China Minsheng Bank Obtained Level 3 Certification of Data Security Capability Maturity

　

Nowadays, data has become a critical production factor and core engine of economic development. Data security has been elevated to a strategic level of national security, and data security of the banking industry has become a key focus of national supervision and regulation.

In March 2023, following the assessment by a third-party certification agency approved by the Certification and Accreditation Administration of the People's Republic of China, the data security capability maturity of the customer transaction and service application systems of the Bank obtained the level 3 certification.

GB/T 37988-2019 Information Security Technology — Data Security Capability Maturity Model serves as China's national standard for data security. It measures an organization's data security capability maturity level and helps industries, enterprises, and organizations prevent and mitigate significant security risks in data utilization, and raise awareness and level of data security management.

Through this national standard certification, the Bank's technical and management capabilities in relation to customer privacy and data security have been systematically verified. This represents the Bank's management capabilities and maturity in the four dimensions of organizational development, systems and processes, technical tools, and personnel competencies. It also signifies that the Bank has established a mature data security management system with demonstrated capabilities in data collection security, data transmission security, data storage security, data processing security, data exchange security, data destruction security, and general data security, which are at a leading position among its domestic peers.

The Bank has always attached great importance to data security management and development. It has strengthened the Party Committee's accountability system for data security and coordinated management of data security. The institutions and departments of the Bank have been actively implementing data security management responsibilities, earnestly establishing and improving data security management system, clearly defining full-lifecycle protection for data at different security levels, refining closed-loop management, and improving capabilities.

In the future, the Bank will continue to advance the construction of its data security management system, strengthen the professional cultivation of data security teams, increase investment in human, financial, material, and technical resources, and drive data security management capability and technical protection to a higher level.