China Cybersecurity Law MLPS classified protection evidence map

Begin with a complete inventory of networks and protected objects, including cloud, mobile, Internet of Things, industrial-control and big-data environments. Define each boundary, operator, business function, service population, data, dependencies and technology context. For a new network, determine the security protection level during planning and design rather than after launch.

GB/T 22240-2020 is the current recommended national classification guide, published on 28 April 2020 and implemented on 1 November 2020. It tests two factors: the interest harmed when the protected object is damaged and the severity of that harm. The affected interests are the lawful rights and interests of citizens, legal persons and other organisations; social order and public interests; and national security.

Level 1 covers general harm to citizens, legal persons or other organisations without harm to national security, social order or public interests. Level 2 covers serious or especially serious harm to those private interests, or general harm to social order or public interests, without harm to national security. Level 3 covers serious harm to social order or public interests, or general harm to national security. Level 4 covers especially serious harm to social order or public interests, or serious harm to national security. Level 5 covers especially serious harm to national security. Keep the harm analysis and any sector guidance or authority review with the record; do not choose a level from system size, data sensitivity, or a vendor label alone.

Networks at level 2 or above are filed with the public-security organ. Under the 2007 classified-protection management measures, an operating level 2 or above information system is filed within 30 days after its level is determined, and a new one within 30 days after it enters operation. Apply any current sector procedure and filing channel to the protected object. Level 1 remains subject to the Cybersecurity Law's Article 23 baseline even though the cited filing route starts at level 2.

Keep the submitted classification and filing materials, filing receipt or certificate, authority questions and responses, and the final accepted system boundary. A filing record shows that the materials were accepted; it does not prove that every control operates effectively.

Build the control map from Article 23 and the standards that apply to the recorded level and technology context. GB/T 22239-2019 separates technical requirements for the secure communications network, secure area boundary, secure computing environment and security management centre from management requirements for policies, organisation, personnel, construction and operations.

Assess the controls against the same object, level, standard clauses and technology extensions used in the control map. The MPS implementation guidance directs level 3 and above operators to use a qualified assessment institution once each year and submit the assessment report to the public-security organ that accepted the filing and to the industry authority. It also directs a new level 3 or above network to pass assessment before operation. Apply the level-specific minimums in Article 14 of the management measures as well: level 3 requires assessment and self-inspection at least annually, level 4 at least every six months, and level 5 according to special security needs. Do not use the general annual guidance to lengthen a shorter applicable cycle.

Track every finding to a responsible owner, corrective action, completion date and retest result. Preserve evidence from normal operation as well as the assessment package. A policy, filing certificate or assessment report cannot substitute for current configurations, logs, access reviews, incident exercises, backups and completed remediation.

MLPS answers how a network is classified and protected. It does not by itself decide whether a system is CII, whether a procurement requires cybersecurity review, whether data is important data, whether a personal-information or important-data export route applies, or whether an app needs MIIT filing.

Reuse verified system, architecture, data and supplier facts, but keep each scope decision and its evidence separate. For CII, classified protection is the baseline on top of which the enhanced CII duties apply.