ChinaNetwork Product Security Vulnerability Management Provisions, publishing and collecting vulnerability information
Arts. 9 10 and 14, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to an organization or individual that discovers, collects or publishes network product security vulnerabilities, and to one that sets up a vulnerability collection platform (Articles 2, 9 and 10).
- Do not publish a network product vulnerability before the product's provider has provided a repair measure; if you think earlier publication is necessary, assess it with the provider, report to the Ministry of Industry and Information Technology and the Ministry of Public Security, and publish only after they have organized an assessment (Article 9, item 1).
- Publish a repair or preventive measure at the same time as the vulnerability (Article 9, item 5).
- Do not publish the details of a vulnerability in a network, information system or equipment that a network operator is using, and do not publish a vulnerability during a major national event without the consent of the Ministry of Public Security (Article 9, items 2 and 6).
- Do not give undisclosed network product vulnerability information to an organization or individual outside China other than the product's provider (Article 9, item 7).
- File a vulnerability collection platform you set up with the Ministry of Industry and Information Technology (Article 10).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
A person that discovers or collects network product vulnerabilities and publishes vulnerability information to the public through a network platform, the media, a conference or a competition must not publish it before the product's provider has provided a repair measure, unless it considers earlier publication necessary, assesses the matter with the provider, reports to the Ministry of Industry and Information Technology and the Ministry of Public Security, and publishes only after those ministries have organized an assessment.
It must publish a repair or preventive measure at the same time as the vulnerability. It must not publish the details of a vulnerability in a network, information system or equipment that a network operator is using. It must not give undisclosed vulnerability information to an organization or individual outside China other than the product's provider. It must not publish a vulnerability during a major national event without the consent of the Ministry of Public Security.
A vulnerability collection platform set up by any organization or individual must be filed with the Ministry of Industry and Information Technology.
Article 14 provides that collecting or publishing vulnerability information in breach of the Provisions is handled by the Ministry of Industry and Information Technology and the Ministry of Public Security according to their duties, and that a case amounting to the situation described in Article 62 of the Cybersecurity Law is penalized under that provision.
In the Cybersecurity Law as amended on , Article 65 provides a warning and a fine of 10,000 to 100,000 yuan for carrying out security certification, testing or risk assessment, or publishing system vulnerability information to the public, in breach of Article 28, and a fine of 100,000 to 1,000,000 yuan where the violator refuses to correct or the circumstances are serious.