GB/T 20985.2-2020 in English
VALIDInformation technology—Security techniques—Information security incident management—Part 2:Guidelines to plan and prepare for incident response
- Issued on:2020-12-14
- Implemented on:2021-07-01
- File Format:PDF
- Delivery:Via email within 5 business days
$612.00
《GB/T 20985.2-2020信息技术 安全技术 信息安全事件管理 第2部分：事件响应规划和准备指南》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会。
Introduction
Analysis of the core content of the standard
| Management stage | Key elements | Implementation points |
|---|---|---|
| Planning and preparation | Strategy formulation, IRT formation | Need approval from top management, clarify incident classification standards |
| Response implementation | Technical support, process execution | Including electronic evidence preservation and cross-departmental collaboration mechanism |
| Experience summary | Improvement measures, capability assessment | Need to establish a knowledge base and update control measures |
Incident Response Team (IRT) Construction Specifications
Typical role configuration: Must include managers (strategic decision-making), monitoring posts (7×24 duty), response posts (emergency disposal), and analysis posts (tracing investigation). Members should master skills such as network protocol analysis and digital forensics, and standardize information sharing through the TLP protocol.
Technical support system requirements
The standard emphasizes the need to establish a forensics tool chain independent of the production environment, including: log analysis system, terminal forensics equipment, etc., to ensure that electronic evidence meets the requirements of ISO/IEC 27037. The frequency of drills should be at least once a year for the entire process.
Loading PDF document...
Error loading PDF. Please make sure the file is valid and try again.
We also recommend
-
GB/T 45240-2025 in English
General requirements for device-independent quantum random number generators
2025-01-24 -
GB/Z 24294.1-2018 in English
Information security technology—Guide of implementation for internet-basede-government information security—Part 1:General
2018-03-15 -
GB/T 32213-2015 in English
Information security technology―Public key infrastructure―Specification for remote password authentication and key establishment
2015-12-10 -
GB/T 28449-2018 in English
Information security technology-Testing and evaluation process guide for classified protection of cybersecurity
2018-12-28 -
GB/T 15278-1994 in English
Information processing－Data encipherment－Physical layer interoperability requirements
1994-01-02 -
GB/T 29767-2013 in English
Information security techniques—Public key infrastructure—Bridge Certification Authority leveled certificate specification
2013-09-18 -
GB/T 20009-2019 in English
Information security technology—Security evaluation criteria for database management system
2019-08-30 -
GB/T 33131-2016 in English
Information security technology一Specification for IP storage network security based on IPSec
2016-10-13 -
GB/T 15843.1-2017 in English
Information technology―Security techniques―Entity authentication―Part 1:General
2017-12-29 -
GB/T 24363-2009 in English
Information security technology—Specifications of emergency response plan for information security
2009-09-30
