广东省政务云应用系统上线前风险评估指 引 （GuidelinesforRiskAssessmentbeforetheLaunchofGuangdongProvincial GovernmentCloudApplicationSystems）T/DSAG004-2025团体标准 20xx-xx-xx发布 20xx-xx-xx实施 2025-01-01发布 2025-01-01实施 广东省数字安全协会发布ICS35.020 L70 全国团体标准信息平台 全国团体标准信息平台 T/DSAG004-2025 I目次 前言...............................................................................................................................................................III 1范围.....................................................................................................................................................................1 2规范性引用文件.................................................................................................................................................1 3术语和定义.........................................................................................................................................................1 4上线前风险评估概述.........................................................................................................................................4 4.1评估定位.................................................................................................................................................4 4.2评估范围.................................................................................................................................................4 4.3角色职责.................................................................................................................................................5 4.3.1政务应用系统建设单位............................................................................................................5 4.3.2评估服务机构............................................................................................................................5 5评估流程.............................................................................................................................................................6 5.1评估申请.................................................................................................................................................7 5.2评估实施.................................................................................................................................................7 5.2.1系统调研....................................................................................................................................7 5.2.2首轮评估....................................................................................................................................8 5.2.3安全问题整改............................................................................................................................8 5.2.4回归评估....................................................................................................................................9 5.2.5评估总结和报告编制................................................................................................................9 6评估内容.............................................................................................................................................................9 6.1评估对象选择.........................................................................................................................................9 6.2系统配置核查.......................................................................................................................................11 6.2.1评估对象及内容......................................................................................................................11 6.2.2评估方法..................................................................................................................................16 6.2.3通过评估要求..........................................................................................................................16 6.3应用渗透测试.......................................................................................................................................16 6.3.1评估对象及内容........................