China Cybersecurity Law

PRC Cybersecurity Law - network operator obligations, CII protection, cross-border data.


Short name	CSL CN
Region	Asia-Pacific
Country or scope	China
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CSL CN

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for CSL CN.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for CSL CN and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CN-CSL-21-MLPS` Multi-Level Protection Duties	Network operators must fulfil multi-level protection obligations including internal security management systems and technical measures against attacks and intrusions, which starts with an inventory of the software their networks run (Cybersecurity Law Art. 21)	Scan
`CN-CSL-21-RESP` Security Responsible Persons	Operators must determine persons responsible for cybersecurity, so technical security documentation must record an accountable creator contact (Cybersecurity Law Art. 21)	Scan
`CN-CSL-22` Product Security Maintenance and Vulnerability Disclosure	Network products and services must be free of malicious programs, and providers must inform users of discovered security defects and vulnerabilities and provide ongoing security maintenance, which requires tracked component versions (Cybersecurity Law Art. 22)	Scan
`CN-CSL-22-INTEG` Malicious-Program Prevention	The prohibition on shipping malicious programs implies verifiable integrity of distributed software, evidenced by cryptographic hashes on components (Cybersecurity Law Art. 22)	Scan
`CN-CSL-25` Emergency Response and Remediation	Network operators must formulate emergency response plans and promptly address system vulnerabilities and security risks, which requires matching deployed components against vulnerability identifiers (Cybersecurity Law Art. 25)	Scan
`CN-CSL-35` CII Procurement Security Review	Critical information infrastructure operators procuring network products or services that may affect national security must pass a security review, which presupposes knowing the supplier of the components used (Cybersecurity Law Art. 35)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CSL-21`	Network Operator Security Obligations
`CSL-24`	Real-Name Registration
`CSL-31-39`	Critical Information Infrastructure (CII) Protection
`CSL-37`	Data Localisation
`CSL-40-44`	Personal Information Protection (CSL)
`CSL-48`	Cybersecurity Incident Reporting
`CSL-CII-ISAC`	CII Information Sharing

Policy templates

Written for CSL CN:

Critical Information Infrastructure (CII) Protection Plan

And 22 from the standard set, adapted to CSL CN.