Automobile industry information safety system trustworthiness evaluation method and evaluation system

Abstract

The invention discloses an automobile industry information safety system trustworthiness assessment method, which comprises the following steps: step 1, assessment preparation: completing a series of preparation work before assessment, and obtaining information required for auditing of an assessment system; step 2, primary auditing: performing primary auditing on the evaluation preparation work in the step 1 and the acquired information required by the auditing of the evaluation system; 3, a scoring model is compiled, and the scoring model is compiled according to the evaluation module and the safety process domain thereof; 4, performing formal auditing, auditing whether the security process domain of the evaluation module is in accordance, and determining the security process domain of the score rate of the evaluation module; the invention further discloses an automobile industry information safety system trustworthiness evaluation system. The independence and authority of the auditing result are high, the auditing result can be accepted by all parties, and it can be guaranteed that all demand parties can quickly, accurately and comprehensively inquire the information security auditing result from the evaluation system.

Description

technical field [0001] The invention relates to the technical field of information security systems in the automobile industry, in particular to a reliability evaluation method and an evaluation system of an information security system in the automobile industry. Background technique [0002] The national standard for information security management system GB / T 22080-2016 is equivalent to the international standard ISO / IEC 27001:2013. This series of standards defines information security as maintaining the confidentiality, integrity and availability of information, and also includes authenticity, verifiability, Non-repudiation and reliability, among which confidentiality, integrity and availability are the three most important dimensions of information security. This standard is based on continuous risk assessment, establishes and implements an information security management system, and supervises, reviews and improves the operation of the system, and adopts the PDCA model ...

AI Technical Summary

Problems solved by technology

According to incomplete statistics, in 2020, there are only about a hundred companies in my country's auto industry that have obtained information security management system certification. One of the important reasons is that the general GB / T 22080 (ISO / IEC 27001) information security management system certification cannot Covering the special requirements of enterprises in the automotive industry

Images