Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The Cybersecurity Law of the People's Republic of China is a law designed to ensure cybersecurity, data protection, and data localization. It defines security obligations for network operators and service providers and establishes rules for data management and cross-border data transfer .
The Cybersecurity Law of the People's Republic of China was enacted on November 7, 2016 and implemented on June 1, 2017. The law aims to enhance cybersecurity, data protection and data localization in the interest of national security. It establishes the principle of cyberspace sovereignty and defines the security obligations of internet product and service providers, as well as internet service providers.
It includes rules for personal information protection, a security system for critical information infrastructure. It also requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Network products and services shall comply with the compulsory requirements of the relevant national standards. Providers of network products and services shall not install malwares; when they discover that their network products or services are subject to risks such as security defects or bugs, such providers shall take remedial measures immediately, inform users of the said risks and report the same to the relevant competent departments in accordance with the provisions.
Carrying out such activities as cybersecurity authentication, detection and risk evaluation, and releasing cybersecurity information like system bugs, computer viruses, network attacks and intrusions to society shall comply with the relevant regulations of the State.
When network operators handle network access and domain registration services for users, handle network access formalities for fixed-line or mobile phone users, or provide users with information publication services, instant messaging services and other services, they shall require users to provide real identity information at the time of signing agreements with users or confirming the provision of services.
Where users do not provide real identity information, network operators shall not provide them with relevant services. The State implements the strategy of trusted identities in cyberspace, supports the research and development of secure and convenient technologies for electronic identity authentication, and promotes mutual recognition among different electronic identification authentications.
Where network products and services have the function of collecting users' information, the providers shall clearly notify their users and obtain their consent. In the case of involving users' personal information, the providers shall also comply with the provisions regarding the protection of personal information as stipulated by this Law, relevant laws and administrative regulations.
Network operators, while carrying out business and service activities, shall abide by laws and administrative regulations, show respect for social moralities, follow business ethics, act in good faith, perform the obligation of cybersecurity protection and accept supervision by the government and social public and undertake social responsibilities.
For the construction and operation of a network or the provision of services through a network, it is a requirement to, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, take technical measures and other necessary measures to ensure the secure and stable operation of the network, effectively respond to cybersecurity incidents, prevent illegal crimes committed on the network, and maintain the integrity, confidentiality and availability of cyber data.
Any individual or organization shall have the right to report the behaviors that endanger cybersecurity to the cyberspace administration authorities, telecommunication departments, public security departments, etc. Any department receiving a report shall promptly handle such a report in accordance with the law and transfer the report to the department with the jurisdiction if the said report is beyond its own responsibility. Departments concerned shall maintain the confidentiality of certain information on informants and protect their legitimate rights and interests.
Cyber-related industrial organizations shall, in accordance with their regulations, intensify industrial self-discipline, formulate regulations on cybersecurity behaviors, instruct their members to strengthen cybersecurity protection, raise the level of cybersecurity protection and promote the healthy development of relevant industries.
Any individual or entity shall be responsible for their use of the network, but shall neither create a website or set up a group for communications for illegal and criminal activities, such as defrauding, passing on crime methods, or producing or selling prohibited or controlled goods, nor disclose information by taking advantage of the network that is related to such illegal and criminal activities as defrauding and producing or selling prohibited or controlled goods.
Where individuals discover that network operators gather or use their personal information in violation of the provisions of laws and administrative regulations or the agreements arrived at, they have the right to request the network operators to delete their personal information; where they find that their personal information gathered or stored by network operators is subject to any mistake, they have the right to request the network operators to make corrections. Network operators shall take measures to delete or correct the said information.
To collect and use personal information, network operators shall follow the principles of legitimacy, rightfulness and necessity, disclose their rules of data collection and use, clearly express the purposes, means and scope of collecting and using the information, and obtain the consent of the persons whose data is gathered.
Network operators shall neither gather personal information unrelated to the services they provide, nor gather or use personal information in violation of the provisions of laws and administrative regulations or the agreements arrived at; and shall dispose of personal information they have saved in accordance with the provisions of laws and administrative regulations and agreements reached with users.
Network operators shall adopt technical measures and other necessary measures to ensure the security of the personal information they have collected and prevent such information from being divulged, damaged or lost. If personal information has been or may be divulged, damaged or lost, it is necessary to take remedial measures immediately, inform users promptly according to the provisions and report the same to the relevant competent departments.
Network operators shall set up complaint and reporting systems for network information security, disclose the ways of complaint and reporting and other information, and promptly accept and handle complaints and reports related to network information security. Network operators shall cooperate with the supervision and detection implemented by cyberspace administration authorities and the relevant departments according to the law.
Network operators shall not disclose, tamper with or corrupt the personal information collected by them, and shall not provide any such personal information to any other person without the consent of the person from whom the information was collected, except where information has been processed to the extent that it cannot identify a specific individual and cannot be restored.
Network operators shall strictly keep confidential users' personal information that they have collected, and establish and improve the users' information protection system.
Network operators shall strengthen the management of the information published by their users, and upon discovery of the information whose publication or transmission is prohibited by the laws and administrative regulations, shall immediately stop the transmission of such information, take disposal measures such as deletion to prevent the information from spreading, save relevant records, and report the same to the relevant competent departments.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
