关键信息基础设施保护水平评价指标体系研究  

Study on Evaluation Indicator System of Critical Information Infrastructure Protection Level

作　　者：包莉娜 刘蓓[1] 闫桂勋 文博 袁志千 Bao Lina;Liu Bei;Yan Guixun;Wen Bo;Yuan Zhiqian(Department of Information and Network Security,State Information Center,Beijing 100045)

机构地区：[1]国家信息中心信息与网络安全部

出　　处：《信息安全研究》2019年第6期507-513,共7页Journal of Information Security Research

摘　　要：关键信息基础设施的安全稳定运行关系着国家安全、经济繁荣以及人民福祉,其重要性不言而喻.为了有效衡量我国关键信息基础设施的保护水平,为关键信息基础设施保护工作部门和运营者提供客观衡量标准,有必要设计一套适合我国的关键信息基础设施保护水平评价指标体系.依据我国相关政策和法律法规,总结了关键信息基础设施保护的12类重点要求,并从衡量安全保护措施的有效性和控制风险的能力出发,提出了关键信息基础设施保护水平的四级评价指标体系.在重要行业领域进行的试点结果表明,该指标体系和评价方法具有可操作性和适用性,能够反映我国关键信息基础设施保护的现实状况,并为关键信息基础设施保护工作提供参考.The safe and stable operation of critical information infrastructure (CII) is crucial to the national security, economic prosperity and people s well-being. In order to effectively measure the protection level of China s CII and provide objective measurement standards or work guidelines for the protection departments and operators of CII, it is necessary to design a set of evaluation indicator system for the level of critical information infrastructure protection (CIIP). In accordance with relevant policies, laws and regulations in China, we summarize 12 major requirements of CII, and propose a four-level evaluation indicator system for CIIP based on the effectiveness of safety measures and the ability to control risks. Pilot results in the key fields show that this evaluation indicator system is operable and applicable, which can reflect the current situation of CIIP in China and provide references for the CIIP.

关 键 词：网络安全 关键信息基础设施 关键信息基础设施保护 保护要求 评价指标 

分 类 号：TP309.1[自动化与计算机技术—计算机系统结构] TN915.08[自动化与计算机技术—计算机科学与技术]