This paper discusses the graded protection system of information security in China

Answer: The state organizes citizens, legal persons, and other organizations to implement security protection for information systems at different levels through the formulation of unified management norms and technical standards for classified information security, and supervises and manages the implementation of classified protection work.

Information security regulatory departments (including public security organs, secrecy departments, and state cryptography departments) are to organize the formulation of hierarchical protection management norms and technical standards, organize citizens, legal persons, and other organizations to carry out hierarchical security protections for information systems, and supervise and manage the implementation of hierarchical protection efforts.

In accordance with the "Measures for the Management of Classified Information Security Protection" and relevant standards and specifications, the departments in charge of information systems are to supervise, inspect, and guide the information security graded protection efforts of the units operating and using information systems in that industry, department, or region.

Units operating and using information systems are to carry out hierarchical protection work in accordance with the relevant national management norms and technical standards for graded protection, build security facilities, establish security systems, implement security responsibilities, and accept the supervision and guidance of public security organs, secrecy departments, and state cryptography departments for classified information security protection work, to ensure the security of information systems.

Units that develop and produce information security products, and security service organizations such as information system integration, grade evaluation, and risk assessment, shall carry out technical services and technical support in accordance with relevant national management regulations and technical standards, and accept the supervision and management of the information security supervision department.

Classified information security protection refers to important information to the stateIt is a kind of work to protect information and information carriers according to the level of importance.

Information security level protection is a kind of work to protect information and information carriers according to the importance level, and it is a kind of work in the field of information security that exists in many countries such as China and the United States. In China, classified information security protection is broadly defined as the security work involving the standards, products, systems, and information of the work in accordance with the concept of classified protection.

In a narrow sense, it generally refers to the classified security protection of information systems. The classified protection of information security includes five stages: grading, filing, security construction and rectification, information security level evaluation, and information security inspection. Information system security level assessment is an evaluation process to verify whether the information system meets the corresponding security protection level.

The classified protection of information security requires that information systems with different security levels should have different security protection capabilities, which is achieved by selecting security controls suitable for the security level in security technology and security management; On the other hand, there are different security controls in terms of security technology and security management distributed in the information system.

Through the connection, interaction, dependence, coordination, and coordination of the same interrelated relationship, the security function of the information system is closely related to the overall security function of the information system, and the structure of the information system and the intercorrelation between security controls, planes and regions are closely related. Therefore, on the basis of security control evaluation, the security level evaluation of information systems should also include the overall evaluation of the system.