美国信息系统审计机制研究  

A Research on US Information System Audit

作　　者：孙彦 刘贤刚[1] 蔡磊[1] Sun Yan;Liu Xiangang;Cai Lei(China Electronics Standardization Institute, Beijing 100007)

机构地区：[1]中国电子技术标准化研究院,北京100007

出　　处：《信息安全研究》2017年第12期1108-1114,共7页Journal of Information Security Research

基　　金：国家智能制造专项(京财经一指[2015]1170号);工信部工控安全评估专项(工信软函([2015]366号);工信部电子发展基金工信部财([2014]425号)

摘　　要：《网络安全法》对网络运营者等主体提出了落实网络安全责任,履行网络安全保护义务的要求.信息系统审计作为督促网络安全责任落实的有力手段,能够促进信息系统安全性、可靠性和有效性的改善.目前,我国在信息系统审计领域尚处于起步阶段,各项制度有待完善,应充分了解和学习其他国家的成熟经验.自20世纪60年代末起,美国已经在信息系统审计领域进行探索实践.经过近半个世纪的发展,美国建立了一套较为完善的信息系统审计机制.研究学习美国信息系统审计在组织机构、审计原则、审计流程、审计模式、审计内容、审计成果等方面的做法和经验,对提升我国网络安全防护能力,探索开展适应我国国情的信息系统审计工作具有重要积极的意义.Cybersecurity law raises requirements on network operators to fulfill the cybersecurity responsibility and carry out cybersecurity protection duties.Information system audit,which is a powerful method to supervise the fulfillment of cybersecurity responsibility,can improve the security,reliability and effectiveness of information systems.Information system audit in our country is still in the early stage and corresponding regulations are under development.Considering the current state of information system audit in our country,learning from the successful experience of other countries could be necessary and helpful.Starting from60s of last century,US has begun its explorations in information system audit area.After the development of almost fifty years,US have already built a well-established mechanism.Learning from the advanced experience of US,including organizations,principles,processes,patterns,contents and results of information system audit,will lead to the promotion of information system audit in our country and improvement in cybersecurity protection.

关 键 词：信息系统审计 网络安全责任 审计标准 一般控制 应用控制 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]