GB/T 20274.4-2008 in English

《GB/T 20274.4-2008信息安全技术 信息系统安全保障评估框架 第4部分：工程保障》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会。
ＧＢ／Ｔ２０２７４的本部分建立了信息系统安全工程保障的框架，确立了组织机构启动、实施、维护、评估和改进信息安全工程的指南和通用原则。ＧＢ／Ｔ２０２７４的本部分定义和说明了信息系统安全工程保障工作中反映组织机构信息安全工程保障能力的安全工程能力级，以及提供组织机构信息安全工程保障内容的安全工程保障控制类要求。
ＧＢ／Ｔ２０２７４的本部分适用于启动、实施、维护、评估和改进信息安全工程的组织机构和涉及信息系统安全工程工作的所有用户、开发人员和评估人员。

1 Scope

This part of GB/T 20274 establishes the framework for information system security engineering assurance and the guide & general principle for the organization starting, implementing, maintaining, evaluating and improving information security engineering. This part defines and explains the security engineering capability level that reflects the information security engineering assurance capability of the organization in the information system security engineering assurance work and provides the security engineering assurance control class requirements of the organization's information security engineering assurance contents.
This part of GB/T 20274 is applicable to the organization for starting, implementing, maintaining, evaluating and improving the information security engineering and all the users, developers and evaluation personnel involved in the information system security engineering.

2 Normative References

The following documents contain provisions which, through reference in this text, constitute provisions of this part. For dated reference, subsequent amendments to (excluding any corrigendum), or revisions of, any of these publications do not apply. However, parties to agreements based on this standard are encouraged to investigate the possibility of applying the most recent editions of the standards indicated below. For any undated references, the latest edition of the document referred to applies.
GB/T 20274.1 Information Security Technology - Evaluation Framework for Information Systems Security Assurance - Part 1: Introduction and General Model

3 Terms and Definitions

For the purposes of this part of GB/T 20274, the terms and definitions specified in GB/T 20274.1 and the following ones apply.
3.1.1
Validation
The solution meets the user's operation security requirements.
3.1.2
Verification
The solution meets the security requirements.

4 Structure of This Part

Foreword i
1 Scope
2 Normative References
3 Terms and Definitions
4 Structure of This Part
5 Framework for Information Systems Security Engineering Assurance
5.1 Overview of Information Systems Security Engineering Assurance
5.2 Information Systems Security Engineering Assurance Control
5.3 Information Systems Security Engineering Capability Maturity Level
6 Structure of Information Security Engineering Assurance Control Class
6.1 General
6.2 Structure of Security Engineering Assurance Control Class
6.3 Structure of Security Engineering Assurance Control Subclass
6.4 Structure of Security Engineering Assurance Control Component
7 PRM Security Engineering Assurance Control Class: Process of Risk
7.1 Introduction of Security Engineering Assurance Control Class in Process of Risk
7.2 System Definition (PRM_SDF)
7.3 Assessment of Threat (PRM_ATT)
7.4 Assessment of Vulnerability (PRM_AVL)
7.5 Assessment of Influence (PRM_AIM)
7.6 Assessment of Security Risk (PRM_ASR)
8 PEN Security Engineering Assurance Control Class: Process of Engineering
8.1 Introduction of Security Engineering Assurance Control Class in Process of Engineering
8.2 Identification of Security Requirements (PEN_ISR)
8.3 High-level Security Design (PEN_HSD)
8.4 Detailed Security Design (PEN_DSD)
8.5 Security Engineering Execution (PEN_SEE)
8.6 Provision of Security Input (PEN_PSI)
8.7 Monitoring of Security Posture (PEN_MSP)
8.8 Management of Security Control (PEN_MSC)
8.9 Coordination of Security (PEN_COS)
9 PAS Security Engineering Assurance Control Class: Process of Assurance
9.1 Introduction of Security Engineering Assurance Control Class in Process of Assurance
9.2 Verification and Validation of Security (PAS_VVS)
9.3 Establishment of Assurance Evidence (PAS_EAE)
10 Capability Level of Security Engineering Assurance Control Class
10.1 General
10.2 Description of Security Engineering Capability Levels
10.3 Requirements of Capability Level of Information System Security Engineering
Bibliography
Figure 1 Life Cycle of Security Engineering Process
Figure 2 Structure of Security Engineering Assurance Control Class
Figure 3 Structure of Security Engineering Assurance Control Subclass
Figure 4 Structure of Security Engineering Assurance Control Component
Figure 5 Description of Process of Risk
Figure 6 Structure of Security Engineering Assurance Control Subclass - System Definition (PRM_SDF)
Figure 7 Structure of Security Engineering Assurance Control Subclass – Assessment of Threat (PRM_ATT)
Figure 8 Structure of Security Engineering Assurance Control Subclass - Assessment of Vulnerability (PRM_AVL)
Figure 9 Structure of Security Engineering Assurance Control Subclass – Assessment of Influence (PRM_AIM)
Figure 10 Structure of Security Engineering Assurance Control Subclass – Assessment of Security Risk (PRM_ASR)
Figure 11 Introduction of Security Engineering Assurance Control Class in Process of Engineering
Figure 12 Structure of Security Engineering Assurance Control Subclass – Identification of Security Requirements (PEN_ISR)
Figure 13 Structure of Security Engineering Assurance Control Subclass - High-level Security Design (PEN_HSD)
Figure 14 Structure of Security Engineering Assurance Control Subclass - Detailed Security Design (PEN_DSD)
Figure 15 Structure of Security Engineering Assurance Control Subclass - Security Engineering Execution (PEN_SEE)
Figure 16 Structure of Security Engineering Assurance Control Subclass – Provision of Security Input (PEN_PSI)
Figure 17 Structure of Security Engineering Assurance Control Subclass – Monitoring of Security Posture (PEN_MSP)
Figure 18 Structure of Security Engineering Assurance Control Subclass – Management of Security Control (PEN_MSC)
Figure 19 Structure of Security Engineering Assurance Control Subclass - Coordination of Security (PEN_COS)
Figure 20 Introduction of Security Engineering Assurance Control Class in Process of Assurance
Figure 21 Structure of Security Engineering Assurance Control Subclass - Verification and Validation of Security (PAS_VVS)
Figure 22 Structure of Security Engineering Assurance Control Subclass – Establishment of Assurance Evidence (PAS_EAE)
Figure 23 Required Capability Level of Information Systems Security Engineering
Table 1 Relationship between Security Engineering Life Cycle and Process Domain