Regulations on security protection of power grid and power plant computer monitoring systems and dispatch data networks

Article 1: To prevent attacks on the power grid and power plant computer monitoring systems and dispatch data networks and resulting power system accidents, and to ensure the safe and stable operation of the power system, establish and improve power grid and power plant computers. The security protection system of the monitoring system and dispatch data network is based on the National People's Congress Standing Committee's "Resolution on Maintaining Network Security and Information Security" and the "Regulations on the Security Protection of Computer Information Systems of the People's Republic of China" and the national regulations on computer information and network The relevant regulations on system security protection are formulated in these regulations. Article 2 These regulations apply to computer monitoring systems and dispatch data networks directly related to the power production and transmission and distribution processes.

The term "power monitoring system" as mentioned in these regulations includes power grid dispatching automation systems at all levels, substation automation systems, converter station computer monitoring systems, power plant computer monitoring systems, distribution network automation systems, and microcomputer protection and safety automatic devices, water dispatch automation systems and water elevator level dispatch automation systems, electric energy metering and billing systems, auxiliary control systems for real-time power markets, etc.; "Dispatch data network" includes dedicated wide-area data networks for power dispatch at all levels, for Dedicated dial-up network for dispatching of remote maintenance and electric energy billing, local area network within each computer monitoring system, etc. Article 3 The basic principle of power system safety protection is: in the power system, systems with a higher safety level are not affected by systems with a lower safety level. The security level of power monitoring systems is higher than that of power management information systems and office automation systems. Each power monitoring system must have its own security protection facilities with high reliability and must not be directly connected to systems with low security levels. Article 4 The power monitoring system can be interconnected with other local power monitoring systems through a dedicated local area network, or interconnected with upper and lower-level off-site power monitoring systems through the power dispatch data network. When each power monitoring system is interconnected with an office automation system or other information system through a network, dedicated and reliable safety isolation facilities certified by relevant national departments must be used. Article 5 To establish and improve the power dispatch data network, special network equipment should be used on dedicated channels to form a network, and dedicated lines, synchronous digital sequences, quasi-synchronous digital sequences, etc. should be used to achieve safe isolation from public information networks at the physical level. The power dispatch data network only allows the transmission of data services directly related to power dispatch production. Article 6 Neither the power monitoring system nor the power dispatching data network shall be connected to the Internet, and the use of email is strictly restricted. Article 7 Establish and improve a safety protection responsibility system with hierarchical responsibilities. Various power grids, power plants, substations, etc. are responsible for the security management of computers and information networks within their respective scopes; power dispatching agencies at all levels are responsible for the security management of local power monitoring systems and power dispatching data networks at the same level.

Each relevant unit should set up a security protection team or full-time personnel for the power monitoring system and dispatch data network, and relevant personnel should participate in safety technology training. The person in charge of the unit is the person primarily responsible for safety protection. Article 8 All relevant units should formulate practical security protection plans. New nodes and application systems connected to the power dispatch data network must be approved by the agency responsible for the power dispatch data network at the same level and submitted to the next higher level power dispatch agency for filing; Existing nodes and connected application systems of power dispatching data networks at all levels should be carefully cleaned and inspected. If any safety hazards are discovered, they should be resolved as soon as possible and reported to the next higher level power dispatching agency in a timely manner. Article 9 All relevant units should formulate security emergency measures and fault recovery measures, back up key data and properly store it; promptly upgrade anti-virus software and install operating system vulnerability patches; strengthen the management of emails; equip key parts with Attack monitoring and alarm facilities improve the initiative of security protection. After being attacked by hackers, viruses and other man-made sabotage, security emergency measures must be taken promptly to protect the site, restore system operation as soon as possible, prevent the accident from expanding, and immediately report to the superior power dispatching agency and local information security authorities.

Article 10 Planning and design, project implementation, operation management, project review, etc. related to the power monitoring system and dispatch data network must strictly abide by these regulations, and daily safe operation management must be strengthened. If a safety incident occurs in the power monitoring system or dispatch data network, the relevant responsible persons will be given administrative sanctions; if it causes serious impact and heavy losses, the corresponding legal responsibilities will be investigated in accordance with the law. Article 11 After the implementation of these regulations, all relevant units must comprehensively clean up and review the current relevant technical standards. If any inconsistencies with these regulations or deficiencies in safety protection are found, they shall promptly notify the State Economic and Trade Commission; if they are enterprise standards, they shall be determined by the enterprise. be revised promptly. Article 12 The State Economic and Trade Commission is responsible for the interpretation of these regulations. Article 13 These regulations will come into effect on June 8, 2002.