China Cybersecurity Law (CSL) 35-36: Art. 35-36 Critical information infrastructure: security built in simultaneously, a specialised security body with vetted responsible persons, training and assessments, disaster recovery backups, emergency plans and drills

Critical information infrastructure must be built with performance supporting stable and continuous operation and with security technical measures planned, constructed and put into use simultaneously (Article 35); beyond the ranked-protection obligations of Article 23, CII operators must establish specialised security management bodies and designate persons responsible for security management, with security background checks on them and on other personnel in critical positions, regularly conduct cybersecurity education, technical training and skills assessments for staff, carry out disaster recovery backups for important systems and databases, formulate cybersecurity incident emergency response plans with regular drills, and perform other obligations laws and administrative regulations prescribe (Article 36). The CSET translation's cross-reference in Article 36 reads Article 21, the 2016 number of the ranked-protection article, carried over unrenumbered.