ChinaNetwork Product Security Vulnerability Management Provisions, network operator duty to repair
Arts. 8 and 13 Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security)
In force since .
A security baseline statutes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to a network operator, meaning the owner or manager of a network or a provider of services over one, so it reaches an app developer that runs its own servers or service (Articles 2 and 8).
- On finding or learning that your network, information system or equipment has a security vulnerability, take measures at once, verify the vulnerability in good time and complete its repair (Article 8).
- Keep a channel for receiving vulnerability information open and unobstructed, and keep the receipt logs for at least 6 months (Article 5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
A network operator that finds or learns that its network, information system or equipment has a security vulnerability must take measures at once, verify the vulnerability in good time and complete its repair. Article 5 also requires a network operator to keep its channel for receiving vulnerability information open and to keep the receipt logs for at least 6 months.
Where an operator does not take the repair or preventive measures the Provisions require, the competent authorities handle it according to law, and Article 13 sends a case that amounts to the situation described in Article 59 of the Cybersecurity Law to that Law's penalty. Article 27 of the Cybersecurity Law as amended on requires a network operator to formulate a cybersecurity incident emergency plan and to deal in good time with security risks such as system vulnerabilities.
Article 61 of that Law provides a warning and a fine of 10,000 to 50,000 yuan for failing the duties in Articles 23 and 27 and, where the operator refuses to correct or the violation endangers network security, a fine of 50,000 to 500,000 yuan.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, records calls, records text chat or tracks devices.