T/CSAC 021-2025 Active Group standards

T/CSAC 021-2025 Information and communication technology product supply chain security testing methods

Publish Date: 2025-07-08 Implement Date: 2025-08-08 For services related to genuine standard inquiry, procurement, translation, and other related services in China, please Contact Us

Price: $ 20.00

Out of stock

Basic Information

Standard Code: T/CSAC 021-2025

Standard Type: Group standards

Standard Status: Active

is_force_gb: no

CCS Name: -

ICS Name: Comprehensive Application of Information Technology

Publish Date: 2025-07-08

Implement Date: 2025-08-08

Scope

Scope: This document specifies the technical specifications for security testing of information and communication technology (ICT) product supply chains, including software component security testing, binary software gene security testing, dynamic application security testing, static application security testing, and container image security testing. This document is applicable to technical inspections of ICT product supply chains, and it serves as a reference for network operators when selecting ICT products and conducting security testing. It is also applicable to ICT product providers who wish to mitigate security risks such as open-source components, backdoors, source code vulnerabilities, and security flaws in their products. Main technical content: This standard specifies the technical specifications for security testing of ICT product supply chains, including software component security testing, binary software gene security testing, dynamic application security testing, static application security testing, and container image security testing. Among these, software component security testing is a type of security testing for software that examines the open-source code components used in the software and identifies the versions of the software components used to detect security vulnerabilities, license compliance conflicts, and other risks, while also having the function of generating a software bill of materials. Binary software gene security testing is a type of security testing for binary software that deeply analyzes the structure, code fragments, and dependencies of binary files to detect security vulnerabilities, license compliance conflicts, and software tampering. Container image security testing is a type of security testing for containers and images that scans the layers of container images, including the base image, application code, third-party dependency libraries, and configuration files, to detect security vulnerabilities, malicious code impl