China Cybersecurity Law (CSL)
The Cybersecurity Law of the People's Republic of China (in force 1 June 2017, amended by the NPC Standing Committee's Decision of 28 October 2025 with effect from 1 January 2026) is China's foundational cybersecurity statute. It binds network operators to ranked cybersecurity protection (MLPS) with six-month log retention, incident plans and reporting, real-identity checks, lawful and consented collection of personal information with breach notice, and content management; binds product and service providers to defect remediation and continuous security maintenance and key equipment to certification; and binds critical information infrastructure operators to built-in security, vetted security bodies, backups and drills, procurement security review, domestic storage with assessed outbound transfer and annual assessment. The 2025 amendment left the obligations unchanged but renumbered the Law, added articles on artificial intelligence and minors, tied personal information processing to the PIPL and the Civil Code, raised fines in tiers up to RMB 10 million with personal fines up to RMB 1 million, and extended liability to any overseas activity endangering China's cybersecurity. 20 leaves at 90.
China Cybersecurity Law (CSL) is a compliance framework from People's Republic of China (with overseas liability under Article 77 as amended) with 5 domains and 20 controls that map to 5 other frameworks. The largest domains are Chapter III Section 1: Network operations security, general (Articles 23 to 30) – China Cybersecurity Law (CSL) (7 controls), Chapter IV: Network information security (Articles 42 to 51) – China Cybersecurity Law (CSL) (6 controls), Chapter III Section 2: Critical information infrastructure (Articles 35 to 40) – China Cybersecurity Law (CSL) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Chapter I: General duties on operators and network users (Articles 10, 11 and 13) – China Cybersecurity Law (CSL)
| Code | Title |
|---|---|
| china-cybersecurity-law-csl::10-11 | Art. 10-11 Network operators fulfil their cybersecurity protection obligations and accept supervision; whoever builds or operates networks or provides services over them takes technical and other necessary measures for secure, stable operation, incident response and data integrity, secrecy and availability |
| china-cybersecurity-law-csl::13 | Art. 13 Using networks lawfully: no endangering cybersecurity and no use of networks for the prohibited acts the article lists |
Chapter III Section 1: Network operations security, general (Articles 23 to 30) – China Cybersecurity Law (CSL)
| Code | Title |
|---|---|
| china-cybersecurity-law-csl::23 | Art. 23 Ranked cybersecurity protection (MLPS): management system and responsible persons, technical defences, monitoring with logs kept six months, data categorisation, backup and encryption |
| china-cybersecurity-law-csl::24 | Art. 24 Network products and services: mandatory standards, no malicious programs, defect remediation with user notice and reporting, continuous security maintenance, consent for user-information collection |
| china-cybersecurity-law-csl::25 | Art. 25 Key network equipment and specialised cybersecurity products certified or tested before sale |
| china-cybersecurity-law-csl::26 | Art. 26 Real identity of users for network access, domain registration, telephone services, information publication and instant messaging |
| china-cybersecurity-law-csl::27 | Art. 27 Emergency response plans, prompt handling of vulnerabilities, viruses, attacks and intrusions, activation and reporting on incidents |
| china-cybersecurity-law-csl::28-29 | Art. 28-29 Certification, testing, assessment and vulnerability disclosure under state rules; no attacks, no attack tools, no assistance to attackers |
| china-cybersecurity-law-csl::30 | Art. 30 Technical support and assistance to public security and national security agencies |
Chapter III Section 2: Critical information infrastructure (Articles 35 to 40) – China Cybersecurity Law (CSL)
| Code | Title |
|---|---|
| china-cybersecurity-law-csl::35-36 | Art. 35-36 Critical information infrastructure: security built in simultaneously, a specialised security body with vetted responsible persons, training and assessments, disaster recovery backups, emergency plans and drills |
| china-cybersecurity-law-csl::37-38 | Art. 37-38 CII procurement: national security review where national security may be affected, and security and secrecy agreements with providers |
| china-cybersecurity-law-csl::39 | Art. 39 Personal information and important data collected by CII operators stored within China; security assessment before any provision abroad |
| china-cybersecurity-law-csl::40 | Art. 40 At least one security testing and assessment per year, results and improvements submitted to the protection department |
Chapter IV: Network information security (Articles 42 to 51) – China Cybersecurity Law (CSL)
| Code | Title |
|---|---|
| china-cybersecurity-law-csl::42-43 | Art. 42-43 User information kept secret under a protection system; personal information collected lawfully, legitimately and necessarily, with public rules, stated purposes and consent, and nothing unrelated to the service |
| china-cybersecurity-law-csl::44-45 | Art. 44-45 No disclosure, tampering or damage; no provision to others without consent unless irreversibly de-identified; security measures; breach remediation with user notice and reporting; deletion and correction on request |
| china-cybersecurity-law-csl::46 | Art. 46 No theft, unlawful acquisition, sale or provision of personal information |
| china-cybersecurity-law-csl::48 | Art. 48 No websites, groups or postings for fraud, criminal instruction or prohibited items |
| china-cybersecurity-law-csl::49-50 | Art. 49-50 Manage user-published information: stop prohibited content, delete it, keep records and report; no malicious programs or prohibited information in electronic messages and apps, and download and messaging services police their users |
| china-cybersecurity-law-csl::51 | Art. 51 Complaint and reporting mechanism for network information security, published and promptly handled; cooperate with supervision and inspection |
Chapter V: Emergency response duties on operators (Articles 57 and 58) – China Cybersecurity Law (CSL)
| Code | Title |
|---|---|
| china-cybersecurity-law-csl::57-58 | Art. 57-58 On incidents, take the technical and other measures the departments require; on regulatory interviews, rectify and eliminate hidden dangers |
Your Compliance Coverage
If you comply with China Cybersecurity Law (CSL), you already cover:
NIST Cybersecurity Framework 2.0
14%
6 controls mapped
Compare →GDPR
12%
5 controls mapped
Compare →China Personal Information Protection Law (PIPL)
7%
3 controls mapped
Compare →+ 2 more: China Data Security Law (DSL) (2%), ISO/IEC 17025:2017 - General Requirements for Testing and Calibration (2%)
See all 5 mapped frameworks ↓Maps to 5 other frameworks
Coverage is not the same as your position
This page shows what China Cybersecurity Law (CSL) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is China Cybersecurity Law (CSL) and who does it apply to?
China Cybersecurity Law (CSL) is a compliance framework from People's Republic of China (with overseas liability under Article 77 as amended) with 5 domains and 20 controls. The Cybersecurity Law of the People's Republic of China (in force 1 June 2017, amended by the NPC Standing Committee's Decision of 28 October 2025 with effect from 1 January 2026) is China's foundational cybersecurity statute. It binds network operators to ranked cybersecurity protection (MLPS) with six-month log retention, incident plans and reporting, real-identity checks, lawful and consented collection of personal information with breach notice, and content management; binds product and service providers to defect remediation and continuous security maintenance and key equipment to certification; and binds critical information infrastructure operators to built-in security, vetted security bodies, backups and drills, procurement security review, domestic storage with assessed outbound transfer and annual assessment. The 2025 amendment left the obligations unchanged but renumbered the Law, added articles on artificial intelligence and minors, tied personal information processing to the PIPL and the Civil Code, raised fines in tiers up to RMB 10 million with personal fines up to RMB 1 million, and extended liability to any overseas activity endangering China's cybersecurity. 20 leaves at 90. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does China Cybersecurity Law (CSL) actually require?
China Cybersecurity Law (CSL) has 20 controls organised across 5 domains. The largest domains are Chapter III Section 1: Network operations security, general (Articles 23 to 30) – China Cybersecurity Law (CSL) (7 controls), Chapter IV: Network information security (Articles 42 to 51) – China Cybersecurity Law (CSL) (6 controls), Chapter III Section 2: Critical information infrastructure (Articles 35 to 40) – China Cybersecurity Law (CSL) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of China Cybersecurity Law (CSL) do I already cover?
China Cybersecurity Law (CSL) maps to 5 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (14% coverage), GDPR (12% coverage), China Personal Information Protection Law (PIPL) (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement China Cybersecurity Law (CSL)?
Start your China Cybersecurity Law (CSL) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about China Cybersecurity Law (CSL) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required