QuestionChina

What is MLPS classified protection evidence? Direct answer

MLPS, or classified protection, evidence is the record showing how a defined China network or system was graded, protected, tested, remediated, and reassessed.

The Cybersecurity Law establishes the classified-protection duty. GB/T 22239-2019 supplies a recommended baseline for control mapping; it is not itself a law, approval, or universal certificate.

Author
Sorena AI
Published
Jul 5, 2026
Updated
Jul 25, 2026
Questions
2

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Jul 5, 2026
Updated Jul 25, 2026
Overview

, or classified protection, evidence is the record showing how a defined China network or system was graded, protected, tested, remediated, and reassessed. It should let a reviewer reproduce the scope decision and trace each applicable requirement to evidence.

Search this module

Find a question or answer quickly

2 of 2 questions
Question 1

Short answer

Article 23 of the Cybersecurity Law's consolidated 2025 text requires each to perform security-protection duties under the classified protection system. The evidence starts with the protected object, responsible operator, system boundary, and , then records where required, controls, operating procedures, monitoring, backup, incident handling, testing, gaps, remediation, and reassessment tied to that decision.

, Information security technology - Baseline for classified protection of cybersecurity, is a current recommended national standard. It took effect on 1 December 2019 and supports clause-level control mapping. Its '/T' designation and implementation date do not turn it into a separate law or prove that a system has completed every applicable , assessment, or sector requirement.

GB/T 22240-2020 grades a protected object from the interest harmed and the severity of that harm. Level 1 covers general harm to the lawful rights and interests of citizens, legal persons, or other organizations without harm to national security, social order, or the public interest. Level 2 covers serious or especially serious harm to those rights and interests, or general harm to social order or the public interest, without harm to national security. Level 3 covers serious harm to social order or the public interest, or general harm to national security. Level 4 covers especially serious harm to social order or the public interest, or serious harm to national security. Level 5 covers especially serious harm to national security. The 2007 management measures use older information-system wording, so retain the classification guide, edition, rationale, and approval record rather than mixing the two descriptions. System size or data volume alone does not determine the level.

The general classified-protection management measures require for level 2 or higher information systems: an operating system files within 30 days after its level is determined, and a new system files within 30 days after entering operation. Level 3 systems undergo assessment and self-inspection at least annually, level 4 systems at least every six months, and level 5 systems according to special security needs. Sector regimes can use different protected objects, filing channels, or cycles, so first determine whether the general public-security route, a sector route, or both apply; MIIT's communications-network grading and filing is not the same procedure as public-security classified-protection filing.

Citations
PRC Cybersecurity Law

Articles 23 and 78 establish classified-protection duties for network operators and define the relevant network and operator terms in the consolidated 2025 text.

Question 2

What to keep as evidence

A reviewer should be able to follow the record from system scope through classification, implementation, assessment, remediation, and reassessment.

  • System boundary and inventory: owner, purpose, users, data, interfaces, infrastructure, hosting, dependencies, and suppliers.
  • Grading record: protected object, responsible operator, affected interests, severity-of-harm analysis, proposed , method, result, approver, date, and any required authority, sector, or specialist input.
  • Applicability record: the law, current standard edition, sector rules, and each clause mapped to a technical or management control and evidence owner.
  • Operating evidence: access control, malware protection, monitoring and logs, data classification and backup, incident plan and exercises, personnel controls, and supplier controls, to the extent applicable to the grade.
  • and assessment record where required: filing form and receipt, submitted topology and governance material, assessment scope, qualified assessor where required, findings, corrective actions, retest results, and closure evidence. Keep public-security and sector filings separate.
  • Reassessment triggers for material changes to purpose, architecture, hosting, data, interfaces, suppliers, threats, or applicable rules; do not invent one renewal date for all systems.
Citations
PRC Cybersecurity Law

Articles 23 and 27 identify baseline classified-protection and incident duties, including internal rules, responsible personnel, technical protections, monitoring and logs, data classification, backup, encryption, and incident planning.

Primary sources

References and citations

openstd.samr.gov.cn
Referenced sections
  • Supports the current affected-interest and harm-severity matrix, the five protection-level outcomes, and the 1 November 2020 implementation date.
npc.gov.cn
Referenced sections
  • Confirms that the amended Cybersecurity Law took effect on 1 January 2026; the amendment mainly changed legal-liability provisions and added artificial-intelligence governance language.
sdca.miit.gov.cn
Referenced sections
  • Articles 23 and 27 identify baseline classified-protection and incident duties, including internal rules, responsible personnel, technical protections, monitoring and logs, data classification, backup, encryption, and incident planning.
Related guides

Explore more topics

China App Filing vs Personal Information Rules
Decide whether a China mobile app needs MIIT filing, personal-information controls, or both, with current triggers, duties, dates, and evidence.
China cybersecurity and data security requirements
China cybersecurity requirements by actor: network operators, data processors, CII operators, platforms, app providers, and distribution platforms.
China cybersecurity compliance checklist
A China cybersecurity checklist for scoping network duties, data security, CII procurement review, app rules, MIIT filing, and supporting standards.
China cybersecurity deadlines and compliance calendar
Separate China cybersecurity commencement dates from recurring duties, filing lead times, review periods, and event-driven response deadlines.
China Cybersecurity Law FAQ
Practical answers on China network-operator scope, MLPS evidence, important data, cybersecurity review, app filing and governance, and smart-home standards under the law in force from 1 January 2026.
China Cybersecurity Law vs EU Cyber Resilience Act
Compare China's network-operator rules with the EU CRA's product duties, including scope, actors, evidence, reporting dates, and launch decisions.
China Cybersecurity Law vs EU NIS2 Directive
Compare China's network-operator duties with NIS2 entity duties, including scope, management accountability, incident reporting, evidence, and enforcement.
China cybersecurity penalties and fines
Compare current China Cybersecurity Law and Data Security Law fines by actor, breach, severity, and enforcement consequence.
China Cybersecurity Review vs Data Export Assessment
Separate China's cybersecurity-review triggers from CAC data-export assessment triggers, thresholds, filings, evidence, timing, and reapplication rules.
China cybersecurity review workflow
Determine whether CII procurement, platform data processing, or a qualifying foreign listing triggers China's Cybersecurity Review Measures.
China mobile app filing and app governance
Identify the China app sponsor, complete MIIT filing before service, and separate provider, platform, privacy, content, and security duties.
China Smart-Home Security vs Telecom and Radio Approval
Separate GB/T 41387-2022 smart-home security evidence from China telecom network-access and radio approval decisions for connected products.
CII and network operator role triage
How to separate ordinary network operator duties from CII, procurement, and review-risk questions under China cybersecurity sources.
Does an app need MIIT filing and CAC app governance review?
An app sponsor providing internet information services through an app in China must complete MIIT filing. CAC rules separately govern app providers and distribution platforms without creating one routine CAC approval for every app.
GB/T 22239-2019 classified protection baseline
How to scope and document a GB/T 22239-2019 classified protection baseline without treating the recommended standard as a standalone law.
GB/T 41387-2022 smart home security standard
How connected-device teams can scope and document GB/T 41387-2022 without treating it as an automatic certification or product-approval duty.
How do smart home security standards fit with China cybersecurity law?
GB/T 41387-2022 can organize smart-home security evidence, but it is a recommended standard, not a product approval. Check app, data, MLPS, telecom access, and radio requirements separately.
How does important data change China cybersecurity obligations?
Once data is officially identified as important data, the processor needs named governance, periodic risk assessments and reports, incident controls, and a separate export decision. An internal sensitivity label alone does not establish the legal category.
Is every company a network operator under China Cybersecurity Law?
No. Under China's Cybersecurity Law, a network operator is an owner or administrator of a network or a network service provider. Apply that definition to each China network or service, then test CII and other roles separately.
MLPS classified protection evidence map
Classify a China network under MLPS, complete level 2 or above filing, map controls, and retain assessment, remediation, and change evidence.
When does China cybersecurity review apply?
China cybersecurity review applies to CII procurement or network-platform data processing that affects or may affect national security, plus a mandatory pre-filing trigger for certain foreign listings involving more than one million users' personal information.