Security Laws, Regulations, Standards and Compliance
This domain tests whether you can name the legal instrument that governs a given situation and the standard that defines a required control. Chinese regulation dominates the legal side; international standards dominate the control side.
Chinese laws you must distinguish
- Cybersecurity Law (2017) - baseline duties for network operators: MLPS grading, logs retained at least six months, real-name registration, incident reporting. Critical Information Infrastructure (CII) operators carry extra duties: domestic storage of personal information and important data, a security assessment before cross-border transfer, and periodic risk assessment.
- Data Security Law (2021) - data classification and grading, important data catalogues, national core data, and security reviews for processing that affects national security.
- Personal Information Protection Law (2021) - consent and other lawful bases, separate consent for sensitive personal information and cross-border transfer, individual rights, breach notification, and a local representative for overseas processors.
- Cryptography Law (2020) - commercial versus core cryptography, and import/export control of commercial cryptographic products.
Standards
GB/T 22239-2019 is the MLPS 2.0 baseline; MLPS has five levels, with level 3 systems assessed at least annually and level 4 at least every six months. ISO/IEC 27001 defines an ISMS with 93 Annex A controls in the 2022 revision; ISO/IEC 27002 supplies implementation guidance; the NIST CSF organises activity into Identify, Protect, Detect, Respond and Recover.
Worked example
A hospital outsources its appointment system to a foreign cloud provider and stores patient records abroad. Because it processes personal information above the regulator's threshold, the transfer requires a CAC security assessment (or another permitted route) and separate consent from individuals. The Cybersecurity Law's CII rules and PIPL's cross-border chapter both apply; quoting only one of them is an incomplete answer.
Traps
- Treating PIPL and DSL as interchangeable: DSL governs data security broadly, PIPL governs personal information.
- Assuming the six-month log retention applies only to CII - it applies to network operators.
- Describing ISO/IEC 27001 as a law; it is a certifiable standard, voluntary unless contractually required.
- Forgetting that MLPS assessment frequency depends on the system's level.