ChinaCritical Information Infrastructure Security Protection Regulation, report of a major incident or threat
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to an owner or operator of critical information infrastructure designated as such by the protection-work department of its sector, an important network facility or information system in public communications and information services, energy, transport, water, finance, public services, e-government or defense science and technology (Articles 2, 8 and 10); a service of yours is reached only once it is designated and you are notified.
- When the infrastructure suffers a major cybersecurity incident, or you find a major cybersecurity threat, report to the protection-work department and the public security organ as the relevant provisions require (Article 18). The Regulation states no hour count of its own for this report; the separate incident reporting measures issued by the Cyberspace Administration of China in 2025 set the clock for incidents involving critical information infrastructure.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 40 sets a fine of 100,000 to 1,000,000 yuan on an operator that fails to report a major incident or threat and refuses to correct, or whose failure endangers cybersecurity, and a fine of 10,000 to 100,000 yuan on the directly responsible person in charge.
- Rule
- Fixed only
- As of
- Minimum
- 100,000
- Currency
- CNY
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The protection-work department and the public security organ, each under its duties (Article 40).
Settledness
- As of
What this law does
When critical information infrastructure suffers a major cybersecurity incident, or a major cybersecurity threat is found, the operator must report to the protection-work department and the public security organ as the relevant provisions require. For an especially major incident or threat, the protection-work department must in turn report promptly to the national cyberspace department and the public security department of the State Council.
An operator that fails to report receives an order to correct and a warning, and a fine of 100,000 to 1,000,000 yuan if it refuses to correct or the failure endangers cybersecurity.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services or provides telecom services.