CPIS-compliance Security Requirement Analysis for Software Development

摘要

China CPIS policy is the fundamental policy of China cybersecurity strategy. Therefore, CPIS-compliance software solution is highly demanded to help organizations comply with CPIS associated policies and standards. In this paper, a CPIS-compliance security requirements analysis method for software development is proposed, which utilizes TAG to assess the attack and then develop response plan according to priority. Using TAG, controls from CPIS Baselines are introduced into software during design phase, which efficiently enhances and improves software security. A case is studied to illustrate the practicality and effectiveness of TAG method.