This standard is under the jurisdiction of the China Elevator Association, and is jointly compiled by the National Industrial Information Security Development Research Center and domestic IoT technology enterprises. It is applicable to the whole process data security management of design, development, deployment, operation and maintenance, and destruction of elevator IoT systems, covering all links of elevator terminal equipment, network transmission, platform services and applications. The core contents of the standard include: first, establishing the overall framework of data security, constructing a data security protection system for elevator IoT in accordance with the principles of "classification and grading, whole life cycle protection, compliance and controllability, minimum necessity", and clarifying the core security requirements for the whole life cycle of data collection, transmission, storage, use, processing, provision and destruction; second, standardizing the hierarchical and classified management of data, dividing elevator IoT data into four levels: public data, internal data, sensitive data and core data according to the sensitivity and importance of the data, clarifying the security protection requirements and access control rules of different levels of data, among which the core safety data of elevator operation and user personal information are listed as sensitive data and core data; third, refining the technical requirements for data security in the whole life cycle, for the data collection link, clarifying the minimum necessary collection principle, and prohibiting the collection of personal information unrelated to elevator operation and safety management; for the data transmission link, formulating special technical requirements for data encryption, identity authentication and integrity verification, mandating the use of national cryptographic algorithms to encrypt the transmission of core data; for the data storage link, clarifying the specifications for data backup, disaster recovery and storage encryption; for the data destruction link, formulating special standards for complete data deletion and medium destruction; fourth, strengthening the security protection requirements for platforms and terminals, formulating special specifications for security architecture, access control, intrusion detection and vulnerability protection for elevator IoT platforms; for elevator terminal collection equipment, clarifying the technical requirements for device secure boot, firmware security and authority management; fifth, improving the personal information protection specifications, strictly adapting to the requirements of the Personal Information Protection Law, clarifying the compliance requirements for the collection, use and sharing of personal information in the elevator IoT scenario, and formulating special rules for user informed consent, authority withdrawal and information deletion; sixth, establishing a data security management and emergency disposal system, clarifying the data security management responsibility, organizational structure and personnel management requirements of the elevator IoT operator, formulating the emergency response, disposal process and post-event traceability specifications for data security incidents, and establishing a data security risk assessment and regular audit system. The implementation of this standard has comprehensively standardized the data security management of China's elevator IoT industry, guaranteed the data security and personal information rights and interests in the process of elevator intelligent development, and also promoted the integration of China's elevator IoT data security standards with international standards, providing compliant technical support for the global export of China's smart elevators and IoT systems.