Data Security

After evaluating the gap between the user's organizational structure, management system, technical capability, and personnel capability, the data security professional service personnel design the data security governance system planning according to the actual data interaction process, data security risk scenarios, and risk points, referring to the GB/T 37988-2019 Information security technology - Data security capability maturity model. After planning the data security governance system, build the data security organization structure and establish the authority-responsibility relationships among multiple role organizations, such as the data security decision-making organization, the data security management organization, and the data security audit organization, to provide basic support for data security construction. In terms of data security system construction, on the premise of combining the user's actual data interaction scenarios, security risks, and compliance with the requirements of laws and regulations, put forward differentiated protection requirements for different levels of data, providing a basis for the implementation of technical capabilities. In terms of data security protection technology construction, according to the provisions of the data security management system, build basic data security protection capabilities such as access control, data leakage prevention, and data audit in the full life cycle, to implement the basic data security protection capabilities in the full life cycle. In terms of data security operation and control capacity construction, by combining the data security governance system with the data security protection system and paying equal attention to technology and management, build the data asset identification management, data classified management, data risk identification management, data security incident management, and data security audit capacity to realize a closed-loop operation process. In terms of data security monitoring capacity construction, from the perspective of internal and external monitoring, according to the authority-responsibility relationships as well as the relevant requirements of external industry monitoring and territorial monitoring, build a list of data assets, a list of classification, a list of sensitive data, and a list of data security risks, and develop interfaces, so as to achieve the ability to report monitoring data.