公告&动态 第202页

Update to the German Standardization Roadmap on IT Security

Third edition 

DIN and DKE  have updated the German Roadmap on  IT Security  through the KITS Advisory Council (DIN’s IT Security Coordination Office).

To achieve the primary aims  of IT security  – availability, privacy, integrity and authenticity – secure products and systems are indispensable.  The requirements of and solutions for  defensive shields  must be standardized  and, in the current age of  accelerated technological convergence, coordinated across sectors. The DKE-Kontaktstelle Informationssicherheit (KSI, DKE Liason Office for IT Security) and theKoordinierungsstelle IT-Sicherheit im DIN (KITS) (link in German)  are devoted to  this task. Together, these two bodies  have composed and published  the third Standardization Roadmap on IT Security.

New EU frameworks and business processes

The Standardization Roadmap  responds to  the most recent legislative and regulatory developments  on the European level, e.g.  the EU ePrivacy Regulation draft  which sets new requirements  for IT security.

The third edition of the German Standardization Roadmap on IT Security shows that

l  data protection,

l  energy supply and production,

l  industrial production,

l  health and medical technology,

l  smart living and

l  critical infrastructures

are thoroughly covered  by existing standards.

A future fourth version of  the German Standardization Roadmap on IT Security  will include a focus on  the collectively used specifications.

Currently  the Standardization Roadmap on IT Security  is only available in German  but will be found on this website in English  as soon as  it is published.

执行总裁：布朗温.埃文斯

CEO Report: On-site Battery Systems

Recently Standards Australia has been in the media regarding the work of our technical committee on a draft standard for on-site battery systems, DR AS/NZS 5139:201X, Electrical installations – safety of battery systems for use with power conversion equipment. This comprehensive document is the result of many hours of work from experts representing industry, government and community interests.

The work is being driven by a range of stakeholders from all parts of industry who have an interest in standards in Australia that support the safe uptake of battery storage systems in all buildings, but particularly in homes.

As an installation standard, this document has a number of draft rules for public review relating to the “what, where and how” of battery systems.

All of our standards work is important, with this work no exception.
As with any new technology, standards give consumers and industry confidence in innovative solutions. They should give markets and governments confidence when making regulatory and investment decisions and get the balance right between all the different interests and voices in the room.

We are now at the public comment stage of development and we are seeking the views of all stakeholders over the next 8 weeks. We look forward to receiving these public comments which will all be reviewed by the technical committee. At the conclusion of this process we will have an installation standard for battery storage systems which supports the uptake of systems in Australia, a key focus of Professor Finkel’s Independent Review into the Future Security of the National Electricity Market, released in early June.

Our standards development process is based on the principles of transparency and consensus, and this standard is no different. If you have a view on battery storage systems in Australia, I encourage you to have your say via our public comment portal.

—Dr Bronwyn Evans, CEO

The worldwide standard for electronic documents is evolving

The PDF format exemplifies the value of standards. Had the specification for PDF not been published from the technology’s introduction in 1993, PDF would just be one of a dozen document formats. More than any other single factor, Adobe’s decision to make the PDF specification freely available enabled an ecosystem of developers.

Adobe’s PDF version 1.7 became ISO 32000 in 2008. Since then, members of ISO/TC 171/SC 2/WG 8, the working group responsible for the standard, have continued the development of the specification, with the just-published version defined as PDF 2.0.

0。

PDF’s value proposition – the reason why PDF is today’s worldwide de facto standard for electronic documents – is the fact of standardization itself. PDF files are supposed to be entirely self-contained and interoperable, working equally well with PDF software from every vendor. End-users should be able to gain equivalent results irrespective of their choice of software. This core feature – PDF files always look and work the same way – is the dominant reason for the technology’s success.

In PDF 2.0, the fundamentals of PDF remain identical, but the value to users has increased. Perhaps the most important enhancement is also the most subtle. PDF 2.0 addresses ambiguities, corrects errors, modernizes many features, updates normative references and six critical clauses, totalling 14 % of the 972-page specification that were entirely rewritten.

Although these changes aren’t new features, they make it easier to understand and successfully implement the specification, with better interoperability. In short, PDF 2.0 will make it easier and less costly for developers to improve their support for PDF at every level.

PDF 2.0 does, however, include many entirely new features in addition to the improvements to the existing specification:

Unencrypted wrapper documents allow secured PDF files to be delivered inside a readable “cover letter” document.

There’s new support for rich media annotations, geospatial features and PRC, a 3D format.

Associated files, first introduced with PDF/A-3, now extend to any PDF 2.0 document the ability to include machine-readable metadata about files attached to the PDF.

Users gain from an enhanced ability to include source, data and other file formats as part of their PDF document.

Clause 14.8 on tagged PDF has been completely overhauled with a revised tag set, support for namespaces, MathML support and pronunciation hints. The result will be more accessible documents that are also much easier to repurpose for text extraction, conversion to HTML for small devices, and more.

Digital signature features have been updated to meet the latest specifications, allowing users new options for verifying digitally signed PDF documents.

PDF now supports 256-bit AES encryption, a current-generation standard.

ISO 32000-2, Document management – Portable document format – Part 2: PDF 2.0, is the first PDF specification developed entirely within the ISO guidelines and process. It’s clearer, cleaner, supports non-proprietary technologies and ensures a level playing field for software vendors that create, display, edit or otherwise process PDF electronic documents. In addition to staying true to PDF’s core value, PDF 2.0 provides a solid foundation for new use-cases, capabilities and workflows.

ISO 32000-2 was developed by technical committee ISO/TC 171, Document management applications, subcommittee SC 2, Document file formats, EDMS systems and authenticity of information, whose secretariat is held by ANSI, the ISO member for the United States.

New publication  helps organizations  get full benefit from ISO 26000  for social responsibility

Getting the most out of ISO 26000,  the world’s first and most widely used International Standard for social responsibility,   is the aim of  a new guidance document just published.

In its seven years of existence, ISO 26000 has become one of the key references for implementing social responsibility practices in any organization. It has been adopted nationally in 80 countries across more than 20 languages and was one of  the sets of guidelines  upon which the European Commission  built its corporate social responsibility (CSR) strategy.

Now, a newly published International Workshop Agreement – IWA 26, Using ISO 26000 guidance on social responsibility in management systems – helps organizations reap even greater benefits from the standard using the management systems standard (MSS) approach.

With ISO 26000 being developed before the introduction of ISO’s “high-level structure” for MSSs, designed to bring consistency among all management systems within an organization, this IWA will help users of management systems standards more effectively integrate social responsibility into their business.

Staffan Söderberg, Chair of the technical committee that created IWA 26, said the extra guidance it provides will be a welcome aid for anyone implementing a social responsibility programme.

 “Even for those organizations with experience in management systems, social responsibility is complex and challenging,” he explained. “IWA 26 provides detailed guidance to help organizations benefit more fully from ISO 26000, and thus contribute more effectively to sustainable development.”

Decisions and actions resulting from the SMB meeting held in Geneva, 2017-06-12

IEC Technical Activities – Structure

Masterplan Implementation

SMB decided to set up ahG 76 Masterplan Implementation. Reflecting the intention for the implementation of the Masterplan to be flexible and pragmatic, the task of ahG 76 is to match the main topics of the Masterplan to the responsibilities and activities of SMB in order to ensure alignment and present the findings at SMB 160 in Vladivostok. After final approval of the Masterplan and Implementation Plan, the group will detail the findings and provide SMB with support on how to take action on the implementation plan.

 (SMB Decision 159/5)

Digital Transformation

SMB noted that IEC was facing a digital transformation in the near future and that the concept of the published standard and the process for its development would undergo significant changes.

SMB agreed to set up ahG 77 Digital Transformation with the task of elaborating the scope of a possible permanent group with the following tasks:

.         Consult SMB and IEC TC/SC/SyCs on possible ways to implement a digital transformation for the future.

.         Provide a platform for discussion and workshops with internal and external participation.

.         Investigate links to IEC internal and external activities and the technical work under supervision of IEC.

.         The issues to be reviewed include, but are not limited to: societal and cultural developments, a holistic review of standards and standards development, an inventory of technologies available to assist standards and standards development, what opportunities are offered to IEC.

The ahG will report back to SMB 160 meeting in Vladivostok.

(SMB Decision 159/6)

"Hot Topic Radar"

SMB agreed that it was necessary to monitor on a continuous basis changes that could potentially affect the technical work of IEC. Whilst these clearly included technological development, other factors, such as societal changes could also have a large impact. SMB agreed to set up a Strategic Group, SG 11 Hot Topic Radar to proactively monitor emerging issues, including technological changes and other challenges to the technical work of IEC. Its tasks include the definition of a process and its implementation to:

.         detect and maintain a list of hot topics

.         recommend further steps to SMB

In future SG 11 will communicate closely with corresponding initiatives in MSB and CAB.

 (SMB Decision 159/7)

Horizontal Standards

SMB noted that the recommendations made by ahG 72 concerning Horizontal Standards had been approved (see details in SMB/6161/R), but decided not to exclude standards prepared by TCs 1 and 3 from the list. SMB agreed to re-instate the definition of Guide, previously present in the ISO/IEC Directives.

SMB agreed to amend recommendation A.3 with the agreed list for allocation of horizontal standards and decided to postpone the review of Horizontal Standards by the Advisory Committees and TCs 1 and 3 until Guide 108 has been revised.

(SMB Decision 159/10)

Horizontal Standards and IEC Guide 108

SMB agreed to improve the visibility of horizontal standards and set up ahG 78 to revise IEC Guide 108, Guidelines for ensuring the coherency of IEC publications – Application of horizontal standards. The revision would include the common aspects from the other IEC Guides.

(SMB Decision 159/11)

Feedback from Conformity Assessment Systems to IEC TC/SCs

SMB confirmed that all necessary action had been taken with respect to the procedures applied for Interpretation Sheets and agreed to strengthen communications to the TC/SCs concerned by Decision Sheets prepared by the CA Systems. TC/SCs would be reminded of the need to respond to requests from the CA Systems, but also to be involved in the discussions in the CA Systems. An AC will be circulated to this effect.

(SMB Decision 159/19)

Conformity Assessment aspects in standards

CAB and SMB have produced guidance for IEC TC/SCs on Conformity Assessment aspects in standards. The Guidance is available at http://www.iec.ch/standardsdev/resources/CA/

Decisions and actions resulting from the SMB meeting held in Geneva, 2017-06-12

IEC Technical Activities – Structure

Masterplan Implementation

SMB decided to set up ahG 76 Masterplan Implementation. Reflecting the intention for the implementation of the Masterplan to be flexible and pragmatic, the task of ahG 76 is to match the main topics of the Masterplan to the responsibilities and activities of SMB in order to ensure alignment and present the findings at SMB 160 in Vladivostok. After final approval of the Masterplan and Implementation Plan, the group will detail the findings and provide SMB with support on how to take action on the implementation plan.

 (SMB Decision 159/5)

Digital Transformation

SMB noted that IEC was facing a digital transformation in the near future and that the concept of the published standard and the process for its development would undergo significant changes.

SMB agreed to set up ahG 77 Digital Transformation with the task of elaborating the scope of a possible permanent group with the following tasks:

.         Consult SMB and IEC TC/SC/SyCs on possible ways to implement a digital transformation for the future.

.         Provide a platform for discussion and workshops with internal and external participation.

.         Investigate links to IEC internal and external activities and the technical work under supervision of IEC.

.         The issues to be reviewed include, but are not limited to: societal and cultural developments, a holistic review of standards and standards development, an inventory of technologies available to assist standards and standards development, what opportunities are offered to IEC.

The ahG will report back to SMB 160 meeting in Vladivostok.

(SMB Decision 159/6)

"Hot Topic Radar"

SMB agreed that it was necessary to monitor on a continuous basis changes that could potentially affect the technical work of IEC. Whilst these clearly included technological development, other factors, such as societal changes could also have a large impact. SMB agreed to set up a Strategic Group, SG 11 Hot Topic Radar to proactively monitor emerging issues, including technological changes and other challenges to the technical work of IEC. Its tasks include the definition of a process and its implementation to:

.         detect and maintain a list of hot topics

.         recommend further steps to SMB

In future SG 11 will communicate closely with corresponding initiatives in MSB and CAB.

 (SMB Decision 159/7)

Horizontal Standards

SMB noted that the recommendations made by ahG 72 concerning Horizontal Standards had been approved (see details in SMB/6161/R), but decided not to exclude standards prepared by TCs 1 and 3 from the list. SMB agreed to re-instate the definition of Guide, previously present in the ISO/IEC Directives.

SMB agreed to amend recommendation A.3 with the agreed list for allocation of horizontal standards and decided to postpone the review of Horizontal Standards by the Advisory Committees and TCs 1 and 3 until Guide 108 has been revised.

(SMB Decision 159/10)

Horizontal Standards and IEC Guide 108

SMB agreed to improve the visibility of horizontal standards and set up ahG 78 to revise IEC Guide 108, Guidelines for ensuring the coherency of IEC publications – Application of horizontal standards. The revision would include the common aspects from the other IEC Guides.

(SMB Decision 159/11)

Feedback from Conformity Assessment Systems to IEC TC/SCs

SMB confirmed that all necessary action had been taken with respect to the procedures applied for Interpretation Sheets and agreed to strengthen communications to the TC/SCs concerned by Decision Sheets prepared by the CA Systems. TC/SCs would be reminded of the need to respond to requests from the CA Systems, but also to be involved in the discussions in the CA Systems. An AC will be circulated to this effect.

(SMB Decision 159/19)

Conformity Assessment aspects in standards

CAB and SMB have produced guidance for IEC TC/SCs on Conformity Assessment aspects in standards. The Guidance is available at http://www.iec.ch/standardsdev/resources/CA/

New code of practice for tackling illegal fishing and depleting fisheries

BSI, the business standards company, has launched a new code of practice for importers and processors of seafood on how to navigate the murky waters of illegal, unreported and unregulated fishing. 

Globally, over half of the world’s fisheries are fully exploited, and a further 30% over-fished. BSI’s new code of practice, PAS 1550:2017 Exercising due diligence in establishing the legal origin of fishery/seafood products and marine ingredients – importing and processing – code of practice, lists recommendations on how to check that seafood products being imported or processed within the EU are legally sourced.

Recommendations include what the seafood sector should do to ensure decent labour and employment conditions in the sector, and what traceability systems should be used to verify source claims. An organization handling seafood should have systems in place to manage critical aspects of legality – including processes, information verification, and transparency.

Issues concerning the supply chain, and the responsible management of fisheries, are covered, with guidance on how an organization can avoid sourcing seafood from vessels which appear on blacklists. The code of practice also includes a dedicated section on social and ethical responsibility.

Developed with support from the Environmental Justice Foundation, Oceana, The Pew Charitable Trusts, and the WWF, among others, PAS 1550 is intended to be used alongside existing regulation concerning illegal, unreported and unregulated fishing. EU regulation specifies that there is a regulatory requirement to undertake due diligence on whether or not seafood which is caught in or imported into the EU has been legally caught, transported and processed. PAS 1550 helps guide importers and processors of seafood through this process.

As well as importers and exporters of seafood, the PAS is relevant to authorities and other entities – such as NGOs, industry associations and certification bodies – where it can provide a benchmark for developing a due diligence system and provide information on the expectations of processors and importers.

David Fatscher, Head of Market Development for Sustainability at BSI, said: “Fishing and aquaculture provide over 250 million jobs world-wide. PAS 1550 was created to provide guidance to organizations which import and process seafood. The code of practice includes a sample risk-assessment checklist to guide them through what can be a complex process.”

PAS 1550 includes an extract from the International Labour Organization Work in Fishing Convention and background information on the minutiae of EU market rules. The code of practice applies to all aquatic ingredients sold into the retail, food service or any other sector that contain aquatic items – including, for examples pharmaceuticals and pet food.

The following organizations were involved in the development of PAS 1550: British Retail Consortium; ClientEarth; Environmental Justice Foundation; FishWise; Food and Drink Federation; Human Rights at Sea; Lovering Foods Ltd; Marine Management Organisation; MRAG Ltd; Oceana; The Pew Charitable Trusts; Seafish; UK Seafood Industry Alliance; Tesco Stores Limited; Wm. Morrison Supermarkets plc; WWF.

New standard for Police body cams backed by industry

BSI, the business standards company, has launched a new standard for Body Worn Video (BWV), the cameras now widely adopted by councils and police across the UK. In October 2016 the world’s largest scale roll out of such cameras was announced by London’s Metropolitan Police.

In response to concerns over data security and privacy, the new standard, BS 8593: 2017 Code of practice for the deployment and use of Body Worn Video (BWV) has been developed in conjunction with security and privacy groups – including the Home Office, the Metropolitan Police, and Big Brother Watch.

The standard delivers a common framework to boost public trust in understanding of where and when BWV can be used. The voluntary standard provides technical and operational recommendations for the appropriate and proportionate deployment and use of Body Worn Video.

The standard was drawn up to address a gap in guidance due to the differences between the use of CCTV and BWV, and to avoid a repeat of the privacy concerns associated with the widespread roll out of CCTV. The UK is widely believed to be the most surveilled state in the world. BS 8593 covers planning and operational recommendations, outlining the need for BWV deployment to be based on legitimate reasons, particularly in terms of undertaking a Privacy Impact Assessment.

Anne Hayes, Head of Market Development for Governance and Resilience at BSI, said: “During the development of BS 8593 it was agreed that public confidence in the operation and management of BWV was critical, with balancing safety, security and privacy matters a central concern. The involvement of both security and privacy groups shows that standards can deliver industry consensus by aligning agendas to the public benefit.

“BWV has an advantage as a security device in terms of providing the user with a sense of protection; a second pair of eyes and ears should something go wrong.”

Tony Porter, Surveillance Camera Commissioner, said: “I am delighted to support the new British Standard and acknowledge the excellent work which has been undertaken by those to deliver it in such short timescales. As the use of body worn cameras proliferate they become more and more engrained as an intrusive capability in the daily lives of citizens. The important and fundamental balance of preserving the rights of citizens whilst keeping our communities safe and secure, are at the heart of the Home Secretary’s Surveillance Camera Code of Practice which I regulate, the principles within that Code are at the heart of the new standard, and I commend its introduction.”

Examples of legitimate deployment of BWV can include:

–       Safeguarding employee safety and security – where a user of Body Worn Video may be at risk of physical or verbal attack, or working in a hazardous environment

–       As a deterrent – if the device wearer is involved in policing or controlling an environment which people could try to disrupt

–       Evidence capture – if the BWV user is involved in a role where they might witness or investigate criminal activity, and capturing visual or audio evidence could assist with future legal proceedings

–       Promoting transparency – where a device wearer regularly encounters complaints, such as bailiffs or parking wardens

–       Capturing data to use in process improvement or training – such as identifying learning opportunities

Device recommendations – such as functionality, weight, image quality and encryption – are covered in the standard. A separate clause covers data management and security including data integrity, audit trails, storage and sharing redaction.

Training for the device wearers, data handlers, and general operator guidance, is provided in the standard, along with a dedicated clause covering monitoring, escalation and response as agreed with the system owners.

The standard is applicable to BWV users and system owners, as well as suppliers and procurers.  Examples of where BWV systems might be used include emergency services, taxi marshalling, warden schemes, security guarding, parking enforcement and door supervision.

The following organizations were involved in the development of BS 8593: Association of Security Consultants; Big Brother Watch; British Security Industry Association; Home Office; Information Commissioner’s Office; Metropolitan Police; National Police Chiefs Council (NPCC); National Security Inspectorate; Security Industry Authority; Security Systems and Alarms Inspection Board (SSAIB); Transport for London. In an individual capacity: IndigoVision; Edisix Ltd; SoloProtect Ltd.

The medical devices’ Regulations and the role of Standards

With the new medical devices and in-vitro diagnostic medical devices Regulations (MDR and IVDR) published on 5 May 2017 by the European Commission, the long process of revising the European regulatory framework has ended. The Regulations pose new challenges to the various stakeholders involved in the sector due to the changes that they have introduced. They have expanded the scope of products, there are more rigorous requirements for clinical evaluations as well as changes to clinical investigations, mandatory unique device identification (UDI) mechanisms, and increased post-market oversight by European Notified Bodies. In addition, the IVDR introduces a new risk-rule classification system based on the Global Harmonization Task Force’s rules for classification, which considers patient impact for the first time.

The Regulations recognise the important role of standardisation in the field of medical devices. By complying with harmonised standards, manufacturers may demonstrate conformity with the general safety, performance, quality and risk management requirements of the Regulations, and thereby gain access to the European market. In addition to standardisation, the Regulations authorise the European Commission to publish common technical specifications that will represent state-of-the art and will be part of the products’ evaluation process. Several questions remain open, however, regarding the development of the common specifications and their co-existence with harmonised standards.

Given the complexity of the new regulatory framework, the scope of the changes it has introduced, and the short timeframe for the transition period, it is important to provide an open space for discussion and exchange of information and ideas regarding the new Regulations and the way forward. This is the objective of the Seminar on ‘The new regulations on medical devices and related standards: ensuring a successful transition’, which is organised by CEN and CENELEC and will take place on 21 September 2017. The focus of the seminar will be on standardization and its role in supporting the new Regulations, the future of harmonised standards under the Regulations, and the need to ensure a smooth and successful transition for the benefit of European citizens and industry.

Consult the agenda of the seminar and register before 19 September.