When is commercial cryptography testing or certification needed? Direct answer

Article 25 of the Cryptography Law and Article 12 of the implementing regulation encourage voluntary commercial-cryptography testing and certification. Voluntary assurance does not waive Article 11: the activity must still comply with applicable laws, administrative regulations, mandatory national standards, and the operator's publicly declared standards. Testing and certification bodies must hold the required qualifications and work within their approved scope under the applicable technical specifications and rules.

Mandatory assurance applies to a narrower group. A commercial-cryptography product involving national security, the national economy and people's livelihoods, or the public interest must be included in the catalogue of critical network equipment and specialised cybersecurity products and pass qualified testing and certification before sale or provision. Both conditions matter: a cryptographic product outside that catalogue, or a listed network product that is not commercial cryptography, does not enter this mandatory route on those facts alone. A commercial-cryptography service that uses critical network equipment and specialised cybersecurity products must pass service certification.

The current network-product catalogue, effective since 3 July 2023, includes routers, switches, rack servers, and PLC equipment that meet stated technical thresholds, plus categories such as firewalls, intrusion-detection systems, VPN products, public-key infrastructure, file-encryption products, and identity-authentication products. Match the exact product and threshold. Do not substitute the separate commercial-cryptography product certification catalogue, which supports the national voluntary certification system, for the mandatory network-product catalogue.

Article 27 applies when laws, administrative regulations, or other state rules require a CII to use commercial cryptography for protection. The CII operator must conduct the commercial-cryptography application security assessment itself or commission a commercial-cryptography testing body.

Articles 38 and 39 of the implementing regulation require the operator to prepare a commercial-cryptography application plan, provide funding and professional staff, and plan, build, and operate the cryptography protection system alongside the CII. The CII provisions effective 1 August 2025 make the lifecycle explicit: assess the application plan, reassess it if it changes during construction, pass an assessment before operation, and assess at least annually after operation. CII already under construction on that date follows the construction and pre-operation route; CII already operating follows the annual route. Its commercial-cryptography products and services must be tested and certified, while its algorithms, protocols, key-management mechanisms, and other cryptographic technologies must pass state cryptography administration review and appraisal.

A failed plan assessment means the plan cannot be used as the construction basis. A failed pre-operation assessment requires modification and prevents operation during the modification period. A failed annual assessment also requires modification, but the operator must take necessary measures to keep the operating CII secure during that work. A major cryptography-related security incident, major cryptography security hazard, or special emergency must be reported promptly and can require another assessment.

When the Commercial Cryptography Application Security Assessment Measures apply, file the assessment report and related work information with the National Cryptography Administration or the relevant province-level cryptography authority within 30 days after the report is formed. An operator that performs its own assessment must retain the original records and report for at least six years. These filing and retention duties belong to the system assessment; they do not turn a product report into a system-assessment result.

Article 42 requires coordination with CII security testing and the network-security classified-protection assessment system to avoid duplicate work. Coordination does not erase the separate trigger, scope, or required conclusion for each assessment.

The record should show whether assurance is voluntary, mandatory for an Article 26 product or service, or part of the CII application-assessment lifecycle. Keep the exact catalogue entry, qualified-body scope, report or certificate, CII trigger, assessment stage, result, filing, and remediation together.