China Cybersecurity Law (CSL) 37-38: Art. 37-38 CII procurement: national security review where national security may be affected, and security and secrecy agreements with providers

Where a CII operator procures network products or services that may affect national security it must undergo the national security review organised by the CAC with the State Council departments (using unreviewed or failed products draws a fine of one to ten times the procurement amount), and when procuring network products or services it must conclude security and secrecy protection agreements with the providers specifying their obligations and responsibilities.