ChinaNational Cybersecurity Incident Reporting Measures
Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued ) Arts. 2, 4, 5, 8, 9, 12, 14
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a network operator, meaning the owner, manager, or network service provider of a network, that builds or operates a network, or provides a service through a network, inside China; because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express rather than a narrower guess.
- On discovering or becoming aware of a cybersecurity incident affecting your own operations, grade it against China's four-tier National Cybersecurity Incident Classification and Grading Guide (especially major, major, relatively major, ordinary), and report only where you grade it relatively major or above; an ordinary incident carries no report duty under this instrument.NIST CSF 2.0RS.MA-03
- Where the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident.NIST CSF 2.0RS.CO-02
- Where you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident.NIST CSF 2.0RS.CO-02
- Every other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident.NIST CSF 2.0RS.CO-02
- A major or especially major incident additionally triggers an escalation between government bodies up to the national cyberspace administration after you report; that further escalation is not a step you perform yourself.
- Where your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly.NIST CSF 2.0RS.CO-02
- Where an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer.NIST CSF 2.0GV.SC-05
- Within 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report.NIST CSF 2.0RC.RP-06
- Taking reasonable and necessary protective measures, disposing of the incident under your emergency plan, effectively reducing its impact, and reporting it as required can draw a lighter consequence, or none at all, for a reporting shortfall elsewhere in the same incident.
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China, official Q&A on the Measures for the Administration of National Cybersecurity Incident Reporting (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- RS.MA-03Incidents are categorized and prioritized
- RS.CO-02Internal and external stakeholders are notified of incidents
- RC.RP-06The end of incident recovery is declared based on criteria, and incident-related documentation is completed
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 10 refers a violation of this reporting duty to the competent department for punishment under other law, and aggravates only administratively, a heavier penalty on the operator and its responsible persons, where late, missed, false, or concealed reporting caused major harm; the Measures name no criminal offense of their own for a reporting failure.
Who enforces it
Enforcement body
The competent department with jurisdiction over the network operator penalizes a reporting failure under other law. Day-to-day intake and coordination run through the national cyberspace administration department, which coordinates cybersecurity incident report management nationwide, and each province's cyberspace administration department, which coordinates it within its own administrative region.
Settledness
The Cyberspace Administration's own Q&A page restates the same clocks and channels Article 4 states and does not resolve the open question above; no court has construed this instrument and it is not under challenge as of the date shown.
- As of
- Guidance link
- https://www.cac.gov.cn/2025-09/15/c_1759583021718167.htm
- Guidance body
- Cyberspace Administration of China, official Q&A on the Measures for the Administration of National Cybersecurity Incident Reporting
- Open questions
- Does Article 4's critical-information-infrastructure reporting channel require the reporting network operator to itself be the designated critical-information-infrastructure operator under the separate Critical Information Infrastructure Security Protection Regulation, or does it also reach a network operator whose own-unit incident merely touches critical information infrastructure that a different entity operates?
What this law does
A network operator that builds or operates a network, or provides a service through a network, within the territory of China must report a cybersecurity incident under these Measures. These Measures define a network operator as the owner, manager, or network service provider of a network.
These Measures also define a cybersecurity incident as an event that, due to human causes, a network attack, a network vulnerability or hidden danger, a hardware or software defect or malfunction, force majeure, or another factor, harms a network or information system or the data and business applications within it and has a negative impact on the state, society, or the economy.
On discovering or becoming aware of an incident involving its own unit, a network operator must grade the incident against the annexed National Cybersecurity Incident Classification and Grading Guide and report only where the grade is relatively major or above. Where the incident involves critical information infrastructure, the operator must report to the sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of it.
A network operator that is a department of a central or state organ, or a directly affiliated unit of one, must report to its own department's cyberspace affairs unit within 2 hours. Every other network operator must report to the cyberspace administration department of its own province within 4 hours.
A major or especially major incident escalates further between the government bodies that received the operator's report, up to the national cyberspace administration, without imposing any additional step on the reporting operator itself.
A network operator must require, by contract, any organization or individual providing it network-security or system-operation-and-maintenance services to promptly report to it any cybersecurity incident that provider discovers through monitoring, and to assist the operator's own reporting under these Measures.
Within 30 days of completing disposal of a relatively major incident or above, the operator must submit a summary report on the incident's cause, its emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel used for the original report.
A failure to report as required draws a penalty under other law, and reporting late, missing a report, or filing a false or concealed report that causes major harm draws a heavier penalty on the operator and its responsible persons. An operator that took reasonable and necessary protective measures, disposed of the incident under its emergency plan, effectively reduced the incident's impact, and reported it as required may be treated leniently or not held accountable at all.
A report involving a state secret follows the rules of the relevant department instead of the general channel described here.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .