China MLPS 2.0

Why does it matter?

MLPS is the compliance gate that network operators in China most often meet in practice. Level 3 and above systems carry a filing certificate, an independent evaluation and regular public security inspection, so the grade a system receives decides how much supervision it gets.

Key benefits include:

• Grades follow harm, not technology

The five levels depend on the harm destruction of the system would cause to citizens' or organizations' rights, social order, the public interest or national security (Article 7 of the 2007 Rules).

• Self-grading with review

Operators grade their own systems, a competent department verifies the grade, and systems planned for level 4 or above go to a national expert committee (Articles 6 and 10).

• Filing with public security

Systems at level 2 and above are filed with the city-level or higher public security body within 30 days of grading or of entering operation (Article 15).

• A fixed evaluation rhythm

Level 3 systems are evaluated and self-inspected at least yearly and level 4 at least every half year, by a qualified evaluation body (Article 14).

• Higher grade, more supervision

Level 2 receives guidance, level 3 supervision and inspection, level 4 mandatory supervision, and level 5 specialized state bodies (Article 8).

How does it work?

The scheme works as a cycle: grade the system, file it, build and rectify safeguards to the level's baseline, have it evaluated, and keep it under supervision. The 2007 Management Rules set the legal steps. Operators apply new IT products that comply with national requirements, build security facilities alongside the system and set up management structures that match the level (Articles 11 to 13).

The 2019 standards, which practitioners call MLPS 2.0, give the technical content. GB/T 22239-2019 sets the baseline requirements by level, covering security technical requirements (physical environment, communications network, area boundary, computing environment and security management center) and security management requirements (policies, organization, personnel, construction management and operations management). GB/T 28448-2019 sets evaluation requirements, with general and extended requirements, and GB/T 25070-2019 covers security design.

If an evaluation finds a system below its level, the operator must prepare a rectification plan (Article 14). Public security organs issue correction notices when they find problems during inspection, and operators file correction reports (Article 20). Penalties apply to level 3 and above operators that violate the Rules (Article 40).

Key Elements

• Five protection levels (Article 7)

Level 1: destruction harms citizens' or organizations' lawful rights but not national security, social order or the public interest. Level 2: grave harm to those rights, or harm to social order or the public interest. Level 3: grave harm to social order or the public interest, or harm to national security. Level 4: especially grave harm to social order or the public interest, or grave harm to national security. Level 5: especially grave harm to national security.

• Grading and expert review (Articles 6 and 10)

Operators follow the principle of self-grading and self-protection. A competent department verifies the grade, may grade cross-province systems uniformly, and systems planned for level 4 or higher must be assessed by the national expert committee.

• Filing and filing review (Articles 15 to 17)

Level 2 and higher systems are filed with public security within 30 days. Level 3 and higher systems submit supporting materials such as the topology, management structures and product lists. Public security reviews the filing within ten working days and issues a filing certificate or asks for correction or regrading.

• Evaluation and inspection (Articles 14 and 18)

Level 3 systems are evaluated and self-inspected at least once a year, level 4 at least every half year, and level 5 by special requirements. Public security inspects level 3 systems at least yearly and level 4 systems at least every half year.

• Baseline standards (GB/T 22239-2019)

The baseline sets security technical and security management requirements for each level. The evaluation standard GB/T 28448-2019 checks conformity to it.

• Link to the Cybersecurity Law (Article 21)

The Cybersecurity Law makes multi-level protection a duty for network operators, including a named responsible person, technical measures, logs kept at least six months, data classification, backups and encryption. Critical information infrastructure operators carry additional duties.

What does it cover?

MLPS applies to network operators in mainland China for the information systems and networks they operate. Systems at level 2 and above have filing duties, and systems at level 3 and above face evaluation and inspection.

What are its objectives?

The scheme aims to protect information systems in proportion to their importance.

Grade every system by the harm its destruction would cause.

File systems at level 2 and above with public security authorities.

Build safeguards that match the system's level and keep them current.

Have systems at level 3 and above evaluated by qualified bodies on a fixed cycle.

Correct gaps found by evaluation and inspection and report the corrections.

Concentrate state supervision on the systems that matter most.

Framework in Context

MLPS sits under the Cybersecurity Law and is supported by national GB/T standards. It is closely related to the critical information infrastructure regime, which adds duties on top of level 3 and above systems, and to the Data Security Law, which also relies on the multi-level protection system for networked data handling.

Common Framework Mappings

Organizations map MLPS 2.0 to internationally recognized frameworks to harmonize controls, demonstrate multi-jurisdictional compliance, and support risk management, audits, and third-party assurance.

Mapped frameworks include:

CIS Critical Security Controls

GB/T 22239 — Information Security Technology — Baseline for Classified Protection of Cybersecurity

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27701

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-53