The goal of the secret evaluation program preparation is to complete the collation of information system-related materials obtained in the evaluation preparation activities, and to provide the most basic documents and guidance programs for the on-site evaluation activities.
According to the "GM-T 0116-2021 Information System Cryptography Application Evaluation Process Guidelines" standard, the secret evaluation plan preparation includes 5 key tasks, which are briefly summarized in the following table.
| serial number | Task | input document | output document | Specific content |
| 1 | Determine the assessment object | Completed survey forms, various technical materials related to the information system under test | The evaluation object part of the secret evaluation plan | The overall structure, boundary, network area, core assets, threats faced, evaluation objects, etc. of the information system under test |
| 2 | Determine the evaluation indicators | Completed survey forms, GMT0115, cryptographic application solutions that have passed the assessment, relevant industry standards or specifications | The evaluation index part of the secret evaluation plan | Applicable and non-applicable evaluation indicators corresponding to the corresponding level of the information system under test |
| 3 | Determine the test points | The detailed network structure of the information system under test, the selected cryptographic algorithm, cryptographic technology, cryptographic products, cryptographic services and other detailed information, the cryptographic application scheme that has passed the evaluation and GMT0115 | The evaluation checkpoint part of the secret evaluation plan | Evaluation testing points, inspection content and evaluation methods |
| 4 | Determine the content of the assessment | The completed survey form, the evaluation objects, evaluation indicators and evaluation checkpoints of the secret evaluation plan, the password application plan that passed the evaluation and GMT0115 | The unit evaluation implementation part of the secret evaluation plan | Unit assessment implementation content |
| 5 | Prepare a secret review plan | Entrusted evaluation agreement, project plan, completed survey form, password application plan and GMT0115 that passed the evaluation, evaluation objects, evaluation indicators, evaluation checkpoints, evaluation content, etc. in the secret evaluation plan | Reviewed and confirmed text of the secret evaluation plan | Project overview, evaluation objects, evaluation indicators, evaluation checkpoints, unit evaluation implementation content, evaluation implementation plan, etc. |
1. Determine the evaluation object
Analyze the entire information system under test and its related business application systems, as well as related password applications, and determine the evaluation objects.
| serial number | mission name | Specific content |
| 1.1 | Identify the basic situation of the information system under test | Organize and identify the information system under test (1) Physical environment (computer room) (2) Network topology and external boundary connections (3) Business application system (4) Computer hardware equipment (5) Network security equipment (6) Cryptographic products and cryptographic services used (7) Identify all the above relevant password application process conditions |
| 1.2 | Describe the information system under test | (1) Describe the overall structure (2) Describe the external boundary connection and main boundary equipment (3) Describe the network area composition, main business functions and related equipment nodes (4) Describe all the password application processes involved |
| 1.3 | Determine the assessment object | (1) Determine the core assets that need to be protected (including business applications, business data, or certain equipment and components of business applications) (2) Determine other supporting data that needs to be protected (audit information, configuration information, access control list, etc.), sensitive security parameters (keys) (3) Related threat models and security policies |
| 1.4 | Asset and Threat Assessment | (1) Determine asset value (importance and criticality), divided into high-medium-low levels (2) Determine the frequency of possible threats, divided into high-medium-low levels |
| 1.5 | Describe the subject of the assessment | According to the classification of evaluation objects, each type of evaluation object is described in the form of a list. Evaluation objects generally include: computer rooms, business application software, hosts and servers, databases, network security products with password functions, password products, password services, system-related personnel, security management system documents and record form documents, etc. |
2. Determination of evaluation indicators
The evaluation indicators for this evaluation are determined according to the system grading results and the password application schemes that have passed the evaluation.
| serial number | mission name | Specific content |
| 2.1 | Select the evaluation index corresponding to the corresponding level | Select all evaluation indicators according to the grading results and GMT0115 |
| 2.2 | Determining special evaluation indicators | Determine the special evaluation indicators according to the relevant industry standards or specifications of the system under test and the password application requirements of the information system under test |
| 2.3 | Determine the applicability of the evaluation indicators | According to the security policy of the information system under test and the requirements of relevant standards, confirm the applicability of each index item by item against the password application scheme that has passed the evaluation |
| 2.4 | Check all that do not apply | Check and evaluate all non-applicable items one by one, demonstrate their security requirements in detail, the specific reasons for non-applicability, and whether other alternative risk control measures that can meet security requirements are adopted (especially in the case of passwordless application solutions) |
3. Determination of evaluation checkpoints
需要对一些关键点进行现场检查确认（如抓包测试、查看关键设备配置等方法），以防止密码产品、密码服务虽然被正确配置、但是未接入被测信息系统之类的情况发生，从而确认密码算法、密码技术、密码产品和密码服务的合规、正确和有效性。在测评方案中确定检查点，并且充分考虑到检查的可行性和风险，能最大限度的避免对被测信息系统的影响，尤其应避免对在线运行业务系统造成影响。
| 编号 | 任务名称 | 具体内容 |
| 3.1 | 列出需要接受现场检查的关键设备和检查内容 | 关键设备一般为承载核心资产流转、进行密钥管理的设备。检查内容包括： (1)密码算法、密码技术（协议和密码管理）、密码产品和服务 (2)相关配置是否与密码应用需求相符 (3)是否满足GMT0115中的相关条款要求 |
| 3.2 | 确定测试路径和工具接入点 | 结合网络拓扑图，用图示的方式描述测评工具的接入点、测试目的、测试途径和测试对象等相关内容 |
四、测评内容确定
确定各单元测评实施内容（以表格形式给出，表格内容包括测评指标、测评内容描述等）。
| 编号 | 任务名称 | 具体内容 |
| 4.1 | 确定可以具体实施测评的单元 | 将各层面上的测评指标结合到具体的测评对象上，并说明具体的测评方法 |
| 4.2 | 确定单元测评实施的工作内容 | 结合已选定的测评指标和测评对象，概要说明现场单元测评实施的工作内容 |
| 4.3 | 确定现场测评测试内容 | 涉及现场测评部分时，应根据确定的测评检查点，编制相应的测试内容 |
五、密评方案编制
| 编号 | 任务名称 | 具体内容 |
| 5.1 | 整理项目信息及相关概述 | 项目来源、被测单位整体信息化建设情况及被测信息系统与其他信息之间的连接情况等 |
| 5.2 | 整理测评依据 | 明确测评活动所要依据和参考的与密码算法、密码技术、密码产品和密码服务等相关的标准规范 |
| 5.3 | 估算现场测评工作量 | 具体根据配置检查的节点数量、工具测试的接入点及测试内容等情况估算 |
| 5.4 | 编制工作安排 | 基于项目组成员分工，编制工作安排 |
| 5.5 | 编制测评实施计划 | 包括现场工作人员的分工和时间安排（避免业务高峰；测评要求一并提出） |
| 5.6 | 汇总形成密评方案 | 汇总以上所有内容及方案编制活动中其他任务获取的内容，形成密评方案 |
| 5.7 | 方案内部评审 | 密评方案经测评方内部评审通过 |
| 5.8 | 被测单位确认 | 测评方评审通过的密评方案提交被测单位签字确认 |