【中英文对照版】工业和信息化领域数据安全风险评估实施细则(试行).docx

工业和信息化部关于印发工业和信息化领域数据安全风险评估实施细则（试行）的通知（工信部网安（2024）82号）各省、自治区、直辖市、计划单列市及新疆生产建设兵团工业和信息化主管部门，各省、自治区、直转市通信管理局，青海、宁夏无线电管理机构，部属各单位，部属各高校，各有关企业：工业和信息化领域数据安全风险评估实施细则(试行)Detai1.edRu1.esfortheImp1.ementationofDataSecurityRiskAssessmentsintheFie1.dofIndustryandInformationTechno1.ogy(forTria1.Imp1.ementation)制定机关：工业和怙息化部发文字号：工怙郡网安(2024)82号公布日期：2024.05.10施行日期：2024.06.01效力位阶：部门规定性文件法规臭别：网络安全管璟IssuingAuthority：MiniSUyof1.ndustr)&InformationTechno1.ogyDocumentNumber：No.822024)of1.heMinistryofIndustryandInfonnatkmTechno1.ogyDateIssued:05-10-2024EffectiveDate：06-01-20241.eve1.ofAuthorityDepanmenta1.Regu1.atoryDocumentsAreaofI-aw：NetworkSecurityManagementNoticebytheMinistryofIndustryandInformationTechno1.ogyofIssuingtheDetai1.edRu1.esfortheImp1.ementationofDataSecurityRiskAssessmentsintheFie1.dofIndustryandInformationTechno1.ogy(forTria1.Imp1.ementation)(No.822024oftheMinistryofIndustryandInformationTechno1.ogy)Theindustryandinformationtechno1.ogyauthoritiesofprovinces,autonomousregions,municipa1.itiesdirect1.yundertheCentra1.Government,citiesunderseparatestatep1.anning,andtheXinjiangProductionandConstructionCorps;thecommunicationsadministrationsofprovinces,autonomousregions,andmunicipa1.itiesdirect1.yundertheCentra1.Government;theradioauthoritiesofQinghaiandNingxia;entitiesandhighereducationinstitutionsdirect1.yundertheMinistry;andre1.evantenterprises:TheDetai1.edRu1.esfortheImp1.ementationofDataSecurityRiskAssessmentsintheFie1.dofIndustryandInformationTechno1.ogy(forTria1.Imp1.ementation)areherebyissuedforyourcomp1.ianceandimp1.ementation.MinistryofIndustryandInformationTechno1.ogyMay10,2024Annex:Detai1.edRu1.esfortheImp1.ementationofDataSecurityRiskAssessmentsintheFie1.dofIndustryandInformationTechno1.ogy(forTria1.Imp1.ementation)Artic1.e1InaccordancewiththeDataSecurity1.awofthePeop1.e'sRepub1.icofChina,theCybersecurity1.awofthePeop1.e'sRepub1.icofChina,andother1.aws,basedonthere1.evantrequirementsoftheMeasuresfortheAdministrationofDataSecurityintheFie1.dofIndustryandInformationTechno1.ogy(forTria1.Imp1.ementation),theseDetai1.edRu1.esareformu1.atedforthepurposesofguidingdataprocessorsinthefie1.dofindustryandinformationtechno1.ogyinproper1.yassessingdatasecurityrisk,improvingdatasecuritymanagement,andsafeguardingnationa1.securityanddeve1.opmentinterests.现将工业和信息化领域数据安全风险评估实施细则（试行）印发给你们，请认真遵照执行。工业和信息化部2024年5月10日附件:工业和信息化领域数据安全风险评估实施细则（试行）第一条根据中华人民共和国数据安全法中华人民共和国网络安全法等法律，按照工业和信息化领域数据安全管理办法（试行）有关要求，为引导工业和信息化领域数据处理者规范开展数据安全风险评估工作，提升数据安全管理水平，维护国家安全和发展利益，制定本细则。第二条本细则适用于对中华人民共和国境内工业和信息化领域重要数据和核心数据处理者数据处理活动开展的数据安全Artic1.e2TheseDetai1.edRu1.esapp1.ytodatasecurityriskassessmentsonthedataprocessingactivitiesconductedbyprocessorsofimportantdataandcoredatainthefie1.dofindustryandinformationtechno1.ogywithintheterritoryofthePeop1.e'sRepub1.icofChina.风险评估。第三条工业和信息化部统一管理、监督和指导工业和信息化领域数据安全风险评估工作，组织开展相关评估标准制修订及推广应用。各省、自治区、直辖市及计划单列市、新疆生产建设兵团工业和信息化主管部门，各省、自治区、直辖市通信管理局和无线电管理机构（以下统称地方行业监管部门）依据职责分别负责监督管理本地区工业、电信、无线电重要数据和核心数据处理者开展数据安全风险评估工作。工业和信息化部及地方行业监管部门统称为行业监管部门。第四条重要数据和核心数据处理者按照及时、客观、有效的原则开展数据安全风险评估，形成真实、完整、准确的评估报告，并对评估结果负责。Artic1.e3TheMinistryofIndustryandInformationTechno1.ogyuniform1.yadministers,supervises,andguidesdatasecurityriskassessmentsinthefie1.dofindustryandinformationtechno1.ogy,andorganizesthedeve1.opment,revision,promotion,andapp1.icationofre1.evantassessmentstandards.Theindustryandinformationtechno1.ogyauthoritiesofa1.1.provinces,autonomousregions,municipa1.itiesdirect1.yundertheCentra1.Government,citiesunderseparatestatep1.anning,andtheXinjiangProductionandConstructionCorpsandthecommunicationsadministrationsandradioinstitutionsofa1.1.provinces,autonomousregions,andmunicipa1.itiesdirect1.yundertheCentra1.Government(co1.1.ective1.y,"1.oca1.industryregu1.atoryauthorities")areresponsib1.eforsupervisingandadministeringthedatasecurityriskassessmentsconductedby1.oca1.processorsofimportantdataandcoredataontheindustria1.sector,te1.ecommunications,andradioaccordingtotheirresponsibi1.ities.TheMinistryofIndustryandInformationTechno1.ogyand1.oca1.industryregu1.atoryauthoritiesareco1.1.ective1.yreferredtoasindustryregu1.atoryauthorities.Artic1.e4Aprocessorofimportantdataandcoredatasha1.1.prompt1.y,objective1.y,andeffective1.yassessdatasecurityrisk,formanauthentic,comp1.ete,andaccurateassessmentreport,andberesponsib1.efortheresu1.toftheassessment.Artic1.e5Aprocessorofimportantdataandcoredatasha1.1.,inaccordancewithnationa1.1.awsandregu1.ations,re1.evantprovisionsissuedbyindustryregu1.atoryauthorities,andassessmentstandards,conductadatasecurityriskassessmentonthepurpose,method,businessscenarios,securitymeasures,riskimpact,andotherfactorsofdataprocessing,withafocuson:第五条重要数据和核心数据处理者按照国家法律法规、行业监管部门有关规定以及评估标准，对数据处理活动的目的和方式、业务场景、安全保障措施、风险影响等要素，开展数据安全风险评估，重点评估以下内容：(1) Whetherthepurpose,method,andscopeofdataprocessingare1.ega1.,justified,andnecessary.（一）数据处理目的、方式、范围是否合法、正当、必要；(2) Theformu1.ationandimp1.ementationofadatasecurity