T/TSIA 005-2019 Active

Scope: This standard applies to service organizations engaged in the cybersecurity industry, including cybersecurity threat assessment agencies, cybersecurity detection and monitoring agencies, and related organizations providing cybersecurity engineering services. Organizations and institutions such as the software and information technology service industry, the Internet industry, enterprises, public institutions, and social groups may also follow this management standard when conducting cybersecurity activities. The relevant work is carried out under the leadership of cybersecurity regulatory authorities and industry organizations. Main technical content: 1. Requirements for the management norms of third-party cybersecurity service organizations are a comprehensive evaluation and recognition of the management system, technical capabilities, and quality assurance capabilities of cybersecurity service organizations during the implementation of cybersecurity engineering projects. The recognition of the capabilities and directions of third-party cybersecurity service organizations is based on the specific requirements of national laws and regulations and national standards in the "Normative Reference Documents". After comprehensively evaluating the basic qualifications, technical capabilities, cybersecurity service capabilities, and organizational management levels of the applicant organizations, the evaluation and recognition institutions will grant corresponding capability qualification certifications. Cybersecurity service organizations are specifically divided into three directions: cybersecurity consulting, cybersecurity threat assessment, and cybersecurity engineering. 2. Supervision and review: Supervision and review units and industry organizations shall carry out supervision and review guidance work for cybersecurity service organizations every year. During the supervision and review process, penalties such as warnings, rectification within a specified peri