation of Technical Requirements of Security Design for
Classified Protection of Cybersecurity GBT 25070—2019 235
Appendix K Interpretation of Evaluation Requirement for Classified Protection of
Cybersecurity GBT 28448—2019 259
Glossary of Classified Protection Terms 265
購物車/收銀台(0) | 在線留言板
| 付款方式
| 運費計算
| 聯絡我們
| 幫助中心 |
加入書簽
HOME
新書上架
