GB/T 30276-2020 in English

Standard Evolution and Core Changes

As an upgraded standard of the 2013 version, GB/T30276-2020 has made major adjustments in the terminology system and management process:

Analysis of the entire vulnerability management process

1. Vulnerability discovery and reporting

The standard clearly requires the discoverer to:
• Use legal technical means to verify the authenticity of the vulnerability
• Prohibit affecting the normal operation of the system (e.g. a certain manufacturer’s white hat testing protocol explicitly prohibits DDoS verification)

2. Key points of vulnerability verification

Implementation recommendations

Enterprise compliance framework

It is recommended to establish a three-level response mechanism:
1. Basic level: Establish a standardized receiving channel (such as secure mailbox + PGP encryption)
2. Enhanced level: Connect with vulnerability collection organizations such as CNVD/CNNVD
3. Professional level: Establish a full-time PSIRT team to handle the vulnerability life cycle

Key points of technical implementation

• A compatibility test matrix must be completed before the patch is released>
• A hot fix solution should be provided for high-risk vulnerabilities (such as a cloud vendor mitigating 0day vulnerabilities through traffic cleaning)