| | |
Notice of the Ministry of Public Security, the State Secrecy Bureau, the State Cipher Code Administration and the Information Office of the State Council on Issuing the Administrative Measures for the Graded Protection of Information Security
(No.43 [2007])
The public security departments (bureaus), the secrecy bureaus, the state cipher code bureaus (the offices of the State Cipher Code Regulatory Commission) and the leading group offices of informatization of all provinces, autonomous regions and municipalities directly under the Central Government; the public security bureau, the secrecy bureau, the state cipher code bureau and the leading group office of informatization of Sinkiang Production and Construction Corp.; the secrecy committee offices, the leading group offices of cipher code work and the leading group offices of informatization of all departments under the Central Committee of the Party and all ministries and commissions under the State Council; the secrecy committee offices of all mass organizations:
In order to advance the graded protection of information security, regulate the administration of the graded protection of information security, improve the ability to guard information security, maintain national security, social stability and public interests and safeguard and enhance the informatization process, the Ministry of Public Security, the State Secrecy Bureau, the State Cipher Code Administration and the Information Office of the State Council formulated the Administrative Measures for the Graded Protection of Information Security, which are hereby printed and distributed to you for your earnest implementation.
Ministry of Public Security
State Secrecy Bureau
State Cipher Code Administration
Information Office of the State Council
June 22nd, 2007
Administrative Measures for the Graded Protection of Information Security
| | 公安部、国家保密局、国家密码管理局、国务院信息工作办公室关于印发《信息安全等级保护管理办法》的通知
(公通字[2007]43号)
各省、自治区、直辖市公安厅（局）、保密局、国家密码管理局（国家密码管理委员会办公室）、信息化领导小组办公室，新疆生产建设兵团公安局、保密局、国家密码管理局、信息化领导小组办公室，中央和国家机关各部委保密委员会办公室、密码工作领导小组办公室、信息化领导小组办公室，各人民团体保密委员会办公室：
为加快推进信息安全等级保护，规范信息安全等级保护管理，提高信息安全保障能力和水平，维护国家安全、社会稳定和公共利益，保障和促进信息化建设，公安部、国家保密局、国家密码管理局、国务院信息化工作办公室制定了《信息安全等级保护管理办法》。现印发给你们，请认真贯彻执行。
公安部
国家保密局
国家密码管理局
国务院信息工作办公室
二〇〇七年六月二十二日
信息安全等级保护管理办法
|
Chapter I General Provisions
| | 第一章 总则
|
Article 1 For the purpose of regulating the administration of the graded protection of information security, improving the ability to guard information security, maintaining national security, social stability and public interests and safeguarding and enhancing the informatization process, these Measures are formulated in accordance with the Regulation of the People's Republic of China on Protecting the Safety of Computer Information Systems and other relevant laws and regulations.
| | 第一条 为规范信息安全等级保护管理，提高信息安全保障能力和水平，维护国家安全、社会稳定和公共利益，保障和促进信息化建设，根据《中华人民共和国计算机信息系统安全保护条例》等有关法律法规，制定本办法。
|
Article 2 The state shall, by formulating nationally effective administrative norms and technical standards for the graded protection of information security, organize citizens, legal persons and other organizations to grade information systems and protect their security, and supervise and administer the graded protection work.
| | 第二条 国家通过制定统一的信息安全等级保护管理规范和技术标准，组织公民、法人和其他组织对信息系统分等级实行安全保护，对等级保护工作的实施进行监督、管理。
|
Article 3 The public security organs shall take charge of supervising, examining and guiding the graded protection of information security. The state secrecy departments shall take charge of supervising, examining and guiding the secrecy-related work in the graded protection of information security. The state cipher code departments shall take charge of supervising, examining and guiding the cipher code work concerned in the graded protection of information security. Issues under the jurisdiction of any other functional department shall be subject to the administration of the functional department in accordance with the relevant state laws and regulations. The information office of the State Council and the administrative organs of the local leading groups of informatization shall take charge of the interdepartmental coordination work as concerned in the graded protection of information security.
| | 第三条 公安机关负责信息安全等级保护工作的监督、检查、指导。国家保密工作部门负责等级保护工作中有关保密工作的监督、检查、指导。国家密码管理部门负责等级保护工作中有关密码工作的监督、检查、指导。涉及其他职能部门管辖范围的事项，由有关职能部门依照国家法律法规的规定进行管理。国务院信息化工作办公室及地方信息化领导小组办事机构负责等级保护工作的部门间协调。
|
Article 4 The competent department of information systems shall regulate, urge, inspect and guide the graded protection of information security of all entities operating and/or using information systems of this industry, this department or this region.
| | 第四条 信息系统主管部门应当依照本办法及相关标准规范，督促、检查、指导本行业、本部门或者本地区信息系统运营、使用单位的信息安全等级保护工作。
|
Article 5 Entities operating and/or using information systems shall perform their obligations and duties of the graded protection of information security pursuant to these Measures and the relevant norms and standards.
| | 第五条 信息系统的运营、使用单位应当依照本办法及其相关标准规范，履行信息安全等级保护的义务和责任。
|
Chapter II Grade Division and Graded Protection
| | 第二章 等级划分与保护
|
Article 6 Graded protection of state information security shall follow the principle of “independently grading and independently protecting”. The security protection grade of an information system shall be determined according to its importance to national security, economic development and social livelihood as well as its damage to national security, economic development, social livelihood and the legitimate rights and interests of citizens, legal persons and other organizations in case of its destroy.
| | 第六条 国家信息安全等级保护坚持自主定级、自主保护的原则。信息系统的安全保护等级应当根据信息系统在国家安全、经济建设、社会生活中的重要程度，信息系统遭到破坏后对国家安全、社会秩序、公共利益以及公民、法人和其他组织的合法权益的危害程度等因素确定。
|
Article 7 Security protection of information systems may be divided into the following five grades:
Grade I: the destroy of a Grade I information system would cause damage to the legitimate rights and interests of citizens, legal persons and other organizations, but would cause no damage to national security, economic development or social livelihood.
Grade II: the destroy of a Grade II information system would cause material damage to the legitimate rights and interests of citizens, legal persons and other organizations or cause damage to social order and public interests, but would not damage national security.
Grade III: the destroy of a Grade III information system would cause material damage to social order and public interests or would cause damage to national security.
Grade IV: the destroy of a Grade IV information system would cause particularly material damage to social order and public interests or would cause material damage to national security.
Grade V: the destroy of a Grade V information system would cause particularly material damage to national security.
| | 第七条 信息系统的安全保护等级分为以下五级：
第一级，信息系统受到破坏后，会对公民、法人和其他组织的合法权益造成损害，但不损害国家安全、社会秩序和公共利益。
第二级，信息系统受到破坏后，会对公民、法人和其他组织的合法权益产生严重损害，或者对社会秩序和公共利益造成损害，但不损害国家安全。
第三级，信息系统受到破坏后，会对社会秩序和公共利益造成严重损害，或者对国家安全造成损害。
第四级，信息系统受到破坏后，会对社会秩序和公共利益造成特别严重损害，或者对国家安全造成严重损害。
第五级，信息系统受到破坏后，会对国家安全造成特别严重损害。
|
Article 8 Entities operating and/or using information systems shall protect information systems pursuant to these Measures and the relevant technical norms, and the state departments in charge of the supervision and administration of information security shall supervise and administer the graded protection work conducted by these entities.
| | 第八条 信息系统运营、使用单位依据本办法和相关技术标准对信息系统进行保护，国家有关信息安全监管部门对其信息安全等级保护工作进行监督管理。
第一级信息系统运营、使用单位应当依据国家有关管理规范和技术标准进行保护。
第二级信息系统运营、使用单位应当依据国家有关管理规范和技术标准进行保护。国家信息安全监管部门对该级信息系统信息安全等级保护工作进行指导。
第三级信息系统运营、使用单位应当依据国家有关管理规范和技术标准进行保护。国家信息安全监管部门对该级信息系统信息安全等级保护工作进行监督、检查。
第四级信息系统运营、使用单位应当依据国家有关管理规范、技术标准和业务专门需求进行保护。国家信息安全监管部门对该级信息系统信息安全等级保护工作进行强制监督、检查。
第五级信息系统运营、使用单位应当依据国家管理规范、技术标准和业务特殊安全需求进行保护。国家指定专门部门对该级信息系统信息安全等级保护工作进行专门监督、检查。
|
Chapter III Implementation and Administration of Graded Protection
| | 第三章 等级保护的实施与管理
|
Article 9 Entities operating and using information systems shall carry out the graded protection work in accordance with the Guide for the Implementation of Graded Protection of Information System Security.
| | 第九条 信息系统运营、使用单位应当按照《信息系统安全等级保护实施指南》具体实施等级保护工作。
|
Article 10 The operator or user of an information system shall determine the security protection grade of the information system pursuant to these Measures and the Guide for the Grading of the Security Protection of Information Systems, and report the grade to the competent department (if any) for examination and approval.
The security protection grade of an information system operating via a unified cross-province or national network shall be determined by the competent department in a unified way.
As for an information system to be determined as Grade IV or above, its operator or user or the competent department shall have it assessed by the expert committee on state information security protection grades.
| | 第十条 信息系统运营、使用单位应当依据本办法和《信息系统安全等级保护定级指南》确定信息系统的安全保护等级。有主管部门的，应当经主管部门审核批准。
跨省或者全国统一联网运行的信息系统可以由主管部门统一确定安全保护等级。
对拟确定为第四级以上信息系统的，运营、使用单位或者主管部门应当请国家信息安全保护等级专家评审委员会评审。
|
Article 11 After the security protection grade of an information system is determined, its operator or user shall, in accordance with the norms for the administration of the graded protection of state information security and the relevant technical standards, use information technology products that conform to the relevant state provisions and satisfy the requirements on the protection grade for the security construction or reconstruction of the information system.
| | 第十一条 信息系统的安全保护等级确定后，运营、使用单位应当按照国家信息安全等级保护管理规范和技术标准，使用符合国家有关规定，满足信息系统安全保护等级需求的信息技术产品，开展信息系统安全建设或者改建工作。
|
Article 12 In the process of construction of an information system, its operator or user shall synchronously construct the information security facilities that satisfy the requirements of the protection grade of the information system pursuant to the technical standards such as the Guideline for the Division of Computer Information System Security Protection Grades (GB17859-1999), the Basic Requirements on the Graded Protection of Information System Security, the Information Security Technology-the General Security Technology Requirements for Information Systems (GB/T20271-2006), the Information Security Technology-the Security Technology Requirements for Network Basis (GB/T20270-2006), the Information Security Technology-the Security Technology Requirements for Operating Systems (GB/T20272-2006), the Information Security Technology-the Security Technology Requirements for Database Management Systems (GB/T20273-2006), the Information Security Technology-the Technical Requirements for Servers, and the Information Security Technology-the Security Technology Requirements for Terminal Computer Systems (GA/T671-2006).
| | 第十二条 在信息系统建设过程中，运营、使用单位应当按照《计算机信息系统安全保护等级划分准则》（GB17859-1999）、《信息系统安全等级保护基本要求》等技术标准，参照《信息安全技术 信息系统通用安全技术要求》（GB/T20271-2006）、《信息安全技术 网络基础安全技术要求》（GB/T20270-2006）、《信息安全技术 操作系统安全技术要求》（GB/T20272-2006）、《信息安全技术 数据库管理系统安全技术要求》（GB/T20273-2006）、《信息安全技术 服务器技术要求》、《信息安全技术 终端计算机系统安全等级技术要求》（GA/T671-2006）等技术标准同步建设符合该等级要求的信息安全设施。
|
Article 13 The operator or user of an information system shall formulate a security management system satisfying the requirements of the protection grade of the information system in accordance with the Information Security Technology-the Requirements for the Security Management of Information Systems (GB/T20269-2006), the Information Security Technology-Information System Safety Engineering Management Requirements (GB/T20282-2006) and the Basic Requirements on the Graded Protection of Information System Security, etc., and put it into practice.
| | 第十三条 运营、使用单位应当参照《信息安全技术 信息系统安全管理要求》（GB/T20269-2006）、《信息安全技术 信息系统安全工程管理要求》（GB/T20282-2006）、《信息系统安全等级保护基本要求》等管理规范，制定并落实符合本系统安全保护等级要求的安全管理制度。
|
Article 14 After an information system is completed, its operator or user or the competent department in charge of it shall choose an evaluation agency which satisfies the conditions prescribed in these Measures to conduct evaluations on the security grade status of the information system on a regular basis pursuant to such technical standards as the Evaluation Requirements on the Graded Protection of Information System Security. At least one evaluation shall be conducted for a Grade III information system every year, at least one evaluation shall be conducted for a Grade IV information system every half year, while a Grade V information system shall be evaluated in light of the special security demands.
．．．．．． | | 第十四条 信息系统建设完成后，运营、使用单位或者其主管部门应当选择符合本办法规定条件的测评机构，依据《信息系统安全等级保护测评要求》等技术标准，定期对信息系统安全等级状况开展等级测评。第三级信息系统应当每年至少进行一次等级测评，第四级信息系统应当每半年至少进行一次等级测评，第五级信息系统应当依据特殊安全需求进行等级测评。
信息系统运营、使用单位及其主管部门应当定期对信息系统安全状况、安全保护制度及措施的落实情况进行自查。第三级信息系统应当每年至少进行一次自查，第四级信息系统应当每半年至少进行一次自查，第五级信息系统应当依据特殊安全需求进行自查。
经测评或者自查，信息系统安全状况未达到安全保护等级要求的，运营、使用单位应当制定方案进行整改。
．．．．．． |
Dear visitor,you are attempting to view a subscription-based section of lawinfochina.com. If you are already a subscriber, please login to enjoy access to our databases . If you are not a subscriber, please subscribe . Should you have any questions, please contact us at:
+86 (10) 8268-9699 or +86 (10) 8266-8266 (ext. 153)
Mobile: +86 133-1157-0713
Fax: +86 (10) 8266-8268
database@chinalawinfo.com
| |
您好：您现在要进入的是北大法律英文网会员专区，如您是我们英文用户可直接 登录，进入会员专区查询您所需要的信息；如您还不是我们 的英文用户，请注册并交纳相应费用成为我们的英文会员 。如有问题请来电咨询；
Tel: +86 (10) 82689699, +86 (10) 82668266 ext. 153
Mobile: +86 13311570713
Fax: +86 (10) 82668268
E-mail: database@chinalawinfo.com
|
| | | |
| | | |