Classified Protection

Full Name:China Cybersecurity Classified Protection System (CCPS) or Multi-level Protection Scheme (MLPS)

What is CP?

Classified protection (“CP”) is an obligation and a privilege under China’s Cybersecurity Law (“CSL”). If certified under CP, a company would have prima facie evidence that its network system meets some basic safety obligations under the CSL. The loopholes that are ever red-flagged could then be plugged up. With the obligations satisfied, the company could fend off possible investigations or punishments resulting from the loopholes in cybersecurity.

等级保护（“CP”）是中国《网络安全法》（“CSL”）下的一项义务和特权。如果通过等级保护认证，公司将拥有初步证据，证明其网络系统符合《网络安全法》下的基本安全义务。此前被标记为风险点的漏洞将得到修补。在满足义务后，公司可以避免因网络安全漏洞而可能受到的调查或处罚。

Key Information Security Systems

The most important information security standard system in mainland China is the “Information Security Level Protection System”. This system is promoted across all major industries and has had a significant impact on the development of the information security industry.

In Taiwan, China, the “Cybersecurity Management Act” issued by the Executive Yuan primarily targets central and local government agencies, public institutions, and key infrastructure providers in sectors such as finance, energy, and transportation. It also influences the organizational structure, information security policies, and budget allocation of the aforementioned entities.

China’s Cybersecurity Law and its associated “Cybersecurity Classified Protection System (MLPS 2.0)” do not apply in the “Hong Kong Special Administrative Region (HKSAR) or the Macao Special Administrative Region (MSAR)”.

中国大陆最重要的信息安全标准体系是信息安全等级保护体系，该体系在所有主要行业进行推广，并对信息安全行业的发展产生了重要影响。

中国台湾由行政院颁布资通安全管理法，主要涵盖对象为中央、地方机关与公法人，及金融、能源、交通等关键基础建设提供者，并影响前述单位的组织架构、信息安全方针及预算分配。

中国内地的《网络安全法》及其下设的网络安全等级保护制度（等保 2.0）在香港特别行政区（HKSAR）和澳门特别行政区（MSAR）均不适用。

How is CP conducted?

Under CP, network systems are graded from Level 1 to Level 5. The higher the level, the more requirements need to be met. Certified entities (i.e., testing agencies with certification licenses) will conduct tests to determine the level of the network system and identify vulnerabilities. However, a certification entity is not allowed to provide rectification services—just like a referee cannot be a player simultaneously. Rectification services must be provided by separate rectification entities to address vulnerabilities in IT, processes, and control measures of the network system.

While a rectification entity does not need a license for its services, it must have expertise in both IT and risk management.

在等保下，网络系统从 1 级 到 5 级 进行分级。级别越高，需要遵守的要求就越多。认证实体（即需要认证许可证的测评机构）将进行测试并确定网络系统处于哪个级别，并告知漏洞所在。然而，认证机构不能提供整改服务，就像裁判员不能同时是参与者一样，整改服务必须由整改机构提供，以解决网络系统在 IT、流程和控制措施方面的漏洞。

尽管整改实体的整改服务不需要许可证，但整改实体必须具备 IT 和 风险管理 方面的能力。

《信息安全等级保护管理办法》

根据《信息安全等级保护管理办法》规定，国家信息安全等级保护坚持自主定级、自主保护的原则。信息系统的安全保护等级应根据以下因素来确定：

• 信息系统在国家安全、经济建设、社会生活中的重要性；
• 信息系统遭受破坏后对国家安全、社会秩序、公共利益的危害程度；
• 对公民、法人和其他组织合法权益的损害程度。

信息系统的安全保护等级划分

信息系统的安全保护等级分为五个等级，级别逐级增高。二级及以上系统需要通过专家评审。

三保二评对比