JR/T 0071.4-2020 in English

Standard Framework and Technological Evolution

As the 4th part of the JR/T 0071 series of standards, this document marks the completion of the financial industry's cybersecurity training system's transition from general requirements to special implementation. Compared with the 2012 version, the 2020 version mainly presents three major technical evolution characteristics:

Analysis of core elements

Design of layered training system

The standard innovatively establishes a four-level classification of training targets:

1. Decision-making level (board of directors/senior executives): focus on cultivating network security strategic decision-making capabilities
2. Management position (security supervisor): need to master risk governance framework and emergency response
3. Technical position: requires technical capabilities for implementing graded protection
4. Audit position: focuses on compliance inspection methodology

Implementation suggestions

Key points for preparing a training plan

• Adopt the PDCA cycle to manage the entire training process
• The training time for new technologies such as cloud computing/big data is recommended to account for ≥30%
• The annual training time for key positions should reach 16 hours/year

Innovation in the assessment mechanism

Article 9.4 of the standard clearly establishes a double veto mechanism:

Compliance Implementation Path

Financial institutions are advised to advance in the following stages:

1. Gap analysis (January-February): Conduct current status assessment against Appendix A of the standard
2. System construction (March-June): Establish a three-level training management organizational structure
3. Pilot operation (June-December): Select 2-3 business lines for verification