88 lines
4.0 KiB
Markdown
88 lines
4.0 KiB
Markdown
# CLAUDE.md
|
|
|
|
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
|
|
|
## Repository Overview
|
|
|
|
This repository contains security operation manuals and compliance documentation for the Suzhou Education E-Card platform, implementing China's Multi-Level Protection Scheme (MLPS) Level 3 requirements.
|
|
|
|
### Key Documents
|
|
|
|
- **苏州教育E卡通数据安全运维操作手册.md** - Main operational manual with 5-tier risk classification system, role-based access control, and MLPS Level 3 compliance measures
|
|
- **ff.md** - Original formal compliance document with theoretical security framework
|
|
|
|
### Architecture Focus
|
|
|
|
The operational manual implements a **5-tier risk classification system**:
|
|
|
|
1. **Level 1 Operations** (Critical Management Operations)
|
|
- Special sensitive data modifications (ID cards, names, student numbers)
|
|
- System core configuration changes
|
|
- Security policy modifications
|
|
- MLPS Level 3 required: 2FA + screen recording + dual-person execution + complete audit trail
|
|
|
|
2. **Level 2 Operations** (Important Data Modifications)
|
|
- Secondary sensitive data modifications
|
|
- MLPS Level 3 required: 2FA + approval + backup + audit logging
|
|
|
|
3. **Level 3 Operations** (General Permission Operations)
|
|
- New student registration, account creation
|
|
- MLPS Level 3 required: 2FA for critical actions + approval + session management
|
|
|
|
4. **Level 4 Operations** (Data Query Operations)
|
|
- Information queries, report generation
|
|
- MLPS Level 3 required: Access control + query audit + data masking
|
|
|
|
5. **Level 5 Operations** (Read-only Operations)
|
|
- Public information viewing, help documentation
|
|
- MLPS Level 3 required: Basic authentication + session management
|
|
|
|
### Technical Implementation
|
|
|
|
- **Field-level Access Control**: Row-level security policies with role-based data masking
|
|
- **MLPS Level 3 Authentication**: Multi-factor authentication with specific application scenarios
|
|
- **Audit Trail Integrity**: Digital signatures, SHA256 hashing, WORM storage
|
|
- **Data Integrity Protection**: Transmission validation, storage constraints, automated integrity checks
|
|
|
|
## Development Context
|
|
|
|
This is a **documentation-only repository** focused on security compliance and operational procedures rather than application code development. The main work involves:
|
|
|
|
- Updating security operation manuals based on regulatory requirements
|
|
- Implementing MLPS Level 3 compliance measures
|
|
- Creating audit and monitoring procedures
|
|
- Defining role-based access control matrices
|
|
|
|
## Common Development Tasks
|
|
|
|
Since this is primarily a documentation repository, common tasks include:
|
|
|
|
1. **Manual Updates**: Revise operational procedures based on new MLPS requirements
|
|
2. **Compliance Reviews**: Audit existing procedures against MLPS Level 3 standards
|
|
3. **Template Creation**: Develop new operation forms and checklists
|
|
4. **Policy Documentation**: Write technical implementation guidelines for security measures
|
|
|
|
## Review Guidelines
|
|
|
|
When updating documentation:
|
|
|
|
1. **MLPS Level 3 Compliance**: Ensure all procedures align with China's Multi-Level Protection Scheme requirements
|
|
2. **Practical Implementation**: Focus on operational feasibility rather than theoretical security
|
|
3. **Role Separation**: Maintain clear separation between operations, audit, and technical roles
|
|
4. **Audit Completeness**: Ensure all security controls have corresponding audit procedures
|
|
|
|
## File Structure
|
|
|
|
```
|
|
/
|
|
├── 苏州教育E卡通数据安全运维操作手册.md # Main operational manual
|
|
├── ff.md # Original formal compliance document
|
|
└── CLAUDE.md # This file
|
|
```
|
|
|
|
## Important Notes
|
|
|
|
- This repository handles **sensitive student data** - always follow MLPS Level 3 requirements
|
|
- The operational manual implements **practical security measures** rather than theoretical frameworks
|
|
- All procedures should maintain **separation of duties** between operational roles
|
|
- Documentation should be **actionable** and suitable for immediate implementation |