ChinaNetwork Product Security Vulnerability Management Provisions, product provider duties
Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace… Administration of China and Ministry of Public Security), Arts. 5, 7 and 12
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a provider of a network product, hardware or software, in China, a role a maker or distributor of software or a mobile app occupies (Articles 2 and 7).
- On finding or learning of a security vulnerability in a product you provide, take measures at once, verify the vulnerability and assess its harm and scope; where the flaw is in an upstream product or component, notify that product's provider at once (Article 7(1)).
- Report the vulnerability within 2 days to the cybersecurity threat and vulnerability information sharing platform of the Ministry of Industry and Information Technology, stating the product name, model and version and the vulnerability's technical features, harm and scope (Article 7(2)).
- Organize prompt repair of the vulnerability; where users, including downstream manufacturers, must upgrade software or firmware, promptly tell the users who may be affected the risk and the repair method, and give necessary technical support (Article 7(3)).
- Keep a channel for receiving vulnerability information open and unobstructed, and keep the receipt logs for at least 6 months (Article 5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministry of Industry and Information Technology and the Ministry of Public Security, each under its duties (Article 12).
Settledness
- As of
What this law does
A provider of a network product, hardware or software, must report a security vulnerability it finds or learns of in a product it provides to the vulnerability information sharing platform of the Ministry of Industry and Information Technology within 2 days. The report must state the product name, model and version and the vulnerability's technical features, harm and scope of impact.
Where users must upgrade software or firmware, the provider must promptly tell the users who may be affected the risk and the repair method and give necessary technical support. A provider must keep the receipt logs of its vulnerability information channel for at least 6 months.
A provider that fails to take the vulnerability repair or reporting measures the Provisions require is handled by the Ministry of Industry and Information Technology and the Ministry of Public Security according to their duties. Article 12 provides that a failure of that kind which amounts to the situation described in Article 60 of the Cybersecurity Law is penalized under that provision.
In the Cybersecurity Law as amended on , Article 62 lists among the penalized acts that a provider has not taken remedial measures at once on a security defect, vulnerability or other risk in its product or service, or has not told users in time as required and reported to the competent authority. Article 62 provides for a warning and, where the provider refuses to correct or the violation endangers network security, a fine of 50,000 to 500,000 yuan.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.