T/SCCIA 012-2023 Guidelines for Operational Risk Management of Electronic Authentication Service Providers
T/SCCIA 012-2023 Guidelines for Operational Risk Management of Electronic Authentication Service Providers
Basic Information
Scope
Scope: This document specifies the term definitions, strategies, principles, organization, and business processes for the operation of electronic certification service providers, and clarifies the specific business standards, requirements, and indicators for risk control in business operations, providing guidance for subsequent business continuous improvement and audit management. This standard applies to the risk management work of electronic certification service providers in identifying, analyzing, handling, and supervising and improving the risks of digital certificate business operations. Electronic certification service providers can establish, implement, effectively operate, and continuously improve the digital certificate business operation risk management system according to this document, and effectively manage risks by ensuring the effective operation of the system. Main technical content: The guidelines for operational risk management of electronic certification service providers are based on the "Measures for the Administration of Electronic Certification Services". Under the requirements of the electronic certification service system and technical standards, and under the given technical constraints and input data conditions, it is determined whether the electronic certification services meet the set technical indicators. According to the provisions of the "Measures for the Administration of Electronic Certification Services", electronic certification service providers use commercial cryptographic product testing institutions to test qualified domestic cryptographic technologies, equipment, and software systems to provide electronic certification services externally, which lays a technical foundation for the standardization of operational risk management for electronic certification service providers. For example, in the aspect of certification risk management, with the development of mobile Internet, new certification technologies such as online im