Identify the actor and trigger before preparing a filing. Not every network operator, vendor purchase, data export, or security assessment is a cybersecurity review.
The Measures cover CII operators procuring network products or services and network platform operators conducting data processing where national security is or may be affected. A network platform operator holding personal information of more than one million users must also file before seeking a listing abroad.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this workflow to decide whether a 's procurement, a 's data-processing activity, or a listing abroad requires a filing under China's Cybersecurity Review Measures.
Start with the named legal entity and the activity. A procuring a must pre-judge the national-security risk created by using it and file when the procurement affects or may affect national security. A conducting data processing is within the Measures when that activity affects or may affect national security.
Apply the separate Article 7 rule to a proposed listing abroad: a holding personal information of more than one million users must file with the before the listing. Article 7 uses the Chinese phrase for listing in a foreign country; it should not be assumed to cover or exclude a particular offshore venue without checking current authority practice and the transaction facts. The one-million-user threshold is not a general safe harbour: it does not exempt a smaller operator or another transaction from the broader national-security trigger. Review-mechanism members may also refer a product, service, or data-processing activity for review under Article 16.
No. More than one million users' personal information is the express filing threshold for a seeking a listing abroad under Article 7. CII procurement and platform data processing can still require review at any scale when the activity affects or may affect national security, and Article 16 permits an authority-initiated review.
If a filing is required, submit the application, an analysis of actual or possible effects on national security, the relevant procurement document, agreement, proposed contract or listing application, and any other material the review requires. Keep the analysis tied to the specific systems, data, supplier dependencies, transaction and listing facts.
For a CII procurement, the procurement documents or agreement must require the supplier to cooperate with review. The documents must include commitments not to use the supply relationship to obtain user data illegally, control or manipulate user equipment illegally, or interrupt supply or necessary technical support without proper reason.
Article 10 requires an assessment of specific national-security risks. A generic vendor score is insufficient. Address possible illegal control, interference or destruction of CII; harm from supply interruption; product or service security, openness and transparency; source diversity and supply-channel reliability; supplier compliance with Chinese law; and risks to core data, important data or large volumes of personal information.
For a listing, also assess the risk that CII, core data, important data or large volumes of personal information could be influenced, controlled or maliciously used by a foreign government, together with other network and information-security risks.
No. Complex initial reviews may be extended by 15 working days, complex special reviews may be extended without a fixed additional period in the Measures, and time used to supply requested supplemental material is excluded. Plan against each procedural stage and the written notices, not a single guaranteed end date.
Retain the trigger analysis, filed materials, supplemental submissions, supplier commitments, risk-reduction measures, written notices and final conclusion. Reopen the analysis when the operator, CII status, product or service, supplier, use case, data categories or volume, listing plan, affected systems, or national-security risk changes.
A cybersecurity review is separate from a personal-information or important-data export assessment, MLPS work, CII annual risk assessment, app filing, sector licensing and foreign-investment security review. The same facts may feed several analyses, but one approval or filing does not replace another.
Turn the cybersecurity-review decision into named owners, filed materials, supplier commitments, written notices and change triggers.