ChinaCritical Information Infrastructure Security Protection Regulation, operator duties
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to an owner or operator of critical information infrastructure designated as such by the protection-work department of its sector, an important network facility or information system in public communications and information services, energy, transport, water, finance, public services, e-government or defense science and technology (Articles 2, 8 and 10); a service of yours is reached only once it is designated and you are notified.
- Plan, build and put into use your security protection measures at the same time as the critical information infrastructure itself (Article 12).
- Set up a cybersecurity protection system and an accountability system, and guarantee the staff, funds and material for them; the head of the operator is overall responsible for protecting the infrastructure and leads the handling of major incidents (Article 13).
- Set up a dedicated security management body and run security background checks on its head and on key-post staff (Article 14).
- Carry out a cybersecurity inspection and risk assessment of the infrastructure at least once a year, yourself or through a cybersecurity service organization, correct the problems found promptly and report the results as the protection-work department requires (Article 17).
- Report to the protection-work department promptly when the infrastructure changes in a way that may affect its designation, and on a merger, division or dissolution (Articles 11 and 21).
- Give priority to secure and trustworthy network products and services, put a purchase that may affect national security through the national cybersecurity review, and sign a security and confidentiality agreement with each provider (Articles 19 and 20).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 39 sets a fine of 100,000 to 1,000,000 yuan on an operator that refuses to correct a listed failure or whose failure endangers cybersecurity, and a fine of 10,000 to 100,000 yuan on the directly responsible person in charge.
- Rule
- Fixed only
- As of
- Minimum
- 100,000
- Currency
- CNY
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
Under the overall coordination of the national cyberspace department, the public security department of the State Council guides and supervises protection work, and the telecommunications department and other departments are responsible for protection and supervision within their duties (Article 3).
Settledness
- As of
What this law does
The Regulation protects critical information infrastructure, meaning important network facilities and information systems in public communications and information services, energy, transport, water, finance, public services, e-government and defense science and technology, and in other fields where destruction, loss of function or data leakage could seriously harm national security, the national economy or the public interest.
The protection-work department of each sector designates the critical information infrastructure of its sector under its designation rules, notifies the operator of the result and informs the public security department of the State Council. An operator must plan, build and put into use its security protection measures at the same time as the infrastructure. An operator must set up a dedicated security management body and run security background checks on the body's head and on key-post staff.
An operator must carry out a cybersecurity inspection and risk assessment of the infrastructure at least once a year, either itself or through a cybersecurity service organization. An operator must give priority to secure and trustworthy network products and services and must put a purchase that may affect national security through the national cybersecurity review.
An operator that commits a listed failure receives an order to correct and a warning, and a fine of 100,000 to 1,000,000 yuan if it refuses to correct or the failure endangers cybersecurity.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services or provides telecom services.