Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The Cybersecurity Law of the People's Republic of China is a law designed to ensure cybersecurity, data protection, and data localization. It defines security obligations for network operators and service providers and establishes rules for data management and cross-border data transfer .
The Cybersecurity Law of the People's Republic of China was enacted on November 7, 2016 and implemented on June 1, 2017. The law aims to enhance cybersecurity, data protection and data localization in the interest of national security. It establishes the principle of cyberspace sovereignty and defines the security obligations of internet product and service providers, as well as internet service providers.
It includes rules for personal information protection, a security system for critical information infrastructure. It also requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Critical network equipment and specialized cybersecurity products shall, pursuant to the compulsory requirements of the relevant national standards, pass the security certification by qualified institutions or meet the requirements of security detection before being sold or provided.
The State implements the classified protection system for cybersecurity. Network operators shall fulfill the following obligations of security protection according to the requirements of the classified protection system for cybersecurity to ensure that the network is free from interference, damage or unauthorized access, and prevent network data from being divulged, stolen or falsified,
To purchase network products and services, critical information infrastructure operators shall enter into security confidentiality agreements with the providers in accordance with the provisions, in which obligations and responsibilities in terms of security and confidentiality shall be clarified.
In addition to the general provisions, critical information infrastructure operators must also fulfill the following security protection obligations: set up independent security management institutions and designate persons responsible for security management, including reviewing the security background of responsible persons and personnel in key positions.
In addition to the general provisions, critical information infrastructure operators must also fulfill the following security protection obligations: make disaster recovery backups of important systems and databases.
In addition to the general provisions, critical information infrastructure operators must also fulfill the following security protection obligations: periodically conduct cybersecurity education, technical training, and skill assessments for practitioners.
Critical information infrastructure operators shall store personal information and important data gathered and produced during operations within the territory of the People's Republic of China. Where it is really necessary to provide such information and data to overseas parties due to business requirements, a security assessment shall be conducted in accordance with the measures formulated by the national cyberspace administration authority in concert with the relevant departments under the State Council. Where the laws and administration regulations have other provisions, those provisions shall prevail.
In addition to the general provisions, critical information infrastructure operators must also fulfill the following security protection obligations: fulfill other obligations stipulated by applicable laws and administrative regulations.
To construct the critical information infrastructure, it shall be ensured that the critical information infrastructure has properties for supporting the stable and continuous operation of the business, and that technical security measures are planned, established and used concurrently.
In addition to the general provisions, critical information infrastructure operators must also fulfill the following security protection obligations: formulate contingency plans for cybersecurity incidents and carry out drills on a regular basis.
Critical information infrastructure operators shall conduct by themselves, or entrust cybersecurity service institutions to conduct, the detection and assessment of their cybersecurity and any potential risk at least once a year; and submit the detection and assessment situations as well as improvement measures to the relevant departments responsible for the security protection of critical information infrastructure.
Network operators shall formulate contingency plans for cybersecurity incidents, and promptly deal with system bugs, computer viruses, network attacks and intrusions and other security risks; when any incident endangering cybersecurity occurs, network operators shall immediately initiate contingency plans, take corresponding remedial measures, and report the same to the relevant competent departments in accordance with the provisions.
The State supports the cooperation among network operators in areas such as collection, analysis, and reporting of cybersecurity information and emergency disposal, so as to improve the ability of network operators to safeguard the security. Relevant industrial organizations shall establish and perfect cybersecurity protection regulations and coordination mechanisms for their own industry, strengthen the analysis and evaluation of cybersecurity risks, regularly give risk warnings to their members, and support and assist members in handling cybersecurity risks.
Providers of network products and services shall provide security maintenance for their products and services; and shall not terminate the provision of security maintenance within the stipulated time limit or the time limit agreed by the parties concerned.
Any individual or organization shall neither engage in activities endangering cybersecurity, including illegally invading others' networks, interfering with the normal functions of others' networks and stealing cyber data, nor provide programs or tools specifically used for activities endangering cybersecurity, such as network intrusions, interference with the normal functions and protective measures of the network, and theft of cyber data; if such individual or organization knows that a person engages in activities jeopardizing cybersecurity, it shall not provide technical support, advertising promotion, payment and settlement services or other types of assistance to such person or organization.
Network operators shall provide technical support and assistance to the public security organs and state security organs in lawfully safeguarding national security and investigating crimes.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
