GB/T 45576-2025 网络安全技术 网络安全保险应用指南

ICS35.030

CCSL80

中华人民共和国国家标准

GB/T45576—2025

网络安全技术网络安全保险应用指南

Cybersecuritytechnology—Guidelinesforapplicationofcybersecurityinsurance

2025⁃04⁃25发布2025⁃11⁃01实施

国家市场监督管理总局

国家标准化管理委员会发布

GB/T45576—2025

目次

前言··························································································································Ⅲ

1范围·······················································································································1

2规范性引用文件········································································································1

3术语和定义··············································································································1

4网络安全保险应用概述·······························································································2

4.1目的和作用········································································································2

4.2主要角色与责任··································································································2

4.3基本应用流程·····································································································4

5网络安全保险保障范围·······························································································5

5.1概述·················································································································5

5.2事件类型···········································································································5

5.3损失类型···········································································································6

6投保前风险评估········································································································6

6.1确定保险需求·····································································································6

6.2实施风险评估·····································································································7

6.3保险核保与定价··································································································9

7保险期间风险控制·····································································································9

7.1日常风险管理·····································································································9

7.2保险人风险控制··································································································9

7.3实施风险控制····································································································10

8出险后事件评估······································································································10

8.1应急响应与索赔·································································································10

8.2实施事件评估····································································································11

8.3保险理赔··········································································································11

附录A（资料性）网络安全保险需求及应用场景·································································13

A.1网络安全保险需求分析·······················································································13

A.2网络安全保险必要性··························································································13

A.3网络安全保险应用场景及示例··············································································14

附录B（资料性）保险业务活动与网络安全·······································································16

附录C（资料性）网络安全保险其他考虑事项····································································17

C.1保险金额·········································································································17

C.2免赔额和免赔期间·····························································································17

C.3常见除外责任···································································································17

Ⅰ

GB/T45576—2025

附录D（资料性）基于风险场景的量化分析方法·································································18

D.1风险场景示例···································································································18

D.2风险量化分析示例·····························································································18

参考文献····················································································································20

Ⅱ

GB/T45576—2025

前言

本文件按照GB/T1.1—2020《标准化工作导则第1部分：标准化文件的结构和起草规则》的规

定起草。

本文件由全国网络安全标准化技术委员会（SAC/TC260）提出并归口。

本文件起草单位：北京源堡科技有限公司、国家工业信息安全发展研究中心、中国电子技术标准化

研究院、中国人民财产保险股份有限公司、中国信息安全测评中心、公安部第一研究所、国家计算机网

络与信息安全管理中心、公安部第三研究所、国家信息技术安全研究中心、国家信息中心、中国网络空

间研究院、中国科学院信息工程研究所、中国信息通信研究院、中国太平洋财产保险股份有限公司、中国

平安财产保险股份有限公司、中国财产再保险有限责任公司、中国人寿财产保险股份有限公司、建信财

产保险有限公司、国任财产保险股份有限公司、诚泰财产保险股份有限公司、前海再保险股份有限公司、

中国移动通信集团有限公司、中国联合网络通信集团有限公司、北京中测安华科技有限公司、中电长城

网际系统应用有限公司、蚂蚁科技集团股份有限公司、北京京能信息技术有限公司、深信服科技股份有

限公司、广州竞远安全技术股份有限公司、北京神州绿盟科技有限公司、启明星辰信息技术集团股份有

限公司、北京天融信网络安全技术有限公司、国网思极网安科技（北京）有限公司、北京威努特技术有限

公司、远江盛邦（北京）网络安全科技股份有限公司、长扬科技（北京）股份有限公司、奇安信科技集团股

份有限公司、杭州安恒信息技术股份有限公司。

本文件主要起草人：陈幼雷、梁露露、韩冰、李强、孙倩文、王秉政、王惠莅、王建勇、刘敏、王海洋、

宋璟、姜伟、胡光俊、李秋香、韩煜、刘明、陈妍、曹岳、王笑强、王佳慧、宋首友、刘玉岭、廖剑、孟楠、戴方芳、

雷兴华、刘愉、刘怡、周俊华、李君杰、房珊、李萌、沈铭新、吕晔楠、袁捷、邱勤、韩浩、常文娟、张兴、赵远杰、

李季、胡维、何武红、丁雨晗、李淼、白晓媛、殷国强、孔勇、何刚、欧阳周婷、刘玉荟、张静、李祉岐、李之云、

权晓文、任高锋、汪义舟、安锦程、来泽枫。

Ⅲ

GB/T45576—2025

网络安全技术网络安全保险应用指南

1范围

本文件描述了网络安全保险的目的和作用、主要角色和责任，给出了基本应用流程、保障事件类型

和损失类型，提出了网络安全保险应用各阶段的方法。

本文件适用于组织购买和使用网络安全保险以及网络安全保险机构开展网络安全保险业务，应用

网络安全保险的其他相关方参考执行。

2规范性引用文件

下列文件中的内容通过文中的规范性引用而构成本文件必不可少的条款。其中，注日期的引用文

件，仅该日期对应的版本适用于本文件；不注日期的引用文件，其最新版本（包括所有的修改版）适用于

本文件。

GB/T20984—2022信息安全技术信息安全风险评估方法

GB/T20986—2023信息安全技术网络安全事件分类分级指南

GB/T22081—2024网络安全技术信息安全控制

GB/T36687—2018保险术语

3术语和定义

GB/T36687—2018界定的以及下列术语和定义适用于本文件。

3.1

网络安全保险cybersecurityinsurance

承保因发生网络安全事件所造成的经济损失以及需承担的法定赔偿责任的一种财产保险。

注：网络安全保险属于广义的财产保险范畴，数字资产等无形资产可作为该险种的保险标的。

3.2

保险人insurer

与投保人订立保险合同，并按照合同约定承担赔偿或者给付保险金责任的保险公司。

[来源：GB/T36687—2018，2.4]

3.3

投保人applicant

与保险人签订保险合同，并按照保险合同负有支付保险费义务的主体。

[来源：GB/T36687—2018，2.5，有修改]

3.4

被保险人insured

与保险人分担网络安全风险的主体，其财产受保险合同保障，享有保险金请求权。

[来源：GB/T36687—2018，2.6，有修改]

注：投保人可以为被保险人。

3.5

保险标的subjectofinsurance

作为保险对象的财产及其相关利益或在保险合同中所载明的对象。

1

GB/T45576—2025

[来源：GB/T36687—2018，2.22，有修改]

3.6

财产保险propertyinsurance

以财产及其有关利益为保险标的的保险。

[来源：GB/T36687—2018，2.2]

注：财产保险包括财产损失保险、责任保险、信用保险、保证保险等。

3.7

服务方serviceprovider

为网络安全保险业务提供风险评估、风险管理、安全检测、应急响应、事件评估、理赔查勘、法律咨

询等专业服务的机构。

注：在网络安全保险业务中，保险人或被保险人均可根据实际需求委托服务方开展相关服务。

3.8

网络安全保险单cybersecurityinsurancepolicy

网络安全保险合同成立后，保险人向投保人签发的保险合同的正式书面凭证。

[来源：GB/T36687—2018，5.3.1，有修改]

3.9

第三者thethirdparty

除了投保人、被保险人、被保险人的高级管理人员和任何雇员以外的其他自然人或法人。

4网络安全保险应用概述

4.1目的和作用

网络安全保险是一种风险处置手段，其目的是帮助组织管理风险、增强风险应对能力，对组织因网

络安全事件导致的经济损失进行补偿。网络安全事件所造成的经济损失既包含组织自身的损失，也包

含对第三者的赔偿责任。

与传统财产保险以有形财产及其相关经济利益为保险标的不同，网络安全保险的保险标的既包括

有形财产，也包括无形财产。网络安全保险主要承保网络空间的安全风险，如遭受网络攻击、恶意程序

（病毒）感染、数据泄露、系统功能错误或失效等。

网络安全保险的作用如下所述：

a）补偿网络安全事件所导致的经济损失，降低潜在影响；

b）预防和减少网络安全事件所造成的损失和危害；

c）为应急响应及恢复提供资金支持；

d）协助组织恢复正常运营；

e）提高对网络安全风险的抵御能力；

f）降低网络安全风险管理的总体成本。

网络安全保险需求和应用场景见附录A。为方便表述，以下将组织称为投保人或被保险人。

4.2主要角色与责任

4.2.1主要角色

网络安全保险应用主要角色及相互关系如图1，具体如下所述。

a）保险人：

保险人承保被保险人或投保人网络安全风险，并为其提供相关服务，宜包括风险评估和核保，协助

2

GB/T45576—2025

被保险人进行风险控制、应急响应、事件评估、理赔勘察等服务；同时保险人宜接受服务方的服务，保险

人通常是指保险机构。

b）投保人：

投保人投保网络安全保险，向保险人支付保费，宜接受保险人和服务方的服务，当投保人为自己投

保时，投保人即被保险人，投保人为其他法人主体投保时，投保人和被保险人是不同法人主体。

c）被保险人：

被保险人与保险人分担网络安全风险，有保险金请求权，宜接受保险人和服务方的服务。

d）服务方：

宜为保险人、被保险人或投保人提供网络安全保险应用相关服务；服务方宜受保险人或被保险人

委托；根据服务内容宜将服务方划分不同角色，包括为保险人或被保险人提供风险评估、应急响应、事

件评估、损失评估和法律咨询的服务方，以及作为独立第三方角色的检测或仲裁机构等服务方；服务方

宜满足相关资质或标准，如提供网络安全服务参考GB/T32914—2023。

图1网络安全保险应用主要角色及相互关系

4.2.2主要责任

4.2.2.1保险人

保险人的责任宜包括以下内容。

a）对所承保的风险进行核保和定价，在保险期间依据保险合同规定的责任和义务提供服务。

b）依据保险合同双方的约定开展风险管理，如协助被保险人实施风险控制，当风险发生显著变

化时，通知被保险人并提供处置建议。

c）在出险理赔时协助被保险人开展应急响应、事件评估、理赔勘察等服务，并向被保险人说明需

要提供的信息。

d）对被保险人的相关信息负有保密责任。

4.2.2.2被保险人

被保险人的责任宜包括以下内容。

a

）确认网络安全保险需求。

b）配合保险人或其委托的服务方实施风险评估。

c）保险期间开展必要的风险管理活动。

d）出险后开展必要的应急响应工作，避免损失扩大。

e）向保险人提供事件评估结果及相关日志等数据。

f）出险后在约定时间内通知保险人。

3

GB/T45576—2025

4.2.2.3投保人

投保人的责任宜包括以下内容。

a）根据网络安全保险合同，按期缴纳保险费。

b）保险人对保险标的的情况进行询问时，如实告知。

4.2.2.4服务方

服务方的责任宜包括以下内容。

a）对保险标的进行风险评估，支持保险人开展核保和定价。

b）协助保险人进行风险控制，如进行风险监测和预警。

c）协助被保险人进行事件的应急响应。

d）协助保险人对事件进行技术评估和损失影响分析。

e）对保险人、被保险人的相关信息负有保密责任。

f）提供其他法律诉