China MLPS 2.0

PRC Multi-Level Protection Scheme 2.0 - 5 levels of system grading and protection requirements.


Short name	MLPS 2.0
Region	Asia-Pacific
Country or scope	China
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MLPS 2.0

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MLPS 2.0.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for MLPS 2.0 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CN-MLPS-GRADE` System Grading and Identification	Every network/system must be graded and filed, which requires the system to be named and its constituent software components enumerated (GB/T 22239-2019 grading and filing framework)	Scan
`CN-MLPS-ASSET` Asset Management in the Computing Environment	Secure computing environment requirements include managing and cataloguing system assets, so all software components must appear in the inventory (GB/T 22239-2019 secure computing environment / asset management requirements)	Scan
`CN-MLPS-TRUST` Trusted Verification of Software	MLPS 2.0 introduces trusted verification of system programs and applications at boot and runtime, which requires cryptographic integrity hashes for deployed components (GB/T 22239-2019 trusted verification requirements)	Scan
`CN-MLPS-VULN` Vulnerability and Patch Management	Security management requirements include identifying and remediating vulnerabilities in a timely manner, which requires every component's version to be recorded and current (GB/T 22239-2019 security operations and maintenance requirements)	Scan
`CN-MLPS-SUPPLY` Procurement and Outsourced Development Control	Product procurement must use qualified suppliers and outsourced software development is subject to security checks, so the supplier of each software component must be identified (GB/T 22239-2019 product procurement and outsourced development requirements)	Scan
`CN-MLPS-DOC` Security Management Documentation	Graded systems must maintain security management documentation and records for assessment, so machine-readable records must carry a document identity and creation timestamp (GB/T 22239-2019 security management requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MLPS-A`	Physical Security (Class A)
`MLPS-B`	Network Security (Class B)
`MLPS-C`	Host Security (Class C)
`MLPS-D`	Application Security (Class D)
`MLPS-E`	Data Security (Class E)
`MLPS-F`	Security Management (Class F)
`MLPS-EVAL`	Comprehensive MLPS Evaluation
`MLPS-L3-ANNUAL`	Level 3+ Annual Assessment

Policy templates

Written for MLPS 2.0:

MLPS 2.0 Assessment Standard Operating Procedure

And 22 from the standard set, adapted to MLPS 2.0.