The cybersecurity classified protection regime attracted
significant attention when it was included in the PRC Cyber
Security Law promulgated in 2017 (the
"CSL"). The CSL mandates that Network
Operators follow certain security requirements based on the levels
of risk associated with their networks. However, the CSL did
not provide much detail as to how the classification should work in
practice, nor did it specify how the security obligations and
requirements attached to different levels vary. The Ministry of
Public Security, released a draft Regulations for Cybersecurity
Classified Protection (the "Classified Protection
Regulations") for public comment in June 2018. The
Classified Protection Regulations provided some degree of guidance,
but industry has been very interested to see more detailed
technical guidance to ensure compliance with the general and vague
requirements of the CSL in this area.
