Security Accreditation Scheme for UICC Production - Methodology
UICC生产安全认可计划 - 方法论

Version 10.1
版本 10.1

12 April 2023
二零二三年四月十二日

Security Classification: Non-confidential
安全分类：非机密

Access to and distribution of this document is restricted to the persons permitted by the security classification. This document is subject to
本文件的访问和分发仅限于安全分类允许的人员。本文档受制于

copyright protection. This document is to be used only for the purposes for which it has been supplied and information contained in it must not be disclosed or in any other way made available, in whole or in part, to persons other than those permitted under the security classification without
版权保护。本文件仅用于提供本文件的目的，其中所含信息不得全部或部分披露或以任何其他方式提供给安全分类所允许的人以外的人，除非

the prior written approval of the Association.
协会事先书面批准。

Copyright Notice
版权声明

Copyright © 2023 GSM Association
版权所有 © 2023 GSM 协会

Disclaimer
免責聲明

The GSM Association (“Association”) makes no representation, warranty or undertaking (express or implied) with respect to and does not accept any responsibility for, and hereby disclaims liability for the accuracy or completeness or timeliness of the information contained in this document. The information contained in this document may be subject to change without prior notice.
GSM协会（“协会”）对本文档所含信息的准确性、完整性或及时性不作任何陈述、保证或承诺（明示或暗示），也不承担任何责任，特此声明不承担任何责任。本文件所载资料如有更改，恕不另行通知。

Compliance Notice
合规通知

The information contain herein is in full compliance with the GSM Association’s antitrust compliance policy.
此处包含的信息完全符合GSM协会的反垄断合规政策。

This Permanent Reference Document is classified by GSMA as an Industry Specification, as such it has been developed and is maintained by GSMA in accordance with the provisions set out in GSMA AA.35 - Procedures for Industry Specifications.
本永久参考文件被GSMA归类为行业规范，因此由GSMA根据GSMA AA.35 - 行业规范程序中的规定制定和维护。

Table of Contents
目录

1 Introduction 5
1 引言 5

1.1 Overview 5
1.1 概述 5

1.2 Scope 5
1.2 范围 5

1.3 Intended Audience 5
1.3 目标受众 5

1.4 Language 5
1.4 语言 5

1.5 Definitions 6
1.5 定义 6

1.6 Abbreviations 8
1.6 缩略语 8

1.7 References 8
1.7 参考资料 8

2 Participants 9
2 参与者 9

2.1 Auditee 9
2.1 被审计方 9

2.2 Audit Team 9
2.2 审计组 9

2.2.1 Observing Auditor 9
2.2.1 旁听审计师 9

2.3 SAS Group 10
2.3 SAS 组 10

2.4 Audit Management 11
2.4 审计管理 11

2.5 Participant Relationships 11
2.5 参与者关系 11

3 Audit Process 13
3 审计流程 13

3.1 Audit Setup 13
3.1 审计设置 13

3.1.1 Audit Request 13
3.1.1 审计请求 13

3.1.2 Confirmation of Audit Date 13
3.1.2 确认审计日期 13

3.1.3 Contract 13
3.1.3 合同 13

3.2 Audit Preparation (off-site) 13
3.2 审核准备（场外） 13

3.2.1 Audit Agenda 13
3.2.1 审计议程 13

3.2.2 Audit Pre-requisites 14
3.2.2 审计先决条件 14

3.3 Audit Process (on-site) 14
3.3 审核流程（现场） 14

3.3.1 Presentation and Documentation for the Audit Team 14
3.3.1 审计组的列报和文件编制 14

3.3.2 Information collection 14
3.3.2 信息收集 14

3.3.3 Assessment of compliance 14
3.3.3 遵守情况评估 14

3.3.4 Preparation of the Audit Report 15
3.3.4 审计报告的编制 15

3.3.5 Presentation of the Audit Results 15
3.3.5 审计结果的列报 15

3.4 Distribution of the Audit Report 15
3.4 审计报告的分发 15

3.5 Certification 16
3.5 认证 16

3.6 Appeal 16
3.6 上诉 16

3.7 Notification and Publication of Certification 16
3.7 认证的通知和公布 16

4 Certification Process 17
4 认证流程 17

4.1 Certification Process 17
4.1 认证流程 17

4.2 Certification Period 17
4.2 认证期限 17

4.3 Duration of Certification 18
4.3 认证期限 18

4.3.1 Standard durations 18
4.3.1 标准工期 18

4.3.2 Exceptions 19
4.3.2 例外 19

4.3.3 Minimum period of certification 19
4.3.3 最短认证期限 19

4.3.4 Extension of the period of certification 19
4.3.4 延长认证期限 19

5 Scope of certification 20
5 认证范围 20

5.1 Provisional Certification 20
5.1 临时认证 20

5.1.1 Provisional Certification Process 20
5.1.1 临时认证流程 20

5.1.2 Provisional Certification Period 21
5.1.2 暂定认证期 21

5.1.3 Duration of Provisional Certification 21
5.1.3 临时核证期限 21

5.1.4 Duration of Provisional Certification Audits 22
5.1.4 临时认证审核的期限 22

5.2 Auditing and Certification of Supporting Sites 22
5.2 支持站点的审核和认证 22

5.2.1 Definition 22
5.2.1 定义 22

5.2.2 Auditing and Certification Approach 23
5.2.2 审核和认证方法 23

Centralised or Outsourced IT Services 23
集中或外包的IT服务 23

5.3 Management of PKI Certificates 24
5.3 PKI证书的管理 24

6 Audit Report Scoring and Assessment 26
6 审计报告评分与评估 26

6.1 Audit Result 26
6.1 审计结果 26

7 Maintaining SAS Compliance 28
7 维护 SAS 合规性 28

7.1 Notifiable Events for PKI certificate management 28
7.1 PKI 证书管理的通报事件 28

7.2 Examples of other Notifiable Events 28
7.2 其他须予通报的事件例子 28

7.2.1 What should be Notified 29
7.2.1 应通知的内容 29

7.2.2 What Would not Normally Require Notification: 29
7.2.2 通常不需要通知的内容： 29

8 Costs 30
8 费用 30

8.1 First Audit or Renewal Audit 30
8.1 首次审计或续期审计 30

8.2 Audit of Small and Large Sites, and Sites with Limited Scope 31
8.2 小型和大型站点以及范围有限的站点的审核 31

8.3 Audit of Central / Corporate Functions 31
8.3 中央/公司职能的审计 31

8.4 Repeat Audit 31
8.4 重复审计 31

8.5 Off-Site Review of Improvements 32
8.5 改进的场外审查 32

8.6 Cancellation Policy 33
8.6 取消政策 33

8.7 Appeals 33
8.7 上诉 33

Annex A Sample audit agenda 34
附件A 审计议程样本 34

Annex B Audit modules 35
附件B 审计单元 35

B.1 Audit modules 35
B.1 审计单元 35

Annex C Sample required documents list 47
附件 C 所需文件清单样本 47

C.1 Document List 47
C.1 文件清单 47

C.1.1 Security Management System (modules B, C) 47
C.1.1 安全管理系统（B、C单元） 47

C.1.2 Key Management (modules J, K) 47
C.1.2 密钥管理（模块 J、K） 47

C.1.3 Production (modules O, P) 47
C.1.3 生产（模块O、P） 47

C.1.4 Human Resources (module D) 47
C.1.4 人力资源（D单元） 47

C.1.5 Security Internal Audit System (module U) 48
C.1.5 安全内部审计系统（模块U） 48

Annex D Collection of information 49
附件D 资料收集 49

Information 49
信息 49

Annex E Assessment of compliance 52
附件 E 遵约评估 52

E.1 Audit assessment and compliance 52
E.1 审计评估和遵守情况 52

Annex F Final Audit Report Structure 56
附件F 最终审计报告结构 56

F.1 First Page: 56
F.1 首页： 56

F.2 Following Pages: 56
F.2 以下页数：56

Annex G Data Processing Audit 59
附件 G 数据处理审计 59

G.1 Before the Audit 59
G.1 审计前 59

G.1.1 Preparation 59
G.1.1 准备工作 59

G.1.2 Key Exchange 59
G.1.2 密钥交换 59

G.1.3 Input File Exchange 60
G.1.3 输入文件交换 60

G.1.4 Processing of Input File 1 60
G.1.4 输入文件的处理 1 60

G.1.5 Output File Exchange 60
G.1.5 输出文件交换 60

G.1.6 Timescales 60
G.1.6 时间表 60

G.2 During the Audit 60
G.2 审计期间 60

G.2.1 Review of Key Exchange 60
G.2.1 密钥交换审查 60

G.2.2 Review of Input File 1 Processing 60
G.2.2 输入文件审查 1 处理 60

G.2.3 Demonstration of Input File 2 Processing 61
G.2.3 输入文件 2 处理演示 61

G.3 After the Audit 61
G.3 审计后 61

Annex H Document Management 62
附件 H 文件管理 62

H.1 Document History 62
H.1 文件历史 62

H.2 Other Information 63
H.2 其他信息 63

1 Introduction
1 引言

1.1 Overview
1.1 概述

The GSMA Security Accreditation Scheme (SAS) for UICC Production (SAS-UP) is a
GSMAUICC生产安全认证计划（SAS）是一个

scheme through which UICC suppliers subject their production Sites to an Audit. The
UICC供应商对其生产基地进行审核的方案。这

purpose of the Audit is to ensure that UICC suppliers have implemented adequate security measures to protect the interests of mobile network operators (MNOs).
审计的目的是确保UICC供应商已实施足够的安全措施，以保护移动网络运营商（MNO）的利益。

Audits are conducted by specialist Auditing Companies over a number of days, typically in a single Site visit. The Auditors will check compliance against the GSMA SAS-UP Standard[1]
审核由专业审核公司在几天内进行，通常在一次现场访问中进行。审核员将检查是否符合GSMA SAS-UP标准[1]

and the requirements specified in[3]by various methods such as document review
以及[3]中规定的要求，通过各种方法，如文件审查,

interviews and tests in specific areas. Sites that demonstrate compliance with the SAS-UP Standard are certified by the GSMA.
特定领域的面试和测试。符合SAS-UP标准的网站将获得GSMA认证。

NOTE: All references to UICCs and UICC suppliers in this document apply equally
注意：本文档中对 UICC 和 UICC 供应商的所有引用均适用

to eUICCs and eUICC suppliers unless specifically stated otherwise.
除非另有特别说明，否则向 eUICC 和 eUICC 供应商提供。

1.2 Scope
1.2 范围

This scope of this document covers:
本文档的范围包括：

• SAS-UP participating stakeholders and their roles
• SAS-UP参与的利益攸关方及其作用

• Processes for arrangement and conduct of an SAS-UP Audit
• SAS-UP审计的安排和实施流程

• Audit scoring and Audit Report structure
• 审计评分和审计报告结构

• Certification and Provisional Certification Processes
• 认证和临时认证程序

• SAS-UP costs
• SAS-UP成本

1.3 Intended Audience
1.3 目标受众

• Security professionals and others within UICC supplier organisations seeking to obtain accreditation for Sites under SAS-UP.
• UICC供应商组织内寻求获得SAS-UP站点认证的安全专业人员和其他人员。

• Security professionals and others within organisations seeking to procure UICCs
• 寻求采购 UICC 的安全专业人员和组织内的其他人

• SAS Group members
• SAS集团成员

• Auditors
•核 数 师

1.4 Language
1.4 语言

The language of the scheme is English.
该计划的语言是英语。

The language of the scheme will be used for the management and administration of the scheme itself, and for the Audit Process.
该计划的语言将用于计划本身的管理和行政，以及审计过程。

The Audit will, in all cases, be conducted in the language of the scheme. The Auditee is responsible to ensure that documents are available in the language of the scheme, as described inAnnex C. .Other documents may be in a language other than English but translation facilities should be available during the conduct of the Audit.
在所有情况下，审计都将以该计划的语言进行。被审计方有责任确保文件以计划的语言提供，如附件C所述。其他文件可能使用英语以外的语言，但在进行审计期间应提供翻译设施。

Where it is likely to be difficult to conduct Audit discussions with personnel in English,
如果可能难以用英语与人员进行审计讨论，

Auditees should arrange for one or more translators with knowledge of the business and subject matter to be available to the Audit Team.
被审计方应安排一名或多名具有业务和主题知识的翻译人员提供给审计组。

1.5 Definitions
1.5 定义

See section2for more detailed explanations of SAS-UP roles
有关SAS-UP角色的更详细说明，请参见第2节.

1.6 Abbreviations
1.6 缩略语

1.7 References
1.7 参考资料

2 Participants
2 参与者

The following section describes the roles of the participants during the standard Audit
以下部分介绍参与者在标准审核期间的角色

Process. The role of the Appeals Board is not considered here (see section3.6for details instead).
过程。这里不考虑上诉委员会的作用（详见第3.6节）。

2.1 Auditee
2.1 被审计单位

The Auditee is the participant in the UICC supply chain that is to be subject to Audit. The Auditee is responsible for:
被审核方是UICC供应链中要接受审核的参与者。被审计方负责：

• Providing all necessary information during the Audit to enable the Audit Team to perform its assessment of compliance with SAS-UP requirements for activities within the scope of certification.
• 在审核期间提供所有必要的信息，使审核小组能够对认证范围内的活动是否符合 SAS-UP 要求进行评估。

• Ensuring that all key individuals are present when required.
• 确保所有关键人员在需要时都在场。

• Delivering a short presentation at the beginning of the Audit describing how it believes that it is compliant with the Standard [1], and the relevant documentation that will be made available to the Audit Team during the Audit.
• 在审核开始时做一个简短的介绍，描述它如何认为它符合标准[1]，以及在审核期间将提供给审计小组的相关文件。

• Disclosing to the Audit Team all areas of the Site where assets related to UICC production may be created, stored or processed. The Auditee may be required by the Audit Team to demonstrate that other areas of the Site are not being used to create, store or process relevant assets, and should honour any reasonable request to validate this
• 向审计小组披露网站中可能创建、存储或处理与UICC生产相关的资产的所有区域。审计团队可能会要求被审计方证明网站的其他区域未用于创建、存储或处理相关资产，并应遵守任何合理的请求以验证这一点.

2.2 Audit Team
2.2 审计小组

The Audit Team consists of two independent Auditors, one from each of the Auditing
审计组由两名独立审计员组成，每个审计组各一名

Companies selected by the GSMA following a competitive tender for the supply of SAS auditing services and in accordance with selection criteria defined by the GSMA.
GSMA根据GSMA定义的遴选标准，通过竞争性招标选出提供SAS审核服务的公司。

The Audit Team conducts the Audit by reviewing documentation, conducting interviews with key individuals and carrying out tests in key areas. After the Audit is conducted, the Audit
审计小组通过审查文件、与关键人物进行访谈和在关键领域进行测试来进行审计。审计完成后，审计

Team writes a report (see3.3.4)
团队编写报告（见3.3.4）.

The independence of the Audit Team is of paramount importance to the integrity of the
审计小组的独立性对审计组的诚信至关重要

scheme. It is recognised that the chosen Auditing Companies are professional in the conduct of their business. Where the Auditing Companies previously supplied consultancy services
方案。我们认可所选择的审计公司在开展业务方面是专业的。审计公司以前提供咨询服务的地方

to an Auditee, the GSMA should be informed of this fact prior to commencement of the Audit, and the Auditors performing the Audit should be different individuals to those who have provided the consultancy services.
对于被审计者，GSMA应在审计开始前被告知这一事实，并且执行审计的审计师应与提供咨询服务的审计师是不同的个人。

2.2.1 Observing Auditor
2.2.1 观察审计员

On some audits, an additional observing SAS Auditor may accompany the Audit Team, in order to:
在一些审计中，审计团队可能会有一名额外的观察员陪同审计小组，以便：

• Support the development of a common understanding of SAS-UP between the Auditing Companies
• 支持审计公司之间就SAS-UP达成共识

• Ensure consistency in standards and the Audit Process
• 确保标准和审核流程的一致性

• Facilitate sharing of best practice in the Audit approach
• 促进分享审计方法中的最佳做法

Audit observation will be carried out at no additional cost to the Auditee, and subject to the following guidelines:
审计观察将不向被审计者收取额外费用，并遵守以下准则：

• A maximum of one observer will be present on any one Audit, except by the prior agreement with the Auditee. Auditees will be under no obligation to agree to any requests for participation of more than one observer.
• 任何一次审计最多有一名观察员在场，除非事先与被审计人达成协议。被审计方没有义务同意任何要求一名以上观察员参加的请求。

• The observer will comply with all requirements of the Auditee
• 观察员将遵守被审计方的所有要求:

• Prior to the Audit (e.g. signing NDAs, providing personal information for visitor authorisation).
• 在审核之前（例如签署保密协议，为访客授权提供个人信息）。

• On-site (e.g. behaviour and supervision).
• 现场（例如行为和监督）。

• The role of the observer is to observe. The observation process should not interfere with the conduct of the Audit. Specifically, the observing Auditor should:
• 观察者的作用是观察。观察过程不应干扰审计的进行。具体而言，观察审计师应：

• Not normally engage directly with the Auditee during the Audit Process to ask Audit questions
• 在审计过程中，通常不会直接与被审计者接触以询问审计问题.

• Only engage in discussion with the Auditee about the observer’s own SAS scheme when such discussion will not interfere with the Audit Process.
• 只有在不干扰审计过程的情况下，才与被审计者就观察员自己的SAS计划进行讨论。

• Not present or participate in any discussions during the closing meeting.
• 在闭幕会议期间不出席或参与任何讨论。

• Not contribute to the preparation of the Audit Report.
• 不参与编制审计报告。

To maximise the benefits of the observation process the observer and Audit Team are expected to discuss elements of the Audit Process and approach. Such discussions:
为了最大限度地发挥观察过程的好处，观察员和审计小组应讨论审计过程的要素和方法。这样的讨论：

• Should only take place outside of the Audit Process, and not in the presence of the Auditee.
• 只能在审计程序之外进行，不得在被审计者在场的情况下进行。

• Should include an opportunity for the observer to read the Audit Report.
• 应包括观察员阅读审计报告的机会。

• May include a post-Audit discussion, either on- or off-site to discuss any questions or observations. The post-Audit discussion may be extended to include other Auditors if appropriate.
• 可能包括审计后讨论，在现场或场外讨论任何问题或意见。审计后的讨论可酌情扩大到包括其他审计师。

Members of the Audit Management may also seek to attend and observe audits from time to time. They guidelines above will also apply to them.
审计管理层成员亦可不时出席及旁听审计工作。上述准则也适用于他们。

2.3 SAS Group
2.3 SAS集团

The SAS Group is a committee comprised of GSMA staff (including the Audit Management)
SAS集团是一个由GSMA员工（包括审计管理层）组成的委员会

and members, and representatives of the Auditing Companies. It is responsible for maintenance of the following SAS-UP documentation:
以及审计公司的成员和代表。它负责维护以下 SAS-UP 文档：

• The Standard[1]which contains the security objectives for SAS-UP
• 标准[1]，其中包含SAS-UP的安全目标.

• The Consolidated Security Requirements and Guidelines (CSRG)[3]which
• 综合安全要求和准则 （CSRG）[3]其中:

• Provides requirements for all sensitive processes (SPs) within the scope of the different SAS schemes. Many of the requirements are common across all schemes, however some requirements are specific to individual SPs, including UICC production. The requirements that apply to UICC production indicated in
• 为不同 SAS 方案范围内的所有敏感进程 （SP） 提供要求。许多要求在所有方案中都是通用的，但有些要求特定于单个 SP，包括 UICC 生产。适用于UICC生产的要求

that document. These are the requirements that the UICC supplier must satisfy in order to be certified.
该文件。这些是UICC供应商必须满足的要求才能获得认证。

• Provides guidelines to guide interpretation and operational application of the requirements
• 提供指导要求的解释和操作应用的准则

• The Methodology (this document)
• 方法论（本文件）

Updates will normally arise from an annual review meeting of the SAS Group. Where acute issues are identified ad hoc meetings may be convened to discuss updates to the SAS-UP documentation.
更新通常由SAS集团的年度审查会议提供。如果发现严重问题，可以召开特别会议来讨论对SAS-UP文档的更新。

The SAS Group also contributes to the development of Auditing Company selection criteria when the GSMA is procuring SAS auditing services from time to time. Operator members of the SAS Group that do not offer any products or services within the scope of SAS will be
当GSMA不时采购SAS审计服务时，SAS集团还为审计公司选择标准的制定做出了贡献。SAS集团的运营商成员如果不在SAS范围内提供任何产品或服务，则将

invited by the GSMA to participate in the review of tender responses and the selection of Auditing Companies.
受GSMA邀请参与投标响应的审查和审计公司的遴选。

2.4 Audit Management
2.4 审计管理

The Audit Management comprises a team of GSMA staff members responsible for administering the scheme, including:
审计管理层由负责管理该计划的GSMA工作人员组成，包括：

• Selecting suitably qualified Auditing Companies to carry out the audits, in conjunction with the SAS Group as indicated in section2.3, and ensuring that they provide a high- quality service
• 如第2.3节所述，选择具有适当资格的审计公司与SAS集团一起进行审计，并确保他们提供高质量的服务.

• Ensuring that audits are conducted in accordance with the SAS-UP Methodology and that Audit Reports meet GSMA quality requirements.
• 确保审核按照SAS-UP方法进行，并确保审核报告符合GSMA的质量要求。

• Managing Audit lifecycle tasks, pre and post Audit, for example maintenance of the Audit logs and list of certified and provisionally certified Sites
• 管理审计前后的审计生命周期任务，例如维护审计日志以及认证和临时认证站点列表

• Contract and financial management between the GSMA and Auditees and the GSMA and Auditing Companies
• GSMA与被审计单位以及GSMA与审计公司之间的合同和财务管理

• Distribution of SAS-UP documentation (this document, the Standard [1], the Consolidated Security Requirements and Guidelines [3], and other supporting documents to Auditees and Auditors.
• 向被审计方和审计师分发SAS-UP文件（本文件、标准[1]、综合安全要求和指南[3]以及其他支持文件）。

• Handling general queries for example, via sas@gsma.com.
• 处理一般查询，例如，通过sas@gsmacom

2.5 Participant Relationships
2.5 参与者关系

The relationships between SAS-UP participants are indicated inFigure 1.
SAS-UP参与者之间的关系如图1所示。

Figure 1: SAS-UP Participant Relationships
图 1：SAS-UP 参与者关系

3 Audit Process
3 审核流程

The Audit Process is described below.
审计流程如下所述。

3.1 Audit Setup
3.1 审计设置

3.1.1 Audit Request
3.1.1 审计请求

If an entity involved in the UICC production chain wishes to be SAS-UP certified, the entity should present itself to the Audit Management as a potential participant in the scheme.
如果参与UICC生产链的实体希望获得SAS-UP认证，则该实体应向审计管理层表明自己是该计划的潜在参与者。

Prior to contacting the Audit Management, the potential participant should have familiarised itself with the current published scheme documentation.
在联系审计管理部门之前，潜在参与者应熟悉当前发布的计划文件。

The potential participant should contact the Audit Management to obtain a copy of the Audit Application Form and supporting guidance notes. The completed Audit Application Form
潜在参与者应联系审计管理部门，以获取审计申请表和支持性指导说明的副本。填妥的审核申请表

should be formally submitted to the Audit Management to request a certification audit. On receipt of the request the Audit Management will log the details of the request.
应正式提交给审核管理层，以请求认证审核。收到请求后，审计管理部门将记录请求的详细信息。

Audit applications should be submitted to the GSMA several months in advance to increase the likelihood of the SAS Audit Teams being available to conduct an Audit on or near the
审核申请应提前几个月提交给GSMA，以增加SAS审核团队在

dates requested by the Auditee. As a guide:
被审员要求的日期。作为指南：

Table 1 - Audit Scheduling Guidance
表 1 - 审核计划指南

It always remains the responsibility of the Auditee to ensure that certification is in place to meet the requirements of any specific contract, customer or bid.
被审核方始终有责任确保认证到位，以满足任何特定合同、客户或投标的要求。

3.1.2 Confirmation of Audit Date
3.1.2 审核日期的确认

After logging the details of the Audit request, the information is sent to the Audit Team. The Audit Team will contact the Auditee to agree Audit dates.
记录审核请求的详细信息后，信息将发送给审核团队。审计小组将与被审计方联系，商定审计日期。

3.1.3 Contract
3.1.3 合同

The Auditee enters into a standard agreement[2]with the GSMA and pays the GSMA in advance for the Audit.
被审计方与GSMA签订标准协议[2]，并提前向GSMA支付审计费用。

3.2 Audit Preparation (off-site)
3.2 审核准备（场外）

After Audit dates have been agreed, the Audit Team and Auditee will liaise to agree arrangements for the Audit.
在商定审计日期后，审计团队和被审计方将联络以商定审计安排。

3.2.1 Audit Agenda
3.2.1 审计议程

A provisional agenda will normally be agreed at least one week before the Audit Team travels to the Site to be audited.
一般在审计组前往现场接受审计之前至少一周，将商定一个临时议程。

A sample agenda is included in Annex A. The sample agenda includes guidance for Auditees on information that should be prepared for each element of the Audit.
议程样本载于附件A。议程样本包括为被审计单位提供的关于应为审计的每个要素准备的信息的指南。

Changes to the agenda may need to be made during the Audit itself, as agreed between the Audit Team and Auditee.
根据审计组和被审计人之间的商定，可能需要在审计期间对议程进行更改。

3.2.2 Audit Pre-requisites
3.2.2 审核先决条件

To assist in the process of auditing the data generation process (for Sites where this is part of the audit or certification scope), the Audit Team may request that a test/demonstration of the Site’s data processing operations is carried out. The process may include advance
为了协助审核数据生成过程（对于属于审核或认证范围的站点），审核小组可能会要求对站点的数据处理操作进行测试/演示。该过程可能包括提前

arrangements with the Auditee to:
与被审计方的安排：

• Exchange transport keys
• 交换传输密钥

• Submit test input files to the Auditee
• 向被审核方提交测试输入文件

• Perform data generation for the specified test input file(s)
• 为指定的测试输入文件执行数据生成

• Return the corresponding output file(s) to the Audit Team
• 将相应的输出文件返回给审计小组

The Auditee will be expected to make appropriate arrangements within its systems to enable a test/demonstration of the data processing to take place.
被审计方应在其系统内做出适当的安排，以便对数据处理进行测试/演示。

The Audit Team will liaise with the Auditee to ensure that pre-requisites are in place.
审计小组将与被审计方联络，以确保先决条件到位。

A more detailed guide to this process for Auditees is included inAnnex G.
附件G中为被审计方提供了更详细的流程指南

3.3 Audit Process (on-site)
3.3 审核流程（现场）

The process of conducting the audit follows a number of defined phases.
进行审计的过程遵循若干规定的阶段。

3.3.1 Presentation and Documentation for the Audit Team
3.3.1 审计小组的演示和文件

During the first half day of the Audit the Auditee introduces the Site’s activities and security management system, and presents to the Audit Team the information and documentation specified in the Audit agenda.
在审核的前半天，被审核方介绍网站的活动和安全管理系统，并向审核小组提交审核议程中指定的信息和文件。

A list of the required documentation is included inAnnex C. Documentation must be available to the Audit Team in English.
所需文件清单载于附件C。文件必须以英文提供给审计组。

Based on the Audit agenda, presentation and documentation, the Audit Team agrees the key individuals to be interviewed during the Audit. It is the responsibility of the Auditee to ensure the availability of these key individuals.
根据审计议程、演示文稿和文件，审计小组同意在审计期间与关键人物进行面谈。被审计方有责任确保这些关键人员的可用性。

3.3.2 Information collection
3.3.2 信息收集

The Audit Team collects information according to the agreed agenda to form the basis of the assessment of compliance.
审计组根据商定的议程收集信息，以形成对遵守情况的评估。

The approach to collection of information is described in more detail in Annex D.
附件D更详细地描述了收集信息的方法。

3.3.3 Assessment of compliance
3.3.3 合规评估

Based on the information collected during the Audit, the Audit Team assesses the compliance of the Auditee’s controls with the SAS requirements.
根据审计期间收集的信息，审计小组评估被审计方的控制措施是否符合SAS的要求。

The assessment of compliance with the SAS requirements is described in more detail in Annex E.
附件E更详细地描述了对SAS要求的遵守情况的评估。

3.3.4 Preparation of the Audit Report
3.3.4 编制审计报告

The Audit Team summarises the findings of the Audit in a report that follows a fixed structure, as described in Annex F, that comprises
审计组在一份报告中总结了审计结果，该报告遵循附件F所述的固定结构，其中包括:

• Audit summary and overall assessment
• 审计总结和总体评估

• Summary of certification
• 认证摘要

• Auditors’ comments
• 审计员的意见

• Actions required
• 需要采取的行动

• Detailed results
• 详细结果

Detailed results are provided in an annex to the Audit Report, following the structure of the SAS requirements.
详细结果见审计报告的附件，按照SAS要求的结构提供。

3.3.5 Presentation of the Audit Results
3.3.5 审计结果的列报

The Audit Report is normally completed during the Audit and delivered to the Auditee on completion of the closing meeting.
审计报告通常在审计期间完成，并在闭幕会议结束后交付给被审计方。

During the final half day of the Audit, the Audit Team will normally finalise the Audit Report. The Audit Team will present the Audit Results to the Auditee, focussing on the key points identified in the Audit Report.
在审计的最后半天，审计组通常会完成审计报告。审计组将向被审计人提交审计结果，重点关注审计报告中确定的要点。

The Audit Result includes the Audit Team’s decision on certification of the Site, which is passed to the Audit Management.
审核结果包括审核小组对网站认证的决定，该决定将传递给审核管理层。

It is not deemed necessary to have a slide presentation, or to undertake a detailed review of the Audit Report, as part of the presentation of the Audit Results.
作为审计结果介绍的一部分，认为没有必要进行幻灯片演示或对审计报告进行详细审查。

3.4 Distribution of the Audit Report
3.4 审计报告的分发

On completion, the Audit Team will distribute the Audit Report to:
完成后，审计小组将把审计报告分发给：

• The Auditee for the purpose of internal review and formulation of action plan(s).
• 被审计方进行内部审查和制定行动计划。

• The Audit Management for the purpose of quality control and certification.
• 以质量控制和认证为目的的审核管理。

Neither the Auditee nor Audit Management will distribute the report to any other party as part of the Audit Process, except:
作为审计过程的一部分，被审计方和审计管理层都不会将报告分发给任何其他方，但以下情况除外：

• In case of an appeal (see below), the Audit Report will also be provided to the Appeals Board.
• 如有上诉（见下文），审计报告也将提供给上诉委员会。

• For the purpose of Auditor training and SAS quality management, the Audit Report may be provided by the Audit Management to other SAS-UP and SAS-SM Auditors.
• 出于审核员培训和SAS质量管理的目的，审核管理层可能会向其他SAS-UP和SAS-SM审核员提供审核报告。

The Auditee is free to distribute the report to its customers, but is responsible to ensure that neither the Audit Findings, Audit Result or status of Certification are misrepresented.
被审核方可以自由地将报告分发给其客户，但有责任确保审核结果、审核结果或认证状态均未被歪曲。

3.5 Certification
3.5 认证

The Audit Management checks the report to confirm that the Audit has been carried out in accordance with this Methodology document and that the report meets GSMA quality
审核管理层会检查报告，以确认审核已按照本方法文件进行，并且报告符合GSMA质量

requirements.
要求。

In the event of a successful Audit the Audit Management issues a Certificate to the Auditee within fifteen (15) business days of completion of the Audit.
如果审核成功，审核管理层将在审核完成后十五 （15） 个工作日内向被审核方颁发证书。

3.6 Appeal
3.6 上诉

In the event that the certification decision and/or duration of certification are in dispute the Auditee may lodge a submission with the Audit Management within twenty (20) business
如果认证决定和/或认证期限有争议，被审核方可以在二十 （20） 项业务中向审核管理层提交意见

days of completion of the Audit. The Audit Management will refer the appeal to the Appeals Board.
审计完成后的天数。审计管理部门将把上诉转交上诉委员会。

The Appeals Board is comprised of two Auditors, one each from different GSMA selected Auditing Companies and separate from the Auditing Companies that performed the Audit that is the subject of the appeal. For SAS-UP, the Appeals Board is comprised of
上诉委员会由两名审计师组成，分别来自不同的GSMA选定的审计公司，并且与执行上诉标的审计的审计公司分开。对于SAS-UP，上诉委员会由以下人员组成

representatives of the SAS-SM Auditing Companies, and vice versa. The individual Auditors from each Auditing Company that serve on the Appeals Board may be assigned by those
SAS-SM审计公司的代表，反之亦然。在上诉委员会任职的各审计公司的个人审计师可由以下人员指派

Auditing Companies from a pool of suitably experienced Auditors pre-approved by the GSMA, and may change per appeal.
从GSMA预先批准的具有适当经验的审计师库中选出的审计公司，并可能因上诉而改变。

The Appeals Board will consider and rule on appealed Audit Results. The process to be followed by the Appeals Board will include:
上诉委员会将考虑并裁定被上诉的审计结果。上诉委员会应遵循的程序将包括：

• Review of the Audit Report, focussing on the appealed assessment(s)
• 审查审计报告，重点关注被上诉的评估

• Discussion with the Audit Team and the Auditee The Appeals Board should not need to visit the Site.
• 与审计小组和被审计方的讨论 上诉委员会不应访问该网站。

The Auditee may request the members of the Appeals Board to sign an NDA prior to receiving a copy of the Audit Report and other information about the Site.
被审计方可以要求上诉委员会成员在收到审计报告副本和有关本网站的其他信息之前签署保密协议。

The Appeals Board will seek to rule on appeals within twenty (20) business days of
上诉委员会将寻求在二十 （20） 个工作日内对上诉作出裁决

lodgement of the appeal, subject to the availability of the Audit Team and the Auditee and the prompt provision of any information requested from either party.
提出上诉，但须视审计组和被审计方的出席情况以及任何一方要求提供的任何资料而定。

The Auditee and the Audit Team agree to accept the decision of the Appeals Board as final.
被审计方和审计小组同意接受上诉委员会的决定为最终决定。

A description of the costs associated with the appeals process is included in section0.
第0节中包括了与上诉程序相关的费用说明。

3.7 Notification and Publication of Certification
3.7 认证的通知和公布

The GSMA will list certified Sites on theSAS website. The listing will include
GSMA将在SAS网站上列出经过认证的网站，该列表将包括:

• The Auditee name and the address of the certified Site.
• 被审核机构名称和认证站点的地址。

• The scope of certification, including whether the certification is full or provisional.
• 认证范围，包括认证是全面认证还是临时认证。

• The expiry date of the certification
• 认证的有效期.

• Details of any exceptions or specific comments that apply to the Site’s certificates.
• 适用于本网站证书的任何例外情况或特定评论的详细信息。

4 Certification Process
4 认证流程

The Certification Process is described below.
认证过程如下所述。

4.1 Certification Process
4.1 认证流程

The Certification Process begins with the first full Audit, first Dry Audit (provisional certification) or Renewal Audit at a Site.
认证过程从现场的第一次全面审核、第一次干审核（临时认证）或更新审核开始。

The Certification Process ends when:
认证过程在以下情况下结束：

• A Certificate is issued based on the decision of the Audit Team.
• 根据审核小组的决定颁发证书。

or

• The Site withdraws from the Certification Process by either:
• 本网站通过以下任一方式退出认证流程：

• Indicating that it does not intend to continue with the Certification Process.
• 表明不打算继续进行认证程序。

or

• Not complying with the Audit Team’s requirements for continuing with the Certification Process following a non-compliant Audit Result (Typically, the Audit Team requires the Site to arrange a Repeat Audit, or to provide appropriate evidence of improvement within agreed periods).
• 在审核结果不合规后，不遵守审核小组的要求，继续进行认证流程（通常，审核小组要求现场安排重复审核，或在约定的期限内提供适当的改进证据）。

For an existing certified Site the Certification Process can begin up to 3 months before the expiry of the current Certificate.
对于现有的认证站点，认证过程可以在当前证书到期前 3 个月开始。

4.2 Certification Period
4.2 认证期限

The Certification Period begins when a Certificate is issued based on the decision of the Audit Team
认证期从根据审核小组的决定颁发证书时开始.

The Certification Period ends at the date specified on the Site’s SAS Certificate.
认证期在网站SAS证书上指定的日期结束。

The Certification Period will be determined by the Audit Team based on the following criteria:
认证期限将由审核小组根据以下标准确定：

• For Sites with an existing valid Certificate:
• 对于具有现有有效证书的站点：

• If the Certification Process begins up to 3 months before the expiry of the existing Certificate
• 如果认证过程在现有证书到期前 3 个月开始

and

• the certification is awarded before the expiry of the existing Certificate
• 该证书是在现有证书到期之前颁发的

then
然后

• the Certification Period will begin at the expiry of the existing Certificate
• 认证期将从现有证书到期时开始

In all other cases the Certification Period will begin at the time that the Certificate is issued.
在所有其他情况下，认证期将从证书颁发时开始。

Existing
现存

Certificate
证书

Certification
认证