Shandong Provincial Department of Industry and Information Technology: Notice on Issuing the Implementation Plan for Promoting the Enhancement of Data Security Capability in the Industrial Sector in Shandong Province (2024-2026)
Lugongxin Data [2024] No. 152
Each city's industrial and information technology bureau, relevant units:
We are now issuing the Implementation Plan for Promoting the Enhancement of Data Security Capability in the Industrial Sector in Shandong Province (2024-2026) to you. Please organize and implement it carefully based on the actual situation.
Shandong Provincial Department of Industry and Information Technology
July 12, 2024
(This document is publicly released)
Implementation Plan for Promoting Data Security Capability Enhancement in the Industrial Sector in Shandong Province (2024-2026)
In order to implement the requirements of the Implementation Plan for Enhancing Data Security Capability in the Industrial Sector (2024-2026) issued by the Ministry of Industry and Information Technology (MIIT Network Security [2024] No. 34), comprehensively enhance the data security protection capability in the industrial sector of our province, consolidate the security foundation of the development of new industrialization, and combine with the actual situation of our province, this plan is formulated.
1、 Overall requirements
（1） Guiding ideology
Guided by Xi Jinping Thought on Socialism with Chinese Characteristics for a New Era, fully implement the spirit of the Party's 20th National Congress, unswervingly implement the overall national security concept, adhere to overall development and security, and build and improve the industrial data security guarantee system as the main line. Implement the main responsibility of the enterprise as the core, implement the data protection capability of industrial enterprises, data security scientific supervision capability, data security industry support capability improvement project, and improve the data security governance capability in the industrial field, promote the safe and orderly flow of data elements and the release of value, and provide solid support for accelerating new industrialization and building a strong manufacturing province, a strong network province and a strong digital province.
（2） Overall objective
By the end of 2026, the data security guarantee system for the industrial sector in the province will be basically established. The awareness of data security protection in industrial enterprises has generally increased, and the main responsibility for data security in key enterprises has been fully implemented. The data security work mechanism, policy standards, and technical means are more sound. The supply capacity of data security technology, products, and services continues to strengthen, and the scale and skill level of talent continue to improve. The promotion and implementation of data security policies for industrial enterprises above designated size in the province has achieved full coverage, with a training scale of over 40000 people. More than 5000 key enterprises have carried out data classification and grading protection, and the top 10% of large-scale industrial enterprises in the industry with annual revenue in each city have achieved full coverage. Cultivate no less than 20 national level data security application cases around our province's characteristic advantageous industries.
2、 Key tasks
（1） Implementing the Industrial Enterprise Data Protection Capability Enhancement Project
1. Enhance corporate data security awareness. For industrial and information departments at all levels, regulated industrial enterprises and data security enterprises, the use of special online courses, forum lectures, on-site observation and other online and offline forms, to strengthen the promotion of laws, regulations and policy standards in the field of data security, and improve the data security awareness of enterprises in various industries. Supervise and urge enterprises to implement the main responsibility of data security in accordance with laws and regulations, consolidate the first responsibility of the legal representative or the main person in charge of data security, allocate and strengthen the data security posts and personnel team, and promote enterprises to establish and improve the data security responsibility management mechanism. Guide enterprises to do a good job in development and security, integrate data security into enterprise development strategy and assessment mechanism, and promote data security management and business development with planning, deployment, implementation and assessment.
2. Strengthen the risk assessment of important enterprise data. In accordance with the requirements of the "Implementation Rules for Data Security Management in the Field of Industry and Information Technology in Shandong Province (Trial)", guide key enterprises to establish and improve security management systems such as data classification and classification protection, regularly sort out and identify important and core data, form a catalog and report in time. Supervise and urge important data and core data processors to implement data classification protection requirements, carry out data security risk assessment at least once a year, discover data security risks in a timely manner, and submit assessment reports as required. For important data leakage, extortion virus attacks, personnel violations, uncontrolled remote operation and maintenance and other prone to frequent security risks, guide enterprises to strengthen management and technical protection measures, enhance data security risk prevention capabilities.
3. Improve the ability of enterprise data security protection. Guide enterprises to strengthen the construction of data anomaly monitoring, data encryption, data desensitization, data leakage prevention and other security protection means according to the series of guidelines on data security protection practices in the industrial field, improve the comprehensive capabilities of enterprise risk monitoring, situational awareness, threat research and judgment, and emergency response, and report major risk events in a timely manner. Guide enterprises to integrate data security into the whole process of business data and data business, accelerate the construction of trusted industrial big data platform and enterprise data warehouse based on privacy computing, build enterprise trusted data space, and improve the security protection capability of data processing scenarios such as enterprise data aggregation, circulation and application. For typical business scenarios such as upstream and downstream collaboration in the supply chain, service outsourcing, and cloud-based platforms, the multi-subject data security responsibility interface and connection mode are clarified, and a full-chain all-round data security protection system is established.
(II) Implementation of Data Security Scientific Supervision Capability Improvement Project
4. Improve the data security management mechanism. Implement national policy documents such as the implementation rules for data security risk assessment in the industrial sector, emergency plans, and administrative penalty discretion guidelines, and promote industry and information authorities at all levels to improve the work processes of important data filing, risk monitoring, supervision and inspection, and emergency response. Formulate detailed work plans, strengthen cooperation with relevant departments such as Internet information and public security, and jointly improve the level of regional data security management. Relying on the Provincial Digital Economy Standardization Technical Committee to establish a data security working group to accelerate the development of industrial data security protection, trusted execution environment, situational awareness, risk assessment and other standards, to provide standardized guidance for industrial data security management.
5. Promote the construction of data security techniques and means. Improve the functions of the provincial industrial data security management platform, and strongly support important data management, risk monitoring, information reporting and sharing, and event notification. Encourage qualified cities and enterprises to build municipal and enterprise-level nodes, promote the docking and linkage with provincial platforms, build a collaborative and efficient data security monitoring and early warning system for provincial and municipal enterprises, and improve the ability to obtain, analyze and judge and early warning and disposal of regional and large-scale industrial data security risk information. Accelerate the establishment of a provincial-level industrial data security tool library, and select a number of special tools such as data classification and grading, testing and evaluation, compliance inspection, password application, etc., to provide support for data security supervision and protection.
6. Improve the ability of data security supervision and inspection. A list of key enterprises for data security risk prevention and control in the industrial sector at the provincial and municipal levels is compiled on a rolling basis, and data security supervision and inspection are regularly carried out on the enterprises in the list in the form of joint multi-departmental inspections and special inspections in the industrial sector. We will implement the special action of "digital security escort", carry out data security risk investigation and prevention by industry and batch, and enhance the ability of enterprise risk identification and disposal by means of enterprise self-examination, remote detection and on-site diagnosis. We will promote the inclusion of data security in the list of administrative law enforcement matters, strengthen the building of the administrative law enforcement capacity of the competent departments of industry and information technology, build a professional and standardized supervision and law enforcement team, establish and improve the complaint and reporting channels for data security violations, and strictly deal with violations of laws and regulations.
7. Improve the level of data security emergency disposal. Set up a data security risk analysis expert group, figure out the characteristics and laws of data security risk events, strengthen the analysis of typical cases, establish a case database of major risk events, and provide empirical reference for emergency response. Strengthen the construction of provincial and municipal emergency response support teams, and carry out guidance for key enterprises on pre-prevention, in-process disposal, and post-event summary of data security risk events. In accordance with the unified deployment of the Ministry of Industry and Information Technology's "Digital Safety and Shield" special action, organize key enterprises to carry out emergency drills, continuously optimize incident response processes and mechanisms, and improve the level of rapid incident response, standardized handling, and collaborative linkage.
(III) implementation of data security industry support capacity enhancement project
8. Strengthen key core technology research. We will give full play to the advantages of universities and scientific research institutes in terms of talents, technology and achievements, support the establishment of innovative carriers such as data security industry technology research institutes, joint laboratories and technological innovation centers, and increase the research and development of basic software and hardware core technologies such as encryption chips, secure operating systems and privacy computing databases. Focusing on industrial data security scenarios, we continue to improve the level of common technological innovation such as intelligent data classification, industrial database audit, and low-latency encrypted transmission. Focus on industrial big data, industrial big model and other emerging application needs, to carry out data security sandbox, data leakage prevention, data traceability and other application technology research and development.
9. Increase the supply of products and services. Encourage data security enterprises to focus on industrial data leakage, theft, tampering and other risks, research and development of traffic anomaly monitoring, attack behavior identification, event tracing and disposal of data security products, the establishment and rolling update of data security product catalog. Support qualified service agencies to carry out data security services such as planning consultation, technical training, emergency response, security audit, assessment and certification. Innovate the "product service" supply model, provide small and medium-sized enterprises with "small, fast, light, accurate, out-of-the-box" data security products and services, and customize "special new, all-excellent, safe and credible" data security integrated solutions for large enterprises.
10. Cultivate and expand data security enterprises. Promote data security leaders to enrich the data security product matrix, build a comprehensive protection system and overall solutions covering the entire data life cycle, and grow into an ecologically-oriented enterprise with core competitiveness. Support innovative small and medium-sized enterprises to focus on data governance, privacy computing and other segments of the track, accelerate the growth of outstanding innovation capabilities, obvious characteristics, high market share of specialized new enterprises. Encourage network security enterprises to expand into the field of data security based on their own industry and product advantages. Promote the deepening of cooperation with the Beijing-Tianjin-Hebei region and the Yangtze River Economic Belt, focusing on promoting national-level scientific and technological innovation platforms and industry leaders to set up regional headquarters, incubation platforms, and R & D centers in our province, forming a new pattern of coordinated development of the data security industry, and radiating the Yellow River Basin High-quality development of data security industry.
3、 Guarantee measures
(I) strengthen organizational coordination. The Provincial Department of Industry and Information Technology will strengthen work coordination with relevant departments, do a good job in linking up with the provincial data security work coordination mechanism, and strengthen cross-departmental comprehensive supervision, joint law enforcement and emergency response. To build a four-level linkage of provinces, cities, counties and enterprises in the industrial field data security management mechanism, strengthen the linkage of provinces and cities, government and enterprises to form a joint force. Support professional think tanks and service organizations in the field of data security, and provide capacity support for policy planning, standards and specifications, exchanges and cooperation, application and promotion for the development of data security in the province.
(II) increase the factor guarantee. Explore the establishment of special funds for data security in the industrial transformation and development funds of various cities, and increase the investment of data security funds in the industrial field by means of subsidies and interest subsidies. Encourage banking financial institutions to innovate products and services, and increase support for the data security industry. Guide universities, scientific research institutes, data security enterprises and other joint construction of provincial digital economy innovation platform, data security industry talent training base, support colleges and universities to carry out professional, characteristic data security professional discipline construction, expand the data security talent team.
(III) enhanced effectiveness evaluation. The competent departments of industry and information technology in each city shall timely track the implementation of the dispatching implementation plan and the completion of the objectives, and evaluate the effectiveness of data security work. Explore the establishment of the province's industrial data security development evaluation index system, support industry associations and third-party organizations to carry out data security development assessment, and regularly issue evaluation reports. The Provincial Department of Industry and Information Technology praised the regions, enterprises and units that have achieved strong work promotion and achieved remarkable results, selected typical experiences and practices and promoted them, and recommended them to the Ministry of Industry and Information Technology.
(IV) create a good atmosphere. Organize "Skills Xinglu-Shandong Province Data Security Vocational Skills Competition", "Shandong Province Big Data Technology and Application Vocational Skills Competition" and other competitions to promote the renewal of talent knowledge and ability improvement. Give full play to the role of associations, societies and industrial alliances, carry out supply and demand docking, technical exchanges, case promotion and other activities, use public numbers, financial media and other means to carry out innovative publicity, to create a strong atmosphere of data security, co-governance and sharing.
This implementation plan will come into force on July 12, 2024 and will be valid until December 31, 2026.
