How to scope a system and document a GB/T 22239-2019 classified protection baseline.
GB/T 22239-2019 is a current recommended national standard, implemented on 1 December 2019. The official standards record confirms its identity and status, but the captured source does not provide the full control text. Obtain the complete current standard and apply the governing classification rules before claiming control-level conformity.
Structured answer sets in this page tree.
Cited legal and guidance references.
is the current recommended national standard titled Baseline for of cybersecurity. It supports China's Multi-Level Protection Scheme (). Use it after defining the and classification basis.
Define the information system or network boundary first. Cybersecurity Law Article 23 creates the binding network security duty and lists baseline obligations for network operators. The Data Security Law creates a separate data classification and graded-protection system for data-processing activities conducted through information networks. supports the network control mapping. The governing classification rules determine the system's level and applicable control set; the recommended standard is not a standalone statute.
The official standards record identifies as a current recommended national standard, published on 10 May 2019 and implemented on 1 December 2019. That record does not provide the complete requirement text, so obtain the applicable standard text and the governing classification and implementation rules before citing clauses, assigning a level, describing an authority-facing procedure, or asserting conformity.
Translate the applicable baseline into technical and management controls only after the system scope and level are resolved. For each clause, record applicability, the control owner, implementation evidence, test method and result, open finding, exception approval, remediation date, and retest. Keep Article 23's express duties visible even when a broader standard mapping is used: internal responsibility, malware and intrusion protection, monitoring, at least six months of network logs, and data classification, important-data backup, and encryption.
Reassess the classification and control mapping when system boundaries, hosting, business functions, users, data sensitivity, interconnections, suppliers, or threat exposure materially change. A change may affect the level, the applicable controls, or both; the standards record does not establish a universal renewal date.
Keep the classification and control file tied to the defined system, its approved level, and the edition of every standard used.
A reviewer should be able to trace each applicable requirement from the classification decision to implementation, test results, gaps, remediation, and retesting.
does not answer every China cybersecurity question. Assess important-data duties, critical-information-infrastructure status, cybersecurity review, personal-information processing and export, and app or product rules under their own instruments.
Shared technical evidence may support several records, but keep the system classification, data classification, filing, review, and product-approval conclusions separate.
Track the system boundary, classification decision, Article 23 controls, GB/T 22239-2019 mapping, tests, findings, remediation, and material changes.
Connect Article 23, the system classification, applicable GB/T clauses, control owners, test results, and later boundary changes.
Check the China Cybersecurity Law scope decision and unresolved launch questions with Sorena.