"""安全问卷 · 答案库种子 — 56 条双语标准问答(乙方侧初始知识库). Data-only seed for ``auditor_answer_library_entries``: the standard bilingual (zh+en) answers PingCAP gives when a CUSTOMER sends us a security questionnaire. Content is grounded in the company's real artifacts — 《信息化水平介绍》(ISO 27001 认证、安全方针、月度漏扫、年度 渗透测试、7×24 监控、零信任/SSL VPN、门禁与人事联动、UCloud 等保三级 机房、HA 网络等)、年度风险评估报告、IT 灾难恢复计划、ISO/IEC 27701 认证 — plus the security practices实现于 Helix 本身(SSO/MFA 监控、离职 T+0 回收、半年访问自证、密钥轮换台账、审计溯源、季度自检、供应商 TPRM)。 Idempotent: an entry is skipped when a row with the same ``question_zh`` already exists (the library has no natural unique key; exact question text is the seed identity). Seeded rows carry ``created_by_person_id`` NULL and ``last_reviewed_at`` = seed time so they surface as "fresh"; owners are expected to adopt/curate them in the UI afterwards. Self-contained (no app imports) per the migration chain-guard rule. Revision ID: 381 Revises: 380 """ from __future__ import annotations import json import uuid import sqlalchemy as sa from alembic import op revision = "381" down_revision = "380" branch_labels = None depends_on = None TABLE = "auditor_answer_library_entries" # ── Seed content ───────────────────────────────────────────────────── # (category, question_zh, question_en, answer_zh, answer_en, tags) SEED: list[dict] = [ # ═══ 认证与资质 certification ═══ { "category": "certification", "tags": ["iso27001", "iso27701"], "question_zh": "贵公司持有哪些信息安全/隐私相关认证?", "question_en": "Which information-security or privacy certifications does your organization hold?", "answer_zh": "我们已通过 ISO/IEC 27001 信息安全管理体系认证与 ISO/IEC 27701 隐私信息管理体系认证,并按体系要求每年开展管理评审、内部审核与正式的风险评估。证书副本可在保密前提下提供。", "answer_en": "We are certified to ISO/IEC 27001 (information security management) and ISO/IEC 27701 (privacy information management), with annual management reviews, internal audits and a formal risk assessment as required by the ISMS. Certificate copies are available under NDA.", }, { "category": "certification", "tags": ["idc", "mlps", "等保"], "question_zh": "贵公司的数据中心/机房具备哪些合规资质?", "question_en": "What compliance qualifications does your data centre / hosting facility hold?", "answer_zh": "自有托管服务器位于优刻得(UCloud)亦庄数据中心,该机房通过可信云评估、国家网络安全等级保护三级(等保三级)及云计算信息安全管理体系认证;生产 SaaS 负载托管于 AWS、TiDB Cloud 等主流云服务商。", "answer_en": "Our colocated servers are hosted in UCloud's Yizhuang data centre, which holds Trusted Cloud assessment, China MLPS Level 3 and cloud information-security management certifications; production SaaS workloads run on major cloud providers such as AWS and TiDB Cloud.", }, { "category": "certification", "tags": ["pentest", "audit"], "question_zh": "是否定期接受独立第三方安全审计或渗透测试?", "question_en": "Do you undergo independent third-party security audits or penetration tests?", "answer_zh": "是。除 ISO 27001/27701 年度外部审核外,我们每年对控制环境进行渗透测试,评估不断变化的环境所面临的风险;测试结果纳入漏洞修复流程闭环跟踪直至关闭。", "answer_en": "Yes. In addition to annual external ISO 27001/27701 audits, we conduct an annual penetration test of the control environment to assess evolving risks; findings feed our remediation workflow and are tracked to closure.", }, # ═══ 治理 governance ═══ { "category": "governance", "tags": ["policy"], "question_zh": "是否有经管理层批准并定期评审的信息安全方针/策略?", "question_en": "Do you have a management-approved information-security policy that is reviewed periodically?", "answer_zh": "有。公司发布经管理层批准的信息安全方针,覆盖信息资产管理、访问控制、网络与主机安全、备份保护、介质处置、事件处理与惩戒等方面,作为信息安全工作的总体要求,并随 ISMS 年度评审持续更新。", "answer_en": "Yes. A management-approved information-security policy covers asset management, access control, network and host security, backup protection, media disposal, incident handling and disciplinary measures, and is kept current through the annual ISMS review.", }, { "category": "governance", "tags": ["organization", "ciso"], "question_zh": "是否设有专职的信息安全组织/负责人?", "question_en": "Have you designated a dedicated information-security function or officer?", "answer_zh": "是。公司设有 IT 与信息安全团队,统一负责安全策略制定、风险评估、准入审批与日常安全运营,并建立 7×24 监控值守;任何设备或软件接入公司网络均须经 IT 与信息安全评估审批。", "answer_en": "Yes. A dedicated IT & information-security function owns security policy, risk assessment, approvals and day-to-day operations with 7×24 monitoring; any device or software joining the corporate network requires IT/security review and approval.", }, { "category": "governance", "tags": ["accountability"], "question_zh": "是否建立信息安全管理制度体系与违规惩戒机制?", "question_en": "Is there a security-management framework with disciplinary measures for violations?", "answer_zh": "是。我们建立了覆盖报告、响应、评价与惩戒的完整机制,明确全员安全责任与可疑/已发生事件的上报流程;违反安全制度的人员将按制度惩处,事件处理包含根因分析以防止同类事故再发。", "answer_en": "Yes. Our framework defines reporting, response, evaluation and disciplinary mechanisms with clear security responsibilities and escalation paths for all staff; violations are sanctioned per policy, and incident handling includes root-cause analysis to prevent recurrence.", }, # ═══ 风险管理 risk_management ═══ { "category": "risk_management", "tags": ["risk-assessment"], "question_zh": "是否建立正式的风险评估与风险处置流程?", "question_en": "Do you have a formal risk-assessment and risk-treatment process?", "answer_zh": "是。我们建立了识别威胁与脆弱性的风险评估流程,每年输出正式的风险评估报告,附信息资产清单、重要信息资产清单、风险识别评估表与风险处置计划;高风险及较高风险均已采取控制措施并降至可接受水平。", "answer_en": "Yes. A formal process identifies threats and vulnerabilities and produces an annual risk-assessment report with an asset inventory, critical-asset list, risk register and treatment plan; high risks are treated with controls down to an acceptable residual level.", }, { "category": "risk_management", "tags": ["change"], "question_zh": "业务或系统发生重大变化时是否重新评估风险?", "question_en": "Do you reassess risk when the business or systems change materially?", "answer_zh": "是。在业务流程、IT 运营环境、业务系统或架构发生变化,以及新业务、新环境或新系统上线时,均触发风险评估与测试,主动识别安全风险并制定应对措施;控制措施的有效性定期评估与回顾。", "answer_en": "Yes. Changes to business processes, the IT environment, systems or architecture — and any new business, environment or system — trigger reassessment and testing, with periodic reviews of control effectiveness.", }, { "category": "risk_management", "tags": ["asset-inventory"], "question_zh": "是否维护信息资产清单并进行分类分级?", "question_en": "Do you maintain a classified information-asset inventory?", "answer_zh": "是。我们维护信息资产清单与重要信息资产清单,按数据分类与安全级别实施管理;硬件资产在内部 IT 平台全生命周期管理(采购、领用、转移、回收、处置),与人员和 MDM 数据联动。", "answer_en": "Yes. We maintain full and critical information-asset inventories with data classification levels; hardware assets are lifecycle-managed (procurement, assignment, transfer, recovery, disposal) in our internal IT platform, linked to owners and MDM data.", }, # ═══ 访问控制 access_control ═══ { "category": "access_control", "tags": ["least-privilege"], "question_zh": "是否为每位员工分配唯一账号并遵循最小权限原则?", "question_en": "Does every employee have a unique account with least-privilege access?", "answer_zh": "是。每位员工拥有唯一账号,权限按业务需要与最小权限原则授予;账号与权限的开通须经审批,访问与操作行为被记录并可追踪,监控系统对异常访问行为进行探测。", "answer_en": "Yes. Every employee has a unique account with least-privilege, need-based entitlements; provisioning requires approval, access and operations are logged and traceable, and monitoring detects anomalous access behaviour.", }, { "category": "access_control", "tags": ["sso"], "question_zh": "是否实现统一身份认证(SSO)?", "question_en": "Do you provide single sign-on (SSO) across internal systems?", "answer_zh": "是。内部系统统一接入自研 IAM 平台实现单点登录,认证委托 Google Workspace / 飞书 OAuth 完成,业务系统不保存本地口令;账号、权限与登录集中管控、集中审计。", "answer_en": "Yes. Internal systems integrate with our in-house IAM platform for SSO; authentication is delegated to Google Workspace / Feishu OAuth with no local passwords in business systems, and accounts, entitlements and sign-ins are centrally governed and audited.", }, { "category": "access_control", "tags": ["mfa"], "question_zh": "管理与远程访问是否强制多因素认证(MFA)?", "question_en": "Is multi-factor authentication (MFA) enforced for administrative and remote access?", "answer_zh": "是。身份源(Google Workspace/飞书)强制多因素认证,应用登录采用账号、口令加动态验证码;我们通过内部安全平台按身份提供方持续监控 MFA 注册与强制状态,未覆盖账号会作为安全发现跟踪整改。", "answer_en": "Yes. Identity providers (Google Workspace/Feishu) enforce MFA, and applications authenticate with password plus dynamic verification codes; MFA enrolment/enforcement is continuously monitored per provider in our security platform, with gaps tracked as findings.", }, { "category": "access_control", "tags": ["password"], "question_zh": "是否启用强密码策略与登录失败锁定?", "question_en": "Are strong password policies and failed-login lockout enforced?", "answer_zh": "是。系统开启强密码策略;连续 5 次登录失败即自动告警并启动锁定策略,阻止未经授权的登录尝试,保障账户安全。", "answer_en": "Yes. Strong password policies are enforced; five consecutive failed logins automatically trigger an alert and account lockout to block unauthorized attempts.", }, { "category": "access_control", "tags": ["privileged-access"], "question_zh": "特权/管理员账号如何管理?", "question_en": "How is privileged/administrative access managed?", "answer_zh": "特权权限按需最小化授予并单独管理,纳入周期性特权访问认证复核;云环境高危权限授予须经审批并设有效期,到期自动提醒续期或回收,超期未决升级为合规事件跟踪。", "answer_en": "Privileged access is granted minimally and managed separately, covered by periodic privileged-access certifications; high-risk cloud grants require approval and carry expiry dates with renewal reminders, and overdue reviews escalate as compliance incidents.", }, { "category": "access_control", "tags": ["access-review"], "question_zh": "是否定期进行用户访问权限复核?", "question_en": "Do you perform periodic user-access reviews?", "answer_zh": "是。每半年开展全员访问自证(员工逐项确认本人账号、权限与资产),并由安全团队发起访问认证活动对特权与关键系统权限逐项复核;保留/回收决定闭环执行并留存完整审计记录。", "answer_en": "Yes. Semi-annual company-wide access self-attestation (each employee confirms their accounts, entitlements and assets) is complemented by security-run access-certification campaigns over privileged and key-system access; keep/revoke decisions are executed to closure with full audit records.", }, # ═══ 账号生命周期 identity_lifecycle ═══ { "category": "identity_lifecycle", "tags": ["onboarding", "jml"], "question_zh": "新员工账号如何开通?", "question_en": "How are accounts provisioned for new joiners?", "answer_zh": "入职以 HR 系统为唯一事实源驱动:确认入职后,内部 IAM 平台自动创建账号并按岗位策略开通基线权限(邮箱、协同办公、目录同步),入职当天即可使用;门禁系统与人事系统联动同步。", "answer_en": "Onboarding is driven by the HR system as the single source of truth: on confirmation our IAM platform auto-creates accounts and baseline entitlements (email, collaboration, directory) per role policy, ready on day one; door access also syncs with HR.", }, { "category": "identity_lifecycle", "tags": ["offboarding", "jml"], "question_zh": "员工离职时访问权限如何回收?", "question_en": "How is access revoked when an employee leaves?", "answer_zh": "离职当日(T+0)自动化回收:平台角色与系统权限撤销、Google 账号自动挂起、飞书账号冻结、下游 SaaS 经自动化连接器停用,设备与资产同步触发回收流程;平台内置离职者操作护栏防止误恢复,并有每日对账兜底,确保无残留访问。", "answer_en": "Revocation is automated on the leaver's last day (T+0): platform roles and entitlements are revoked, Google accounts auto-suspended, Feishu frozen and downstream SaaS deactivated via connectors, while devices/assets enter recovery; built-in leaver guards prevent accidental re-provisioning and daily reconciliation ensures no residual access.", }, { "category": "identity_lifecycle", "tags": ["transfer"], "question_zh": "员工转岗/调动时权限如何调整?", "question_en": "How are entitlements adjusted on internal transfers?", "answer_zh": "人事系统的入离调转数据驱动下游账号与权限联动调整;周期性权限复核与全员访问自证覆盖存量权限,防止权限随岗位变动漂移累积。", "answer_en": "Joiner/mover/leaver data from HR drives downstream account and entitlement adjustments; periodic access reviews and company-wide self-attestation cover legacy grants to prevent privilege creep.", }, # ═══ 网络安全 network_security ═══ { "category": "network_security", "tags": ["segmentation", "firewall"], "question_zh": "网络是否进行安全分区与边界防护?", "question_en": "Is the network segmented with boundary protection?", "answer_zh": "是。网络架构合理划分,在网络出口及重要应用系统区域通过防火墙与网络设备建立安全区域和访问控制;托管机房内部通过 VLAN 实现二层网络隔离;网络与设备遵循基于业界最佳实践的安全配置基线。", "answer_en": "Yes. The network is segmented with firewalls and access control at egress and around critical application zones; the colocation environment uses VLAN layer-2 isolation, and devices follow hardening baselines built on industry best practice.", }, { "category": "network_security", "tags": ["ids"], "question_zh": "是否部署入侵检测与异常行为监控?", "question_en": "Do you deploy intrusion detection and anomaly monitoring?", "answer_zh": "是。在网络出口与重要安全区域部署网络入侵检测,及时发现异常攻击与违规行为;配合专职监控团队对网络设备、业务系统、流量与线路的指标进行 7×24 监控。", "answer_en": "Yes. Network intrusion detection covers egress and critical zones to surface attacks and violations promptly, complemented by a dedicated team monitoring devices, systems, traffic and links 7×24.", }, { "category": "network_security", "tags": ["zero-trust", "vpn"], "question_zh": "远程访问如何保障安全?", "question_en": "How is remote access secured?", "answer_zh": "远程办公采用零信任接入平台(统一身份认证、终端安全管控、访问权限控制与业务访问审计)与 SSL VPN(认证加密、安全检测、权限分配、访问记录),全程加密并留痕,支持任意地点安全接入业务系统。", "answer_en": "Remote work uses a zero-trust access platform (unified authentication, endpoint controls, access authorization, business-access auditing) together with SSL VPN (encryption, authentication, granular permissions, access logging); all sessions are encrypted and auditable from any location.", }, { "category": "network_security", "tags": ["wireless"], "question_zh": "无线网络如何管控?", "question_en": "How are wireless networks controlled?", "answer_zh": "办公无线为企业级统一部署(华为 WiFi6,全职场覆盖);制度禁止私自接入任何无线设备与拨号设备,新增接入须申请并经 IT 与信息安全中心评估审批;每月漏洞评估包含对非授权无线源的探测。", "answer_en": "Corporate Wi-Fi is enterprise-grade (Huawei WiFi6 across all offices); rogue wireless or dial-up devices are prohibited by policy — additions require IT/security assessment and approval — and monthly vulnerability assessments include rogue-AP detection.", }, { "category": "network_security", "tags": ["availability"], "question_zh": "办公网络的可用性如何保障?", "question_en": "How do you ensure office-network availability?", "answer_zh": "办公局域网采用 HA 架构,电源、交换机、路由器与广域网链路均双备,整体 SLA 达 99.99%;全国 5 个职场经虚拟专线组成公司内网,由北京 IT 团队集中远程运维、故障及时响应。", "answer_en": "The office LAN is fully HA — dual power, switches, routers and WAN links — with a 99.99% SLA; our five offices interconnect over virtual private lines into one corporate network, centrally operated by the Beijing IT team for rapid fault response.", }, { "category": "network_security", "tags": ["audit", "compliance"], "question_zh": "是否部署上网行为审计?", "question_en": "Is internet-usage behaviour audited?", "answer_zh": "是。按国家网络安全相关规定,在办公网络边缘部署上网行为管理系统;办公网内及经 VPN 接入的行为可记录、可回溯,满足信息安全与监管要求。", "answer_en": "Yes. In line with regulatory requirements, internet-behaviour management is deployed at the office-network edge; activity on the LAN and via VPN is recorded and traceable for security and compliance purposes.", }, # ═══ 终端安全 endpoint_security ═══ { "category": "endpoint_security", "tags": ["antivirus"], "question_zh": "终端是否部署统一的防病毒/反恶意软件?", "question_en": "Is anti-malware deployed and centrally managed on endpoints?", "answer_zh": "是。各应用系统及客户端统一部署防病毒系统,升级、扫描与报告策略集中管理,防范病毒与各类恶意软件入侵。", "answer_en": "Yes. Anti-malware is deployed across systems and endpoints with centrally managed update, scan and reporting policies to defend against viruses and malicious software.", }, { "category": "endpoint_security", "tags": ["mdm"], "question_zh": "是否使用统一终端管理(MDM)?", "question_en": "Do you manage endpoints with MDM?", "answer_zh": "是。公司终端纳入 MDM 统一管理(macOS 经 Jamf Pro,Windows 经 Microsoft Intune),设备与使用人绑定并与资产台账联动;离职设备执行标准化回收与重置流程。", "answer_en": "Yes. Endpoints are managed via MDM (Jamf Pro for macOS, Microsoft Intune for Windows), bound to owners and synced with the asset register; leaver devices follow standardized recovery and reset procedures.", }, { "category": "endpoint_security", "tags": ["admission"], "question_zh": "设备与软件接入是否有准入控制?", "question_en": "Is there admission control for devices and software?", "answer_zh": "是。只有经 IT 评估与审批的设备或软件才能部署或接入公司网络,并记录其使用情况;未经授权的无线与拨号设备一律禁止接入。", "answer_en": "Yes. Only IT-assessed and approved devices/software may be deployed on or join the corporate network, with usage recorded; unauthorized wireless or dial-up devices are strictly prohibited.", }, # ═══ 加密 encryption ═══ { "category": "encryption", "tags": ["tls", "in-transit"], "question_zh": "传输中的数据是否加密?", "question_en": "Is data encrypted in transit?", "answer_zh": "是。对外服务与内部系统访问强制 TLS 加密;与银行、保险等外部合作方的数据传输按对方要求采用链路层加密与数据层加密相结合的方式。", "answer_en": "Yes. TLS is enforced for external services and internal system access; data exchange with partners (banks, insurers, etc.) combines link-layer and payload encryption as required by the counterparty.", }, { "category": "encryption", "tags": ["at-rest"], "question_zh": "静态数据是否加密?", "question_en": "Is data encrypted at rest?", "answer_zh": "是。生产数据托管于 TiDB Cloud、AWS 等云服务,存储默认启用静态加密(AES-256);数据库连接启用 SSL 加密,生产数据库经私有链路(PrivateLink)访问,不暴露公网。", "answer_en": "Yes. Production data resides on TiDB Cloud/AWS with encryption at rest (AES-256) enabled; database connections use SSL, and production databases are reached via PrivateLink without public exposure.", }, { "category": "encryption", "tags": ["secrets", "key-management"], "question_zh": "密钥与凭据如何管理?", "question_en": "How are secrets and credentials managed?", "answer_zh": "生产凭据统一存放于 AWS SSM Parameter Store,部署时注入运行环境,镜像与代码库中不存放明文密钥;API 密钥/令牌在内部平台建立台账并监控轮换情况,长期未轮换的凭据作为安全发现跟踪处置。", "answer_en": "Production credentials are stored in AWS SSM Parameter Store and injected at deploy time — never baked into images or repositories; API keys/tokens are inventoried in our platform with rotation monitored, and stale credentials are tracked as security findings.", }, # ═══ 漏洞管理 vulnerability_management ═══ { "category": "vulnerability_management", "tags": ["scanning"], "question_zh": "是否定期进行漏洞扫描?", "question_en": "Do you run regular vulnerability scans?", "answer_zh": "是。每月对网络设备、服务器、Web 应用及非授权无线源进行漏洞评估与探测,主动及时发现安全风险,并根据评估结果制定并跟踪修复措施。", "answer_en": "Yes. Monthly vulnerability assessments cover network devices, servers, web applications and rogue wireless sources, proactively surfacing risks; remediation is planned and tracked from the results.", }, { "category": "vulnerability_management", "tags": ["patching"], "question_zh": "是否建立补丁管理流程?", "question_en": "Is there a formal patch-management process?", "answer_zh": "是。针对各系统平台建立补丁修复流程,依据评估结果对补丁进行评估、分析、测试、安装及回退操作,保证修复动作可控、可验证、可回退。", "answer_en": "Yes. A per-platform patch process covers assessment, analysis, testing, installation and rollback, keeping remediation controlled, verifiable and reversible.", }, { "category": "vulnerability_management", "tags": ["findings"], "question_zh": "发现的漏洞如何跟踪闭环?", "question_en": "How are identified vulnerabilities tracked to closure?", "answer_zh": "漏洞与安全隐患统一登记为安全发现,在内部安全平台按严重级别跟踪;接受风险须经审批并留痕,整改完成后自动对账关闭。年度渗透测试与月度扫描的结果均进入同一闭环。", "answer_en": "Vulnerabilities are registered as security findings and tracked by severity in our platform; risk acceptance requires approval and is audited, and remediated items auto-reconcile to closure. Annual pentest and monthly scan results share this loop.", }, # ═══ 日志与监控 logging_monitoring ═══ { "category": "logging_monitoring", "tags": ["monitoring", "7x24"], "question_zh": "是否有 7×24 安全监控?", "question_en": "Do you operate 7×24 security monitoring?", "answer_zh": "是。我们对各类网络设备、业务系统、网络流量与线路建立监控指标,由专职监控团队 7×24 值守;发生异常即依据安全事件响应流程进行检测与风险排查。", "answer_en": "Yes. Metrics across network devices, business systems, traffic and links are watched by a dedicated 7×24 monitoring team; anomalies immediately trigger the incident-response process for detection and triage.", }, { "category": "logging_monitoring", "tags": ["audit-log"], "question_zh": "审计日志如何管理?", "question_en": "How are audit logs managed?", "answer_zh": "关键系统按「审计即设计」原则建设:每个关键操作携带追踪标识(trace_id)写入集中审计日志,审批、配置变更与数据导出等敏感行为同样留痕;审计日志仅安全/管理员角色可查,支持按操作人、资源与时间检索追溯。", "answer_en": "Key systems are built audit-by-design: every significant action is written to centralized audit logs with a trace id, including approvals, configuration changes and data exports; logs are restricted to security/admin roles and searchable by actor, resource and time.", }, { "category": "logging_monitoring", "tags": ["signin"], "question_zh": "是否监测异常登录行为?", "question_en": "Do you monitor for anomalous sign-in behaviour?", "answer_zh": "是。登录事件持续采集并进行异常评估(异常地点、时间、频率等),异常登录作为安全发现进入处置流程;账号连续失败登录会触发告警与自动锁定。", "answer_en": "Yes. Sign-in events are continuously collected and anomaly-assessed (unusual location, time, frequency); anomalies become security findings, and repeated failures trigger alerts and automatic lockout.", }, { "category": "logging_monitoring", "tags": ["attribution"], "question_zh": "生产系统操作是否可追溯到个人?", "question_en": "Are production actions attributable to individuals?", "answer_zh": "是。全员唯一账号加统一 SSO 保证操作可归因到个人;平台操作、审批与数据导出均有带 trace_id 的审计记录,支持完整还原操作链路。", "answer_en": "Yes. Unique per-person accounts with SSO make every action attributable; platform operations, approvals and data exports carry trace-id audit records enabling full reconstruction of the activity chain.", }, # ═══ 应用安全 application_security ═══ { "category": "application_security", "tags": ["ssdlc"], "question_zh": "开发过程是否遵循安全开发生命周期(SSDLC)?", "question_en": "Does development follow a secure development lifecycle (SSDLC)?", "answer_zh": "是。从需求设计、程序设计、代码编写、测试到代码复核建立了代码安全规范与管理流程;通过加强安全意识、落实编码安全规范,并以工具化扫描与人工代码审计相结合,持续提升代码层面的安全性。", "answer_en": "Yes. Formal secure-coding standards govern requirements, design, coding, testing and code review; awareness training, enforced coding standards and a combination of automated scanning with manual code audits continually raise code-level security.", }, { "category": "application_security", "tags": ["environment-segregation"], "question_zh": "生产环境与测试/开发环境是否隔离?", "question_en": "Are production and test/development environments segregated?", "answer_zh": "是。生产与测试环境网络隔离(托管机房经 VLAN 划分独立测试区域),访问权限分离管理;公司制度明确禁止在生产环境进行测试。", "answer_en": "Yes. Production and test environments are network-segregated (dedicated VLAN test zones in the colocation site) with separate access control; testing in production is prohibited by policy.", }, { "category": "application_security", "tags": ["change-management"], "question_zh": "系统与代码变更如何管理?", "question_en": "How are system and code changes managed?", "answer_zh": "系统变更经评估、审批、测试后实施并支持回退;代码变更须经同行评审与 CI 全量检查(自动化测试、静态扫描)通过后方可合入受保护主干,发布经统一流水线执行且全程留痕。", "answer_en": "System changes are assessed, approved and tested with rollback support; code changes require peer review and passing CI (automated tests, static checks) before merging to a protected mainline, and releases run through a single audited pipeline.", }, # ═══ 数据与隐私 data_privacy ═══ { "category": "data_privacy", "tags": ["pims", "iso27701"], "question_zh": "是否建立个人信息/隐私保护管理体系?", "question_en": "Do you operate a privacy information management system?", "answer_zh": "是。我们通过 ISO/IEC 27701 隐私信息管理体系认证,明确个人信息处理的角色职责,实施数据分类分级与全生命周期管控,并与 ISO 27001 信息安全管理体系一体化运行。", "answer_en": "Yes. We are ISO/IEC 27701 certified, with defined privacy roles and responsibilities, data classification and lifecycle controls, operating as an integrated extension of our ISO 27001 ISMS.", }, { "category": "data_privacy", "tags": ["disposal"], "question_zh": "数据与介质处置(销毁)如何执行?", "question_en": "How is data / media disposal performed?", "answer_zh": "系统被处置或再利用时,按照数据分类与安全级别要求,采用通用最佳实践对系统及存储介质中的数据进行彻底删除;设备回收、转售或回购前执行标准化擦除与重置流程。", "answer_en": "When systems are disposed of or repurposed, data on systems and storage media is irreversibly erased per classification requirements using accepted best practice; devices are wiped and reset through a standardized process before recycling or resale.", }, { "category": "data_privacy", "tags": ["backup"], "question_zh": "重要数据是否备份?", "question_en": "Is critical data backed up?", "answer_zh": "是。重要信息实施备份保护以保证可用性;生产数据库(TiDB Cloud)启用自动定期备份,备份与恢复能力纳入年度灾难恢复演练验证。", "answer_en": "Yes. Critical information is protected by backups to ensure availability; production databases (TiDB Cloud) run automatic scheduled backups, and restore capability is validated in the annual disaster-recovery exercise.", }, { "category": "data_privacy", "tags": ["data-return"], "question_zh": "合同终止后能否返还或销毁客户数据?", "question_en": "Can you return or destroy customer data on contract termination?", "answer_zh": "可以。合同终止后,我们按约定返还或彻底删除客户数据,销毁遵循数据分类与介质处置要求,并可按需出具删除确认说明。", "answer_en": "Yes. On termination we return or irreversibly delete customer data as contractually agreed, following classification and media-disposal requirements, with written confirmation available on request.", }, # ═══ 业务连续性 bcp_dr ═══ { "category": "bcp_dr", "tags": ["dr-plan"], "question_zh": "是否有文档化并定期演练的灾难恢复计划?", "question_en": "Do you have a documented, regularly tested disaster-recovery plan?", "answer_zh": "是。我们制定了文档化的 IT 灾难恢复计划(IT Disaster Recovery Plan)并建立应急响应事件流程,每年对响应与灾难恢复计划进行宣讲和测试,确保安全事件与灾难发生时快速响应、快速恢复,降低业务损失。", "answer_en": "Yes. A documented IT Disaster Recovery Plan and incident-response procedures are in place, briefed and tested annually to ensure rapid response and recovery and to minimize business impact.", }, { "category": "bcp_dr", "tags": ["ha"], "question_zh": "基础设施层面有哪些高可用与容灾措施?", "question_en": "What infrastructure-level HA and resilience measures are in place?", "answer_zh": "办公网络全链路双备(SLA 99.99%);机房配置备用电源并监控其运行状态,7×24 监控环境指标并定期巡检;生产负载依托云服务的高可用与自动备份能力。", "answer_en": "Office networking is fully redundant (99.99% SLA); the data centre has monitored backup power, 24×7 environmental monitoring and regular inspections; production workloads rely on cloud HA and automated backup capabilities.", }, { "category": "bcp_dr", "tags": ["saas"], "question_zh": "关键云服务/SaaS 中断如何应对?", "question_en": "How do you handle outages of critical cloud/SaaS services?", "answer_zh": "关键系统优先采用成熟云服务与 SaaS 的高可用能力,配合 7×24 监控与告警;发生中断按事件响应流程分级处置,重大场景纳入灾难恢复计划与年度演练覆盖。", "answer_en": "Critical systems build on the HA of mature cloud/SaaS providers with 7×24 monitoring and alerting; outages are handled through tiered incident response, and major scenarios are covered by the DR plan and annual exercises.", }, # ═══ 事件响应 incident_response ═══ { "category": "incident_response", "tags": ["process"], "question_zh": "是否建立安全事件响应流程与团队?", "question_en": "Do you have a security-incident response process and team?", "answer_zh": "是。我们明确了事故、故障和薄弱点的管理部门与响应流程,建立报告、响应、评价与惩戒机制;事件处理包含根因分析,并通过改进措施确保同类事故尽可能不再发生。", "answer_en": "Yes. Responsibilities and procedures for incidents, faults and weaknesses are defined, with reporting, response, evaluation and disciplinary mechanisms; handling includes root-cause analysis and corrective actions to prevent recurrence.", }, { "category": "incident_response", "tags": ["notification"], "question_zh": "涉及客户数据的安全事件是否会通知客户?", "question_en": "Will you notify us of security incidents involving our data?", "answer_zh": "会。发生涉及客户数据的安全事件时,我们将按照合同约定的时限及适用法律法规要求,及时通知受影响客户与监管机构,并持续同步处置进展与整改结论。", "answer_en": "Yes. For incidents involving customer data we notify affected customers and regulators within contractually agreed timeframes and as required by applicable law, with ongoing updates on handling and remediation.", }, { "category": "incident_response", "tags": ["drill"], "question_zh": "是否对事件响应进行演练?", "question_en": "Are incident-response capabilities exercised?", "answer_zh": "是。应急响应与灾难恢复计划每年进行宣讲和测试;7×24 监控值守确保事件第一时间进入响应流程,演练结论用于持续改进。", "answer_en": "Yes. Incident-response and DR plans are briefed and exercised annually; 7×24 monitoring ensures immediate activation of the response process, and exercise results drive continuous improvement.", }, # ═══ 人员安全 hr_security ═══ { "category": "hr_security", "tags": ["nda"], "question_zh": "员工是否签署保密协议?", "question_en": "Do employees sign confidentiality agreements?", "answer_zh": "是。全体员工入职即签署劳动合同附带的保密条款/保密协议,明确信息保密义务与违约责任;与外部合作方合作时另行签署 NDA。", "answer_en": "Yes. All employees sign confidentiality obligations on joining, defining duties and liabilities for breaches; separate NDAs are executed with external parties as needed.", }, { "category": "hr_security", "tags": ["awareness"], "question_zh": "是否开展员工安全意识培训?", "question_en": "Do you provide security-awareness training?", "answer_zh": "是。除年度安全宣讲与制度培训外,内部平台常态化运行「安全每日一题」答题与积分排行,持续量化全员安全意识覆盖;培训与参与记录留存可供审计。", "answer_en": "Yes. Beyond annual briefings and policy training, our platform runs a continuous daily security-quiz program with leaderboards, giving measurable company-wide awareness coverage; training and participation records are auditable.", }, # ═══ 供应链 supply_chain ═══ { "category": "supply_chain", "tags": ["tprm"], "question_zh": "是否对供应商/次级处理者进行安全评估?", "question_en": "Do you security-assess your vendors and subprocessors?", "answer_zh": "是。关键供应商与云厂商须完成基于 ISO 27001:2022/27701 的安全评估问卷,由安全团队评分、评级并跟踪整改;评估在内部平台全生命周期管理,按供应商数据敏感度分级设定复评周期并自动提醒复评。", "answer_en": "Yes. Key vendors and cloud providers complete an ISO 27001:2022/27701-based security questionnaire; our security team scores, rates and tracks remediation in-platform, with tier-based reassessment cycles and automatic re-review reminders.", }, { "category": "supply_chain", "tags": ["inventory", "saas"], "question_zh": "是否维护所用第三方系统/服务清单?", "question_en": "Do you maintain an inventory of third-party systems and services?", "answer_zh": "是。我们维护完整的信息化系统与 SaaS 服务清单(含供应商、覆盖范围与启用时间),主要包括飞书、北森、金蝶、每刻、携程商旅、纷享销客及 AWS、TiDB Cloud 等主流云服务商;清单可在保密前提下按需提供。", "answer_en": "Yes. We maintain a full inventory of systems/SaaS (vendor, scope, adoption date) — including Feishu/Lark, Beisen, Kingdee, Maycur, Ctrip Business and FXiaoKe, plus major cloud providers such as AWS and TiDB Cloud — available under NDA on request.", }, # ═══ 物理安全 physical_security ═══ { "category": "physical_security", "tags": ["office-access"], "question_zh": "办公场所物理访问如何控制?", "question_en": "How is physical access to offices controlled?", "answer_zh": "各办公室部署多光谱智能人脸识别门禁,门禁网络与办公网隔离并统一管理;门禁与人事系统联动,人员入离调转实时同步权限;同时定义敏感区域并实施针对性的保护与监控策略。", "answer_en": "Offices use multi-spectral facial-recognition access control on a network isolated from the office LAN, centrally managed and synced with HR so joiner/mover/leaver changes update access in real time; sensitive areas are defined with targeted protection and monitoring.", }, { "category": "physical_security", "tags": ["datacenter"], "question_zh": "机房的物理与环境安全措施有哪些?", "question_en": "What physical and environmental controls protect the data centre?", "answer_zh": "托管机房具备等保三级等资质,配备消防设施、冗余与备用电源(含运行状态监控),系统 24 小时监控机房环境指标并安排人员定期巡检,保护计算机系统、网络设备与通信链路免受自然灾害、人为破坏和恶意攻击。", "answer_en": "The colocation facility (MLPS Level 3 certified) provides fire suppression, redundant and monitored backup power, 24-hour environmental monitoring with regular physical inspections, protecting systems, network equipment and links against natural disaster, sabotage and attack.", }, ] def upgrade() -> None: bind = op.get_bind() inserted = 0 for e in SEED: exists = bind.execute( sa.text(f"SELECT 1 FROM {TABLE} WHERE question_zh = :q LIMIT 1"), {"q": e["question_zh"]}, ).scalar() if exists: continue bind.execute( sa.text( f""" INSERT INTO {TABLE} (id, category, question_zh, question_en, answer_zh, answer_en, tags, owner_person_id, status, usage_count, last_reviewed_at, review_interval_months, source_doc_ids, created_by_person_id, created_at, updated_at) VALUES (:id, :category, :question_zh, :question_en, :answer_zh, :answer_en, :tags, NULL, 'active', 0, NOW(), 12, NULL, NULL, NOW(), NOW()) """ ), { "id": str(uuid.uuid4()), "category": e["category"], "question_zh": e["question_zh"], "question_en": e["question_en"], "answer_zh": e["answer_zh"], "answer_en": e["answer_en"], "tags": json.dumps(e.get("tags") or [], ensure_ascii=False), }, ) inserted += 1 def downgrade() -> None: # Remove only rows that are still recognisably the seed (same question, # never adopted by a person) — user-curated entries survive. bind = op.get_bind() for e in SEED: bind.execute( sa.text( f""" DELETE FROM {TABLE} WHERE question_zh = :q AND created_by_person_id IS NULL AND owner_person_id IS NULL """ ), {"q": e["question_zh"]}, )