Abstract: The transportation information system is not only a critical component of the national key information infrastructure, but also an important industry of the 2+8+N system, in which is crucial to the nation’s economy and people’s livelihood. With the continuous advancement of smart transportation construction, the volume of traffic data is growing rapidly. The position of data as a production factor highlights its importance and value, and also induces higher demands for data security. The transportation industry pays close attention to data security, and based on national policies, laws, regulations, and standards, the competent transportation authorities have issued a series of industry standards and regulations to guide the security of transportation data. However, the transportation industry covers a wide range of business areas, and its data has characteristics such as multisource, heterogeneity, partiality, spatiotemporal correlation, asynchronicity, information sparsity, and concurrency. Moreover, the data has a high degree of mobility, and the operational conditions and flow are complex, making data surveillance a large range and great difficulty, which brings a series of challenges to the protection of data security. Based on existing laws, regulations, and standards, and deeply integrating the characteristics of transportation industry data, this research on the data security risk assessment system provides a reference for the construction of transportation data security protection.

Key words: smart transportation, data security, data asset identification, data classification and grading, risk assessment, risk level

摘要： 交通运输既是国家关键信息基础设施，也是信创2+8+N体系的重要行业，对于国计民生至关重要.随着智慧交通建设工作持续推进，各类交通运输数据飞速增长，加之数据要素的提出，凸显数据的重要性和价值，也对数据安全提出更高的要求.交通运输行业对数据安全工作高度关注，基于国家相关政策和法律法规、标准规范，交通运输主管部门出台了一系列的行业标准、规章，为交通运输数据安全提供指引.但是交通运输行业业务涉及范围广，其数据具有多源、异质、局部性、时空关联、异步性、信息稀疏性和并发性等特点，同时，数据流动性极大，运行情况与流向复杂，监管范围与难度很大，给数据安全保护工作带来一系列挑战.以现有的法律法规和标准规范为基础，深度结合交通运输行业数据特点，对其数据安全风险评估体系进行研究，为交通运输数据安全保护建设工作提供参考.

关键词: 智慧交通, 数据安全, 数据资产识别, 数据分类分级, 风险评估, 风险等级