T/GDIS 001-2023 Internet Application Security Capability Maturity Model for Information Security Technology

Scope

Main technical content: The Internet application system security capability maturity model is composed of three dimensions: capability elements, capability maturity levels, and capability building processes. Capability elements include institutional construction, system processes, technical tools, and personnel capabilities. The capability maturity levels are divided into five grades, including: Level 1 is the basic construction level, Level 2 is the standard protection level, Level 3 is the integrated control level, Level 4 is the comprehensive coordination level, and Level 5 is the intelligent optimization level. The capability building process includes core protection object security and general security. Core protection object security includes five process categories: communication security, network boundary security, computing environment security, data security, and personal information security. General security includes five process categories: security planning and architecture, personnel management and training, physical and environmental security, monitoring and early warning, and emergency response, and supply chain security. For specific requirements, please refer to Chapters 6 and 7. The capability requirements vary at different levels, and the specific requirements for each direction are described in Standards Appendices A-C. According to the maturity of an organization's Internet application system security capabilities, it is divided into five levels, with Level 5 being the highest and Level 1 being the lowest.

Development Information

Related Standards