美CISA发布《跨部门网络安全绩效目标》及对我启示

U.S.CISA Released the"Cross-Sector Cybersecurity Performance Goals"and Its Enlightenment to China

美国《跨部门网络安全绩效目标》的发布开启了其对关键基础设施安全防护的科学评价阶段,对全球关键基础设施防护产生了重大影响。研究发现,该文件高度重视信息技术及运营技术领域资产的安全维护,聚焦关键基础设施部门实践规范,关注中小型实体安全实践诉求,强调对安全实践目标的效果评估等。这一举措的出台将进一步提升美国关键基础设施领域的网络安全水平,推进关键基础设施安全防御的标准建设,促进以安全绩效为导向的防护体系的形成,促进美国政府在国家关键基础设施网络安全能力建设中的效用发挥。我国应从制度层面加强对关键基础设施安全实践的支持,推进其安全防护的科学评估,加快构建一体化关键基础设施安全防护体系。

The release of the U.S.CPG(Cross-Sector Cybersecurity Performance Goals)opens the stage of scientific evaluation of critical infrastructure security protection,which will have a significant impact on global critical infrastructure protection.The study found that CPG attaches great importance to the security maintenance of assets in the field of information technology and operational technology,focuses on the practice norms of critical infrastructure departments,pays attention to the security practice demands of small and medium-sized entities,and emphasizes the effect evaluation of security practice objectives.The introduction of this measure will further improve the level of cyber security in the field of U.S.critical infrastructure,promote the construction of critical infrastructure security defense standards,facilitate the formation of a security performance-oriented protection system,and enhance the effectiveness of the U.S.government in building cybersecurity capabilities for the nation’s critical infrastructure.China should enhance practical support for infrastructure security at the institutional level,promote the scientific evaluation of critical infrastructure security protection,and accelerate the construction of an integrated critical infrastructure security protection system.