The Classification Standard for Computer Information System Security Protection (hereinafter referred to as the Classification Standard) is an important regulation formulated by China Municipal Government, aiming at ensuring the security of computer information systems and improving the anti-attack and anti-interference capabilities of information technology systems. This standard classifies different levels of computer information systems and requires corresponding security measures and technical capabilities.

The security of computer information system is one of the foundations of modern social and economic activities. With the continuous development of computer technology, network attacks, information leakage and other security threats are also increasing. In order to protect the country's important information infrastructure and maintain national security and social stability, the China Municipal Government issued the classification standards in 2007.

Grading:

The first level (basic level): it is suitable for general information systems and requires basic information security measures, including cryptography, access control and log management.

Level 2 (general level): It is suitable for more important information systems, and requires measures such as risk assessment, network isolation and safety training to be added on the basis of the basic level.

Level 3 (important level): It is suitable for information systems that have a great impact on national security and social stability and require measures such as security audit, malicious code protection and emergency response on the basis of ordinary level.

Level 4 (key level): It is suitable for information systems that have a very important impact on the survival and development of the country, and it is necessary to further enhance the security on the basis of the important level, including comprehensive risk assessment, advanced cryptographic technology, customized security scheme, etc.

Technical capability requirements:

Encryption technology: It is required to use encryption algorithms that meet international standards to protect the confidentiality of sensitive data.

Access control technology: It is necessary to establish an effective authentication and authorization mechanism to ensure that only legitimate users can access the system.

Network isolation technology: It is required to effectively isolate systems with different security levels to prevent horizontal propagation attacks.

Security audit technology: it is required to record and analyze the running logs of the system and find potential security threats.

Emergency response technology: It is required to establish emergency response plans and mechanisms to deal with security incidents in time.