China MLPS 2.0 Guide: Grading, Filing and Annual Testing Explained

Every network operator in mainland China is legally inside the Multi-Level Protection Scheme (MLPS), yet many foreign-invested companies only discover it when a public security bureau asks for their filing certificate or a customer asks for a Level 3 test report. MLPS 2.0 is the name for the scheme as rebuilt in 2019 around the Cybersecurity Law and a family of national standards, chiefly GB/T 22239-2019. It requires each network or system to be graded on a five-level scale, filed with the local public security bureau, built to the matching baseline, and tested by an accredited assessor on a recurring cycle. This guide covers scope, the grading method, obligations by level, the current legal status after the 2025 amendment of the Cybersecurity Law, enforcement, and what MLPS means for service accounts, API keys and AI agents. It is for security and IT leads running systems in China and for global teams deciding how to host China workloads; data export and personal information rules are covered separately in the China PIPL Guide.

Status checked 27 October 2026 against the CAC publication of the amended Cybersecurity Law and the NPC Standing Committee amending decision. This page is not legal advice.

Key takeaways

• MLPS is a statutory duty, not a certification: Article 23 of the amended Cybersecurity Law (Article 21 in the 2017 numbering) says the state implements the multi-level protection system and lists the baseline duties every network operator must meet.
• Grading drives everything: the level (1 to 5) is set by the harm that damage to the system would cause to individuals and organisations, social order and the public interest, or national security, and it fixes the control baseline and the testing cycle.
• Level 2 and above must be filed, Level 3 and above tested every year: the Ministry of Public Security's 2020 Guiding Opinions require annual testing by a qualified body for Level 3 and above, and testing before a new Level 3 system goes live.
• Logs for six months is in the law itself: Article 23 requires network operators to monitor and record network operations and keep network logs for at least six months.
• Penalties rose on 1 January 2026: the amended Article 61 now reaches RMB 10 million for particularly serious consequences and RMB 1 million for responsible individuals.

Scope: who and what is covered

The Cybersecurity Law applies to "network operators": owners and managers of networks and network service providers inside mainland China. In practice that includes any company running servers, cloud tenancies, websites, apps, office networks or industrial control systems in China, whether domestic or foreign-invested. MLPS 2.0 widened the grading object from the "information systems" of the 2007 era (MLPS 1.0) to networks in general, including cloud platforms, mobile internet, Internet of Things, industrial control systems and big data platforms.

A foreign company whose China business runs entirely on a global SaaS platform hosted abroad still operates local networks (office LAN, local cloud tenancy, an ICP-licensed website), so "we have nothing to grade" is rarely true. The practical question is how many grading objects there are and which reach Level 2 or 3.

The five levels

The level definitions follow the 2019 standards as summarised by Reed Smith; the examples are typical patterns, not legal categories. Sector regulators publish their own grading guidance and can set minimum levels for their sectors, so check the sector rule before settling on a level.

Key obligations

The baseline duties in the law

Article 23 of the amended Cybersecurity Law requires every network operator to:

• Govern: set internal security management rules and operating procedures and name the person responsible for network security.
• Protect: take technical measures against computer viruses, network attacks, intrusions and other harmful activity.
• Monitor and log: monitor and record network operating status and security events, and keep the related network logs for at least six months.
• Protect data: classify data, back up important data and encrypt it.

For log design, retention tiers and integrity controls see the Log Management and Retention Guide.

The MLPS lifecycle

1. Grading: define each grading object, assess the harm from loss of business information security and of system service security, and propose a level. Proposed levels of 2 and above go to expert review, and some sectors require regulator approval.
2. Filing: file Level 2 and above with the local public security bureau and report to the sector regulator. Protiviti describes the current deadline as 30 days after the level is determined; the 2018 draft regulation would shorten this to 10 working days.
3. Construction and rectification: build or remediate to GB/T 22239-2019 for the level, using GB/T 25070-2019 for security design and GB/T 25058-2019 for the implementation process.
4. Testing (dengbao ceping): a qualified testing body assesses against GB/T 28448-2019 and issues a report; Level 3 and above results go to the filing authority and the sector regulator.
5. Supervision: public security bodies inspect, on site or remotely, under the Ministry of Public Security's provisions on supervision and inspection (often called Circular 151), which allow inspections without prior notice.

The standards family

GB/T 22239 organises requirements into technical areas (physical environment, communication network, area boundary, computing environment, security management centre) and management areas (policies, organisation, personnel, construction management, operations management). The security management centre is the MLPS 2.0 addition most foreign teams underestimate: Level 3 expects centralised management of security devices, audit records and policies, not only point controls.

Extra duties at Level 3 and above

The Ministry of Public Security's Guiding Opinions on implementing MLPS and CII protection (issued July 2020, published September 2020, as summarised by JunHe) add:

• Annual testing: Level 3 and above networks are tested once a year by a qualified testing body, with reports sent promptly to the filing authority and sector regulator.
• Test before go-live: a newly built Level 3 or higher network must pass testing before it goes into operation.
• Commercial cryptography: cryptography must be used correctly and effectively with compliant products, and a cryptographic application security assessment should run alongside the MLPS test.
• Supply chain: providers of design, construction, operations and technical services must be managed and their risks assessed.
• Remote operations: operating or maintaining systems remotely over the internet needs a risk assessment and controls.

Protiviti reports common market practice as testing every two years for Level 2, annually for Level 3 and every six months for Level 4, and a minimum assessment score of 75 to pass. Treat these as practice benchmarks and confirm the cycle with your assessor and sector regulator.

Critical information infrastructure

Article 33 of the amended law protects CII "on the basis of" MLPS, so a CIIO system is normally graded at Level 3 or above and then carries the CII layer: a dedicated security management body, background checks for key staff, training, disaster recovery backups and tested emergency plans (Art. 36), and a security and risk assessment at least once a year, done in house or by a qualified provider (Art. 40). CII identification is done by sector regulators, who notify operators.

Timeline and current status

The 2018 draft regulation has not, as far as we could confirm on 27 October 2026, been issued in final form, so the operative detail still comes from the law, the national standards, the 2007 measures and the 2020 Guiding Opinions. Older memos citing Article 21 and Article 59 refer to the 2017 numbering. For the wider law see the China Cybersecurity Law Guide.

Enforcement and penalties

Failure to perform the Article 23 duties is penalised under amended Article 61.

The upper tiers are as summarised by Latham and Watkins from the amending decision. Before 2026, Article 59 capped general operator fines at RMB 100,000 and individual fines at RMB 50,000. Enforcement is local and frequent rather than headline-driven: Reed Smith cited Jiangsu province reporting 6,467 administrative cases and 4,631 warnings since 2017, including a company fined RMB 50,000 after a hacking incident. Beyond fines, public security bodies can order correction, suspend services and, through the inspection provisions, demand evidence on short notice.

What it means for AI agents and non-human identities

GB/T 22239 controls identification, authentication, access control and security audit at every level, and they apply to machine accounts as much as to people. Assessors test what they can see in configuration and logs, so non-human identities are often where Level 3 tests lose points.

• Identification and authentication: Level 3 expects unique identities, complexity and periodic change of credentials, and two or more authentication factors for administrators. Shared service accounts, embedded passwords and API keys that never rotate fail this directly. See the Service Account Security Guide.
• Least privilege and separation of duties: default accounts renamed or disabled, privileges split between system, audit and security administrators. An AI agent or automation account with blanket administrator rights collapses that separation.
• Security audit: audit records must cover important user behaviour and security events, be protected from deletion and be kept at least six months under the law. Agent actions taken through tokens need to land in the same audit trail with an attributable identity. See the Agentic AI Identity Guide.
• Remote operations and suppliers: the 2020 Guiding Opinions require a risk assessment for remote internet maintenance at Level 3 and above. Vendor and MSP accounts, jump hosts and the credentials used by overseas support teams are in scope.
• Cryptography: certificates and keys used by workloads fall under the commercial cryptography assessment that accompanies Level 3 testing; inventory them and their algorithms. See the Machine Identity, PKI and Certificate Lifecycle Guide.
• Data flows: an agent or integration that pulls China data to an overseas model or platform is a cross-border transfer under the PIPL and the Data Security Law, regardless of the MLPS level. See the China Data Security Law and Network Data Security Regulations Guide.

Compliance steps

1. Inventory grading objects: list every China network, cloud tenancy, website, app and OT system with owner, boundary, hosting and the data it processes. Include machine identities and integrations that cross the boundary.
2. Propose levels: assess harm to business information and to system service separately, take the higher result, and check sector minimums. Document the reasoning, because expert reviewers and inspectors ask for it.
3. Expert review and filing: get Level 2+ proposals reviewed, file with the local public security bureau, report to the sector regulator, and keep the filing certificate where auditors and customers can be shown it.
4. Gap assessment: run a pre-assessment against GB/T 22239 for the level, including the extensions that apply (cloud, IoT, ICS). Prioritise the security management centre, audit logging, administrator authentication and boundary controls.
5. Remediate: close gaps, using the cloud provider's own MLPS-filed platform controls where hosting in China; the tenant still owns its own grading object.
6. Accredited test: engage a qualified testing body, test before go-live for new Level 3 systems, and run the commercial cryptography assessment in parallel.
7. Submit and fix findings: send the report to the filing authority and regulator, and track findings to closure before the next cycle.
8. Re-grade on change: re-assess when scope, data volume or architecture changes; filed changes follow the same process.
9. Prepare for inspection: keep a binder (filing certificate, test reports, policies, log samples, account lists) ready for unannounced inspection.

Decision guidance

Measurement and framework mapping

• Metrics: percentage of grading objects with a current filing; Level 3+ systems with a test report less than 12 months old; open test findings older than 90 days; log sources retained six months or more; administrator and service accounts with multi-factor or key-based authentication; machine identities with a named owner.

Common failure patterns

• Treating MLPS as optional for foreign companies: the duty attaches to operating a network in China, not to ownership.
• Under-grading to avoid testing: expert review and sector minimums catch it, and an incident exposes it.
• Relying on the cloud provider's filing: the platform's MLPS status does not grade or test the tenant system.
• Logs that roll over in 30 days: default retention in many appliances and SaaS tiers is shorter than the statutory six months.
• Unmanaged machine accounts: shared, never-rotated service and vendor credentials are a recurring test finding and a common path in real intrusions.

Practitioner checklist

• List every China grading object, including cloud tenancies, apps, websites and OT systems.
• Record the harm analysis and proposed level for each, and check sector minimum levels.
• Obtain expert review for Level 2 and above and file with the local public security bureau.
• Run a GB/T 22239 gap assessment with the applicable extensions.
• Keep network logs for at least six months and protect them from deletion.
• Test Level 3 systems before go-live and every year with a qualified testing body.
• Run the commercial cryptography assessment alongside Level 3 testing.
• Bring service accounts, API keys, vendor and agent identities under unique, owned, rotated credentials.
• Update memos and policies to the 2026 numbering (Art. 23, Art. 61) and penalty tiers.

Standards and references

• Cyberspace Administration of China: Cybersecurity Law of the PRC (as amended 28 October 2025)
• NPC Standing Committee via Xinhua: Decision on Amending the Cybersecurity Law
• DigiChina, Stanford University: Translation of the Cybersecurity Law (2017 text)
• JunHe: MPS Guiding Opinions on Implementing MLPS and CII Protection
• Zhong Lun: MLPS 2.0 Review and Outlook
• Reed Smith: MLPS 2.0, China's Enhanced Multi-Level Protection
• Latham and Watkins: China's Cybersecurity Law Amendments Increase Penalties
• Protiviti: Multi-Level Protection Scheme

Related NHI Mgmt Group resources: China Cybersecurity Law Guide · China PIPL Guide · China Data Security Law and Network Data Security Regulations Guide · Log Management and Retention Guide. This guide summarises China's Multi-Level Protection Scheme as of October 2026 and is not legal advice.