组织网络安全能力成熟度模型的研究与构建  

Research and Construction of Organizational Cyber Security Capability Maturity Model

作　　者：刘慧晶 陈蔓 敖佳 钟海涛 LIU Huijing;CHEN Man;AO Jia;ZHONG Haitao(China Electronics Technology Cyber Security Co.,Ltd.,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技网络信息安全有限公司,四川成都610041

出　　处：《信息安全与通信保密》2023年第6期99-109,共11页Information Security and Communications Privacy

摘　　要：随着数字化转型的不断深入,网络安全形势日趋严峻。部分党政机关、大型企事业单位等组织将网络安全保障体系建设的重点转向网络安全能力体系的构建。通过对国内外相关能力成熟度模型的基本思想、模型架构、主要内容等的研究分析,构建了一种组织网络安全能力成熟度模型,着重探讨了安全能力要素、安全能力建设过程以及安全能力成熟度等级3个维度的主要内容,并介绍了该模型的使用步骤、使用场景以及当前应用实践情况。该模型可用于组织网络安全能力成熟度评估和指导组织网络安全能力建设。With the deepening of digital transformation,the cyber security situation is becoming increasingly severe.Some party and government organizations,large enterprises and institutions and other organizations have shifted the focus of the construction of the cyber security guarantee system to the construction of the cyber security capability system.Based on the research and analysis of the basic idea,architecture and main content of relevant capability maturity models from domestic and abroad,this paper constructs an organizational cyber security capability maturity model and focuses on the main contents of the three dimensions of the security capability elements,security capability construction process,and security capability maturity level,and finally introduces the use steps,use scenarios,and current application practice of this model.This model can be used to assess the maturity of the cyber security capability and to guide the construction of cyber security capability for organizations.

关 键 词：网络安全能力 成熟度模型 评估 过程域 基本实践 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]