##  [China sets new rules on security vulnerability of network products](/pl/en_GB/new/china-sets-new-rules-security-vulnerability-network-products) 

# China sets new rules on security vulnerability of network products





China - 07 / 15 / 2021





China Data Protection Alert













- <a aria-label="Link" class="fs-5" data-content="Copied link" data-placement="top" data-toggle="popover" data-trigger="focus" data-url="https://www.garrigues.com/pl/en_GB/new/china-sets-new-rules-security-vulnerability-network-products" id="get-app-artwork" role="button" tabindex="0"></a>
- [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.garrigues.com/pl/en_GB/new/china-sets-new-rules-security-vulnerability-network-products)
- [](<https://twitter.com/intent/tweet?text=China sets new rules on security vulnerability of network products&url=https://www.garrigues.com/pl/en_GB/new/china-sets-new-rules-security-vulnerability-network-products>)
- [](<https://www.facebook.com/sharer.php?u=https://www.garrigues.com/pl/en_GB/new/china-sets-new-rules-security-vulnerability-network-products&t=China sets new rules on security vulnerability of network products>)

 







   Previous    Next  















**China’s Ministry of Industry and Information Technology (MIIT), Cybersecurity Administration of China (CAC) and Ministry of Public Security (MPS) jointly published the Provisions on Administration of Security Vulnerability of Network Products (Provisions), which will be in force as of September 1, 2021. The Provisions have established rules for the detection, collection, publication and other activities in relation to the security vulnerability of network products. We hereby summarize the Provisions as follows:**





**1. Scope of Application**

The Provisions are applicable for the **suppliers of network products** (both hardware and software), the **network operators** and the **cybersecurity platforms or “white hat”**, who are organizations or individuals who conduct the detection, collection, publication of security vulnerability of network products and other related activities. There are specific rules and requirements laid down for all the three types of entities/individuals.

It is worth mentioning that, according to the Cybersecurity Law of China, the “network operator” means any entity that owns or manages a network or network service provider. Considering that most companies are using networks formed by computers and other types of terminals and equipment in their business and internal management, those companies are at least fall within the scope of network operator thus would be subject to the Provisions.

**2. Compliance Obligations**

**(1) General Obligation**

The Provisions requires that all the three types of entities shall set up communication channel to receive report of security vulnerability of network products, and shall **keep the log of received information on security vulnerability for at least 6 months**. This is a specific requirement that expanded the rules under the Cybersecurity Law, which require network operators to keep network log for at least 6 months.

**(2) Suppliers’ Obligations**

Under the Provisions, **suppliers of network products are required to fulfill the following obligations** to ensure the timely fixing and reasonable publication of security vulnerability, and proper guidance to the users of products to adopt preventive measures:

- **Evaluation &amp; Notification**: Upon detection of the vulnerability, immediate measures shall be taken and verification on the vulnerability shall be performed. In case upstream products or parts have vulnerability, it shall notify the upstream supplier immediately.
- **Reporting**: To report to MIIT’s Network Security Threat Information Sharing Platform (<https://www.cstis.cn/>) within **2 days** upon detecting the vulnerability.
- **Fixing**: To timely fix the vulnerability and inform the users the security risk and the way to fix the vulnerability, and provide necessary technical support.

**(3) Obligations for Cybersecurity Platforms**

The Provisions have also established detailed requirements on the way the cybersecurity platforms should publish the security vulnerability the discovered. For example, they are generally required not to publish such information before there is a way to fix the vulnerability, they shall not publish details of the vulnerability, any publication during the time period of important event shall be subject to government approval, etc.



**3. Penalties**. The Provisions have also clarified the specific legal basis for the administrative penalties.

**(1)** MIIT and MPS will have the power to impose penalties on the network product suppliers if they fail to adopt measures for fixing or reporting the vulnerability. A fine up to CNY 500,000 may be given to the supplier and a fine up to CNY 100,000 may be given to the responsible person.

**(2)** In case a network operator fails to take measures to fix security vulnerability or adopt preventive measures, a fine up to CNY 100,000 may be given to the network operator and a fine up to CNY 50,000 may be given to the responsible person.



Considering that most companies could be considered as network operators and thus would need to comply with the Provisions, we suggest companies should start reviewing the technical and organizational measures on related to cybersecurity and make adjustments according to the new compliance rules.









[China](/pl/en_GB/tags/china), [Data Protection](/pl/en_GB/tags/data-protection), [Cybersecurity](/pl/en_GB/tags/cybersecurity)







 

 



 

 

### Contact

 

 ![](/sites/default/files/styles/medium/public/team/photo/Manuel_Torres_Salazar_20230511.jpg?itok=XIQSiRLy)

[Manuel Torres](/pl/en_GB/team/manuel-torres-salazar)




![](/themes/custom/garriguestheme/img/iconos/email-contacto.svg)[Contact](<mailto:manuel.torres@garrigues.com >)

- +86 21 5228 1122
    
    [Shanghai](https://www.garrigues.com/pl/en_GB/office/shanghai)
 










 

[Find more professionals](../team)

 

 



 

### Related services 

 

- [Technology, Communications and Digital ](/pl/en_GB/services/technology-communications-and-digital)
- [Media and Entertainment ](/pl/en_GB/services/media-and-entertainment)
 


 

 



 

### Related offices

 

- - [Shanghai](/pl/en_GB/office/shanghai)
 


 

 



 

## Find a publication

   

- [Administrative and Constitutional Law](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1422)
- [Agribusiness and Food](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1417)
- [Automotive](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1419)
- [Banking and Finance](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1443)
- [Corporate and M&amp;A](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1441)
- [Criminal Law and Internal Investigations](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1434)
- [Data Economy, Privacy and Cybersecurity](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10913)
- [Dispute Resolution: Litigation and Arbitration](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1412)
- [Energy](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10916)
- [EU and Antitrust Law](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1416)
- [Family Business](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1413)
- [Fashion Law](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1435)
- [Financial Regulation](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10915)
- [Human Capital Services](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1431)
- [Infrastructure](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10914)
- [Insurance](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1438)
- [Intellectual Property](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1421)
- [Labor and Employment](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1424)
- [Life Sciences and Healthcare](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1429)
- [Media and Entertainment](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1433)
- [Planning, Zoning and Environment](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1444)
- [Private Equity](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1439)
- [Real Estate](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10927)
- [Restructuring and Insolvency](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1420)
- [Securities Markets](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1442)
- [Sports](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1430)
- [Startups &amp; Open innovation](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1426)
- [Sustainability](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A10921)
- [Tax](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1425)
- [Technology, Communications and Digital](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1436)
- [Tourism and Hotels](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1432)
- [Transport, Logistics and Shipping](/pl/en_GB/markdownify/node/9635?f%5B0%5D=service%3A1428)

 Facet Services detail

 



- [Publications](/pl/en_GB/markdownify/node/9635?f%5B0%5D=publication_type%3A794)
- [Newsletters](/pl/en_GB/markdownify/node/9635?f%5B0%5D=publication_type%3A107)
- [Garrigues collection](/pl/en_GB/markdownify/node/9635?f%5B0%5D=publication_type%3A101)
- [Laws: amendments at a glance](/pl/en_GB/markdownify/node/9635?f%5B0%5D=publication_type%3A104)
- [News](/pl/en_GB/markdownify/node/9635?f%5B0%5D=publication_type%3A105)

 Facet Publication type detail

 



  Min  

 Max  

 







 

## News search engine