China Cybersecurity Law (CSL) 40: Art. 40 At least one security testing and assessment per year, results and improvements submitted to the protection department

CII operators must, independently or through cybersecurity service institutions, conduct at least one testing and assessment of the security of their networks and potential risks per year and submit the results and improvement measures to the departments responsible for the security protection of critical information infrastructure.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Chapter III Section 2: Critical information infrastructure (Articles 35 to 40) – China Cybersecurity Law (CSL)

35-36 Art. 35-36 Critical information infrastructure: security built in simultaneously, a specialised security body with vetted responsible persons, training and assessments, disaster recovery backups, emergency plans and drills
37-38 Art. 37-38 CII procurement: national security review where national security may be affected, and security and secrecy agreements with providers
39 Art. 39 Personal information and important data collected by CII operators stored within China; security assessment before any provision abroad

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All China Cybersecurity Law (CSL) controls