Separate baseline network operator duties from the enhanced duties that follow after a system is identified as critical information infrastructure.
The Cybersecurity Law applies to building, operating, maintaining and using networks in China. CII is narrower: the responsible protection department applies sector recognition rules and notifies the operator.
Structured answer sets in this page tree.
Cited legal and guidance references.
Identify the operator of each network in China and apply the baseline duties to that network. Add duties only when the responsible has identified the specific infrastructure and notified its operator.
Scope the concrete network or network service in China instead of assigning one label to an entire corporate group. A may be the network owner, administrator or network service provider. Record the legal entity that makes operational decisions, the system boundary, users, functions, infrastructure, data, suppliers and connection to China.
Apply the Cybersecurity Law's baseline duties to each in-scope network. is a narrower category with added organisational, assessment, incident, procurement and data duties. The separate term '' in the Cybersecurity Review Measures should not be used as a synonym for either role.
No. A owns or administers a network or provides network services and must meet the baseline security duties. CII is a narrower class of important network facilities and information systems identified under sector rules by the responsible . CII duties are added to, not substituted for, the baseline.
The CII regulation names sectors and a consequence test, but the responsible performs the recognition. Its rules must consider the facility's importance to the sector's key core business, the harm that destruction, loss of function or data leakage could cause, and effects on other industries or fields. The department identifies the specific infrastructure and notifies its operator; sector membership, company size, data volume, customer importance, or a classified-protection level does not replace that notice.
Treat a possible CII classification as an escalation point and do not self-certify the system. Preserve the authority notice and match it to the named facilities, systems, operator, and version or boundary facts. If identified CII changes materially in a way that could affect the result, the operator must report the change; the has three months after receiving the report to complete the new determination and notify the operator.
No. Sector presence is relevant, but the responsible applies its recognition rules to the specific network facility or information system and notifies the operator. Importance to key core business, the harm from disruption or data leakage, and effects on other sectors are part of that determination.
A notified CII operator keeps the baseline Article 23 controls and adds the CII controls in the amended Cybersecurity Law and the CII regulation. The operator's has overall responsibility. The operator must establish a , support it with people and funding, involve it in cybersecurity and informatization decisions, and conduct background screening for its head and key-position personnel.
The dedicated body must cover protection planning, monitoring, testing, risk assessment, incident plans and exercises, key roles, training, personal-information and data protection, service-provider security and required reporting. The operator must assess CII security and risk at least once each year, remedy findings and report as the requires.
classification, CII recognition, cybersecurity review, important-data classification, personal-information protection and data-export routes answer different questions. A high MLPS level does not itself prove CII status, and a CII notice does not replace classified-protection, app, privacy or export work.
Use one system inventory and change record across the analyses, but keep each legal conclusion, authority interaction, filing, approval and recurring duty separately traceable.
Turn the network-operator and CII role decision into named owners, controls, authority records and reassessment triggers.
Connect the network-operator analysis, CII recognition notice, annual assessment, procurement screen, reports and material changes.
Check the China Cybersecurity Law scope decision and unresolved launch questions with Sorena.