GB/T37988 Data Security Capability Maturity Level Certification DSMM

The Data Security Capability Maturity Model for Information Security Technology (GB/T 37988-2019) (hereinafter referred to as "DSMM") is a national standard jointly developed by Alibaba, China Electronics Standardization Institute, National Information Security Engineering Technology Research Center, China Information Security Evaluation Center and other authoritative institutions in the industry. It was released on August 30, 2019 and officially implemented on March 1, 2020.
DSMM certification aims to evaluate an organization's ability in data security. Centered around the data collection, transmission, storage, processing, exchange, and destruction lifecycle of the organization, the data security capability of the organization is evaluated from four capability dimensions: organizational construction, institutional processes, technical tools, and personnel capabilities, according to maturity levels 1-5 (1. informal execution; 2. plan tracking; 3. sufficient definition; 4. quantitative control; 5. continuous optimization). DSMM assessment is conducted on an organizational basis, centered around data, and centered around the lifecycle of data. It evaluates four capability dimensions: organizational development, institutional processes, technical tools, and personnel capabilities, covering five maturity levels, 30 data security capability process areas, and 576 basic practices.

Value and Benefits

Promote organizational understanding and improvement of their own data security level, and carry out data security protection work from the perspective of data lifecycle, combined with the security needs reflected in the development of various data businesses.
Ensure the secure exchange and sharing of data between organizations, fully leverage the value of data, and create a more secure big data application environment.
Measuring the maturity level of an organization's data security capabilities and helping industries, businesses, and organizations identify weaknesses in their data security capabilities.
The relevant regulatory authorities can be used for data security management, determining the types and scope of data owned by enterprises based on their level of data security capabilities.
Enhance the data security level and industry competitiveness of the entire society, ensuring the development of the big data industry and digital economy.

Certification scope

Data owners: big data enterprises, information technology industry, Internet enterprises, financial industry, banking industry, insurance industry, securities industry, e-commerce platform, data center, government affairs, universities and other enterprises and institutions.
According to the providers of the plan: data developers/operators, information system construction and service providers, information technology service providers, etc.

【Home】【Return】

Previous article：T/HNCAA001 Enterprise Site 6S Management Standard Certification

Next article：ISO14064 ESG evaluation certification

Certification application

Through TUVHD's review and certification, you will showcase the best practices, efficiency, and sustainable development achievements of your enterprise.