FAQ item index

Search every question across sub-FAQs

Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.

Indexed coverage

12of12items

Across 6 modules • Updated Jul 5, 2026

Author

Sorena AI

Published

Jul 5, 2026

Updated

Jul 5, 2026

Back to sub-FAQs

Does an app need MIIT filing and CAC app governance review?

Short answer

This answer explains does an app need miit filing and cac app governance review? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

Keep these tracks separate: MIIT filing identifies the app and provider; app governance covers operational and platform duties; PIPL covers notice, consent, minimization, rights, and exports.

Citations

MIIT notice on mobile app filing work

Use for MIIT mobile app filing phases, registration, supervision, normalization, and operational filing evidence.

Mobile Internet Application Information Service Management Provisions

Use for app provider and app distribution platform governance, content/security/data duties, platform filing and verification, and 1 August 2022 effective date.

Jump to answer Open module

Does an app need MIIT filing and CAC app governance review?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

MIIT notice on mobile app filing work

Use for MIIT mobile app filing phases, registration, supervision, normalization, and operational filing evidence.

Mobile Internet Application Information Service Management Provisions

Use for app provider and app distribution platform governance, content/security/data duties, platform filing and verification, and 1 August 2022 effective date.

Jump to answer Open module

How do smart home security standards fit with China cybersecurity law?

Short answer

This answer explains how do smart home security standards fit with china cybersecurity law? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

Use them as product security evidence alongside, not instead of, app filing, privacy, telecom, wireless, or MLPS decisions.

Citations

GB/T smart home general security specification

Use as the smart-home security specification reference for connected appliance evidence mapping and the 1 November 2022 implementation date.

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Jump to answer Open module

How do smart home security standards fit with China cybersecurity law?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

GB/T smart home general security specification

Use as the smart-home security specification reference for connected appliance evidence mapping and the 1 November 2022 implementation date.

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Jump to answer Open module

How does important data change China cybersecurity obligations?

Short answer

This answer explains how does important data change china cybersecurity obligations? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

The practical file is an important-data screening note with data category, business use, potential harm, storage/export path, owner, and escalation decision.

Citations

PRC Data Security Law

Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.

Measures for Security Assessment of Data Export

Use for data export security assessment triggers, self-assessment, application materials, review timing, re-review, validity, and re-application triggers.

Jump to answer Open module

How does important data change China cybersecurity obligations?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

PRC Data Security Law

Measures for Security Assessment of Data Export

Use for data export security assessment triggers, self-assessment, application materials, review timing, re-review, validity, and re-application triggers.

Jump to answer Open module

Is every company a network operator under China Cybersecurity Law?

Short answer

This answer explains is every company a network operator under china cybersecurity law? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

Do not jump straight to CII or cybersecurity review; first document the network/service role, security controls, data categories, users, vendors, and incident process.

Citations

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Mobile Internet Application Information Service Management Provisions

Use for app provider and app distribution platform governance, content/security/data duties, platform filing and verification, and 1 August 2022 effective date.

Jump to answer Open module

Is every company a network operator under China Cybersecurity Law?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Mobile Internet Application Information Service Management Provisions

Use for app provider and app distribution platform governance, content/security/data duties, platform filing and verification, and 1 August 2022 effective date.

Jump to answer Open module

What is MLPS classified protection evidence?

Short answer

This answer explains what is mlps classified protection evidence? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

Useful evidence includes system boundary, classification result, control mapping, technical/management measures, testing or assessment records, remediation log, and owner approval.

Citations

GB/T 22239 classified protection baseline requirements

Use as the MLPS/classified protection baseline standard reference for control evidence mapping and the 1 December 2019 implementation date.

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Jump to answer Open module

What is MLPS classified protection evidence?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

GB/T 22239 classified protection baseline requirements

Use as the MLPS/classified protection baseline standard reference for control evidence mapping and the 1 December 2019 implementation date.

PRC Cybersecurity Law

Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.

Jump to answer Open module

When does China cybersecurity review apply?

Short answer

This answer explains when does china cybersecurity review apply? in practical terms: the trigger to check, the evidence to keep, and the follow-up decision that should be owned before launch or change approval.

A good intake note records the product/service, buyer role, data and user scale, supplier access, national-security concern, and why review is or is not required.

Citations

Cybersecurity Review Measures

Use for cybersecurity review scope, CII procurement filing, platform operator review triggers, review materials, special review, and 15 February 2022 effective date.

Jump to answer Open module

When does China cybersecurity review apply?

What to keep as evidence

A reviewer should be able to reconstruct the decision without asking the launch team what happened.

Keep network-operator role analysis.
Keep baseline security-control map.
Keep important-data screening note.
Keep incident-response and log-retention evidence.
Keep cybersecurity review intake decision.

Citations

Cybersecurity Review Measures

Use for cybersecurity review scope, CII procurement filing, platform operator review triggers, review materials, special review, and 15 February 2022 effective date.

Jump to answer Open module

Page 1 of 1

Previous1Next