Cryptographic Application Security Assessment: Technical Overview, Testing Items, and Compliance Pro

Cryptographic application security assessment is a systematic evaluation that verifies whether information systems apply commercial cryptography correctly, effectively, and in compliance with the Cryptography Law of the People's Republic of China and the national baseline standard GB/T 39786-2021. This guide explains the technical framework, testing samples, testing items, evaluation methodologies, industry applications, and frequently asked questions to help system operators prepare for and pass the assessment.

Technical Overview

Cryptographic application security assessment, also known as commercial cryptography application security assessment, is a structured evaluation process that measures whether an information system uses cryptographic techniques and commercial cryptography products correctly, effectively, and in conformity with applicable national standards. The assessment examines both the technical deployment of cryptography and the management controls that govern its lifecycle, producing an evidence-based compliance conclusion that supports regulatory obligations and risk reduction.

The assessment is grounded in a clear regulatory and standards framework, which typically includes the following elements:

• The Cryptography Law of the People's Republic of China, effective January 1, 2020, which requires operators of critical information infrastructure to conduct commercial cryptography application security assessment.
• GB/T 39786-2021, Information security technology — Baseline requirements for cryptography application in information systems, which defines graded technical and management requirements for Levels 1 through 4.
• GB/T 22239-2019, the multi-level protection scheme baseline, with which the cryptographic assessment is closely coordinated as part of the overall classified protection evaluation cycle.
• International references such as ISO/IEC 19790 for security requirements of cryptographic modules and ISO/IEC 17025 for the competence of testing laboratories.

The standard defines four ascending requirement levels aligned with the security protection grade of the information system. Evaluation uses a deduction-based quantitative scoring model combined with risk analysis, where the deduction assigned to each deficiency depends on the likelihood that a threat will exploit the deficiency and the importance of the affected assets. The final conclusion is expressed as compliant, basically compliant, or non-compliant, accompanied by rectification recommendations.

Testing Samples

The objects of evaluation are complete information systems and the cryptographic products, modules, and services operating within them. Typical categories of assessment samples include the following.

Government and Public Sector Information Systems

Administrative approval platforms, government service portals, office automation systems, and data sharing exchanges that process sensitive citizen and administrative data and are frequently graded at Level 3 or above, making cryptographic assessment a regulatory priority.

Critical Information Infrastructure Systems

Systems supporting finance, energy, transportation, telecommunications, water conservancy, healthcare, and public services, whose failure would harm national security, the economy, or public welfare and which fall under statutory assessment obligations.

Cloud Computing and Big Data Platforms

Infrastructure as a service, platform as a service, and data analytics environments where cryptographic responsibilities are shared between the cloud provider and the tenant, requiring careful evaluation of key management boundaries and tenant isolation mechanisms.

Industrial Control and IoT Systems

Supervisory control and data acquisition systems, distributed control systems, and large-scale sensor networks where resource-constrained devices must still satisfy identity authentication, integrity protection, and secure channel requirements.

E-Commerce, Payment, and Enterprise Business Systems

Online payment gateways, transaction processing platforms, and enterprise resource planning systems that protect transaction integrity, account credentials, and personal financial information using cryptographic mechanisms.

Cryptographic Products and Modules in Use

Hardware security modules, secure gateways, signature verification servers, smart key devices, VPN equipment, and cryptographic application middleware deployed within the target system, whose certification status and correct configuration are verified during the assessment.

Testing Items

Testing items are organized into four technical security domains and two management domains as defined by GB/T 39786-2021. The applicable items and their depth depend on the target requirement level.

Physical and Environmental Security

Evaluation of cryptographic protection at the physical perimeter and operating environment of the system, including:

• Identity authentication for physical access using cryptographic digital signatures or secure credentials.
• Video monitoring data integrity protection using message authentication codes based on approved hash functions.
• Authenticated and encrypted transmission channels for remote voice, video, and monitoring equipment.

Network and Communication Security

Evaluation of cryptography applied to communication boundaries, including:

• Secure communication protocols, such as VPN tunnels based on the SM2, SM3, and SM4 algorithm suite, protecting data in transit across untrusted networks.
• Mutual identity authentication between communication parties using digital certificates.
• Integrity protection of critical session data and anti-replay mechanisms at the network boundary.

Device and Computing Security

Evaluation of cryptographic safeguards on servers, operating systems, databases, and trusted computing components, including:

• Cryptographic-based authentication for remote login and local administrative access.
• Integrity verification of important executable programs, configuration files, and system images.
• Trusted root of trust measurement and remote attestation where trusted computing is deployed.
• Integrity protection of system resources, audit logs, and access control information.

Application and Data Security

The most extensive domain, covering application-layer cryptography for the most important assets:

• User identity authentication using digital signatures, digital certificates, or dynamic password technologies.
• Confidentiality of sensitive data in transmission, using symmetric encryption with negotiated session keys.
• Confidentiality of important data in storage, such as encrypted database fields, files, and backups.
• Integrity and authenticity of data, logs, and messages using message authentication codes or digital signatures.
• Non-repudiation of critical transactions through server-side and client-side digital signatures.

Key Management

Verification of the full key lifecycle, including key generation with adequate entropy, secure distribution, encrypted storage, controlled usage, timely update, secure archival, revocation, and destruction, together with documentation of key management roles, procedures, and emergency plans.

Management Systems, Personnel, Construction, and Operation

Assessment of governance controls, including the existence and completeness of cryptographic management strategy and institutional documents, personnel screening and training, key management officer designation, procurement of certified commercial cryptography products, secure development and implementation processes, routine operations and audits, emergency response plans, and incident handling records.

Testing Methods

Qualified assessment bodies and accredited third-party laboratories apply a combination of qualitative and technical methods to collect objective evidence, as outlined below.

• Documentation review: systematic examination of system topology, security design documents, key management plans, product certification certificates, operational records, and prior evaluation reports.
• Interview and on-site inspection: structured interviews with administrators, security officers, and key custodians, together with physical walkthroughs of machine rooms and equipment areas.
• Configuration and compliance verification: inspection of cryptographic product configurations, certificate chains, algorithm parameters, protocol versions, and cipher suites to confirm that SM2, SM3, SM4, SM9, and ZUC algorithms are enabled where required and deprecated or non-compliant algorithms are disabled.
• Traffic capture and protocol analysis: packet capture at critical interfaces to verify that communication channels are genuinely encrypted and authenticated, and to detect downgrade or weak negotiation behavior.
• Functional and security testing: verification of authentication effectiveness, session key freshness, anti-replay controls, integrity verification triggers, and non-repudiation functions, supplemented by vulnerability scanning and controlled penetration testing of cryptographic implementations.
• Key lifecycle examination: tracing key generation, backup, update, and destruction operations against documented procedures and technical controls.

Findings are consolidated through the deduction-based quantitative model prescribed for the assessment, in which each deficiency receives a deduction value derived from threat likelihood and asset importance. Assessors then perform overall risk analysis, determine the compliance conclusion, and issue a formal assessment report with prioritized rectification recommendations. The typical workflow proceeds through preparation, assessment planning, on-site evaluation, analysis and scoring, report issuance, and rectification verification.

Applications

Cryptographic application security assessment results are used across multiple compliance and engineering scenarios, including statutory compliance for critical information infrastructure, coordination with classified protection grading evaluation for Level 3 and Level 4 systems, system acceptance before go-live, procurement verification of certified cryptographic products, and periodic reassessment after major architecture or application changes.

Principal industry sectors that routinely rely on the assessment include:

• Government and public administration agencies operating Level 3 and above service platforms.
• Banking, securities, insurance, and payment institutions protecting transaction and customer data.
• Energy grid operators, oil and gas enterprises, and water utility providers.
• Railway, aviation, and logistics operators managing dispatch and ticketing systems.
• Telecommunication carriers and internet data center providers.
• Hospitals, health insurance platforms, and regional health information exchanges.
• Universities, research institutions, and state-owned enterprises managing sensitive operational data.

FAQ

Q: Which systems are required to undergo cryptographic application security assessment?

A: Under the Cryptography Law of the People's Republic of China, operators of critical information infrastructure that uses commercial cryptography must conduct the assessment. In addition, networks graded at security protection Level 3 and above are generally expected to undergo assessment in coordination with their classified protection evaluation cycle, and system owners at any level may voluntarily commission an assessment to strengthen security.

Q: How often must the assessment be performed?

A: Under current regulatory guidance, operators of critical information infrastructure and networks at Level 3 and above typically conduct the assessment at least once a year. A new assessment is also required after significant changes to the system, such as upgrades of core applications, changes to cryptographic architecture, or migration of deployment environments.

Q: What is the difference between requirement levels in GB/T 39786-2021?

A: Level 1 provides baseline recommendations and permits autonomous selection of appropriate protection measures, Level 2 adds mandatory requirements for important systems, Level 3 imposes stricter controls including certified cryptographic products and comprehensive key management for important systems, and Level 4 applies the most rigorous requirements to systems whose compromise would cause particularly severe harm.

Q: What happens if the system receives a non-compliant conclusion?

A: The assessment report will itemize each deficiency with its deduction value and provide rectification recommendations. The system owner implements corrective measures, such as replacing non-compliant algorithms, deploying certified cryptographic products, or improving key management procedures, and then requests a reassessment to verify closure of the findings.

Q: Do cryptographic products used in the system need certification?

A: For systems at higher requirement levels, GB/T 39786-2021 requires that significant cryptographic products and modules hold valid commercial cryptography product certification or equivalent qualification, and assessors verify certificates, versions, and configurations as part of the evaluation evidence.

Q: Who is qualified to perform the assessment?

A: The assessment must be carried out by qualified assessment bodies approved by the national cryptography regulatory authority, typically operating as accredited third-party laboratories conforming to ISO/IEC 17025, with authorized assessors who hold recognized professional qualification for commercial cryptography evaluation.

Q: How long does a typical assessment take?

A: Depending on system scale and architecture, the full engagement, from document collection and planning through on-site testing and report issuance, commonly takes several weeks, with the on-site phase ranging from a few days for a single application system to several weeks for a large distributed platform.