Understanding China's New Draft For Cybersecurity Incident Reporting Measures: A Practical Guide For Network Operators

On December 8, 2023, the Cyberspace Administration of China (CAC) introduced Administrative Measures for the Reporting of Cybersecurity Incidents (Draft) ("Measures"). This significant draft, now open for public commentary, mandates specific reporting requirements for network operators in the event of a cybersecurity incident. It clearly outlines the categories of incidents that need to be reported, the information that must be included in these reports, and the consequences for failing to report. This Measures marks a critical enhancement in China's approach to managing and mitigating cybersecurity risks.

1. Identifying the Key Subjects: Who Does the Measures Apply To

The Measures specifically target key subjects within the PRC jurisdiction responsible for network-related activities. These subjects, when facing incidents that jeopardize network security, is obligated to report per the Measures. The primary subjects include: