A vendor whose product is sold or used in mainland China must report a newly verified vulnerability to a Ministry of Industry and Information Technology platform within two days, and researchers there may not publish details before a fix exists, which changes how global PSIRTs and bug bounty programmes run. The Provisions on the Management of Network Product Security Vulnerabilities (网络产品安全漏洞管理规定), issued jointly by the Ministry of Industry and Information Technology (MIIT), the Cyberspace Administration of China (CAC) and the Ministry of Public Security (MPS), have applied since 1 September 2021. They govern how vulnerabilities in network products are received, verified, reported, fixed and published, and who may run a vulnerability collection platform. This guide explains the duties of product providers, network operators, researchers and platforms, the penalties through the amended Cybersecurity Law, and how to fit the two-day rule into a coordinated disclosure process. It is for PSIRT leads, product security managers, bug bounty owners and compliance teams of vendors selling into China. Status: summarised from the official text published in the State Council policy library and the amended Cybersecurity Law published by the CAC, checked 27 October 2026. English renderings of Chinese terms are our own.
Key takeaways
- Two days to report to MIIT. Article 7 requires network product providers to submit vulnerability information to the MIIT Cyber Security Threat and Vulnerability Information Sharing Platform within 2 days, including product name, model, version, technical characteristics, harm and scope of impact.
- Verify and tell upstream immediately. Providers must verify and assess a vulnerability as soon as they learn of it, and notify the upstream supplier at once if a component is affected.
- Publication is constrained. Article 9 bars publishing before the provider offers a fix or mitigation (unless MIIT and MPS assess early release), bars exploit tools, hype or extortion, and bars giving unpublished vulnerability information to overseas parties other than the product provider.
- Everyone keeps intake logs. Providers, operators and collection platforms must keep a working channel for vulnerability reports and retain intake logs for at least 6 months (Article 5).
- Penalties run through the Cybersecurity Law. In the amended law, providers that fail to remedy, notify users or report face a warning and correction order, then fines of RMB 50,000 to 500,000, plus personal fines for responsible managers.
Scope: who and what is covered
The Provisions are based on the Cybersecurity Law (Article 1) and apply in mainland China to network product providers, network operators, and organisations or individuals that discover, collect or publish network product security vulnerabilities (Article 2). Network products include hardware and software. For the parent law see the China Cybersecurity Law Guide.
| Party | Main duties | Articles |
|---|---|---|
| Network product provider (网络产品提供者) | Intake channel and logs; verify, assess, notify upstream; report to MIIT within 2 days; fix promptly; tell users and downstream vendors; provide support | 5, 7 |
| Network operator (网络运营者) | Intake channel and logs; on learning of a vulnerability in its own networks, systems or devices, verify immediately and complete the fix | 5, 8 |
| Vulnerability collection platform (漏洞收集平台) | File (备案) with MIIT; intake channel and logs; internal controls against leaks and improper publication | 5, 10, 11 |
| Discoverers and publishers (researchers, security firms) | Follow the eight publication rules; encouraged to report to providers and to the named national platforms | 6, 9, 10 |
| Everyone | No exploiting vulnerabilities to harm networks; no illegal collection, sale or publication; no technical support, advertising or payment help to those who exploit vulnerabilities | 4 |
Who regulates what (Article 3)
- CAC: overall coordination of vulnerability management.
- MIIT: comprehensive management of network product vulnerabilities and supervision of the telecommunications and internet sectors; operates the reporting platform.
- MPS: supervision and enforcement against illegal and criminal activity that exploits vulnerabilities.
- Information sharing: the three authorities share vulnerability information and jointly assess major risks. Under Article 7, the MIIT platform passes reports to the national network and information security notification centre and to CNCERT.
Key obligations
Provider workflow (Article 7)
| Step | Requirement | Timing |
|---|---|---|
| 1. Verify and assess | Take measures, verify the vulnerability and assess its harm and scope | Immediately on learning of it |
| 2. Notify upstream | If the vulnerability is in an upstream product or component, notify that provider | Immediately |
| 3. Report to MIIT | Submit to the MIIT Cyber Security Threat and Vulnerability Information Sharing Platform: product name, model, version, technical characteristics, harm and scope of impact | Within 2 days ("应当在2日内") |
| 4. Fix | Organise repair of the vulnerability | Promptly |
| 5. Notify users | Where users or downstream vendors must act (for example software or firmware upgrades), inform them of the risk and the fix and provide technical support | Promptly |
| 6. Incentives | Providers are encouraged to set up vulnerability reward (bounty) mechanisms | Optional |
The text does not define when the two days start or whether they are calendar or working days. A prudent reading is two calendar days from verification. Note that the report goes to a government platform before a fix may exist, so plan the content of the report with that in mind.
Publication rules (Article 9)
- Do not publish before the product provider has offered a fix or mitigation. If early publication seems necessary, assess and agree it with the provider and report to MIIT and MPS, which organise an assessment before publication.
- Do not publish details of vulnerabilities in the networks, information systems and equipment that network operators are using.
- Do not deliberately exaggerate harm and risk, or use vulnerability information for malicious hype, fraud or extortion.
- Do not publish or provide programs and tools designed specifically to exploit vulnerabilities.
- Publish fixes or mitigations together with the vulnerability.
- Do not publish vulnerability information during major national events without MPS consent.
- Do not provide unpublished vulnerability information to overseas organisations or individuals other than the product provider.
- Follow other relevant laws and regulations.
Collection platforms and national databases (Article 10)
Any organisation or individual running a vulnerability collection platform, which can include a bug bounty or crowdsourced research platform operating in China, must file with MIIT; MIIT notifies MPS and the CAC and publishes the list of filed platforms. Discoverers are encouraged to report to four national platforms: the MIIT Cyber Security Threat and Vulnerability Information Sharing Platform, the National Network and Information Security Information Notification Centre vulnerability platform, the CNCERT vulnerability platform and the China Information Technology Security Evaluation Center vulnerability database. These are commonly referred to as NVDB, CNVD (CNCERT) and CNNVD (CNITSEC).
How this compares with ISO/IEC 29147 practice
| Topic | Typical coordinated disclosure practice | China Provisions |
|---|---|---|
| Government notification | Usually none before a fix, except sector or product regulation | Mandatory report to MIIT within 2 days |
| Researcher publication | Agreed embargo, often with a deadline | No publication before a fix without MIIT and MPS assessment |
| Proof of concept | Often published after fix | Exploit programs and tools may not be published or provided |
| Cross-border sharing | Researchers may share with coordinators abroad | Unpublished information only to the product provider overseas |
| Intake records | Good practice | Mandatory logs for at least 6 months |
For the general disclosure model see the ISO/IEC 29147 and 30111 Vulnerability Disclosure and Handling Guide.
Timeline and current status
| Date | Event |
|---|---|
| 12 July 2021 | Provisions issued by MIIT, CAC and MPS (工信部联网安〔2021〕66号) |
| 14 July 2021 | Published in the State Council policy library |
| 1 September 2021 | Provisions take effect (Article 16) |
| 28 October 2025 | NPC Standing Committee decision amending the Cybersecurity Law; provider vulnerability duties appear in Article 24 and penalties in Article 62 of the amended text |
| 27 October 2026 | Status check for this guide: Provisions in force as published |
The Provisions' penalty articles cite the Cybersecurity Law by its 2016 article numbers (Articles 59, 60, 62 and 63). The CAC's published amended text renumbers the law, so check which numbering a regulator notice or contract uses.
Enforcement and penalties
| Breach | Route in the Provisions | Consequence in the amended Cybersecurity Law |
|---|---|---|
| Provider fails to remedy or report (Articles 7, 12) | MIIT and MPS act within their remits; cases under the law's provider duties are penalised under it | Article 62: warning and correction order; if the provider refuses or harm results, RMB 50,000 to 500,000, and RMB 10,000 to 100,000 for the directly responsible manager; serious consequences fall under Article 61, paragraph 3 (RMB 500,000 to 2,000,000, or 2,000,000 to 10,000,000 for especially serious consequences) |
| Operator fails to fix (Articles 8, 13) | The relevant authority acts; cases under the law's operator duties are penalised under it | Operator security duty penalties under the law |
| Illegal collection, sale or publication (Articles 4, 9, 14) | MIIT and MPS act within their remits | Penalties under the law for the relevant prohibited conduct |
| Exploiting vulnerabilities (Article 15) | Public security organs | Administrative penalties and, where a crime is committed, criminal liability |
Article 24 of the amended law also forbids providers from installing malicious programs or ending security maintenance during the agreed or prescribed period, so lifecycle and end-of-support commitments in China contracts carry legal weight.
What it means for AI agents and non-human identities
- Credential flaws are product vulnerabilities: hard-coded keys, default service passwords and token handling bugs in a network product are security vulnerabilities to verify, report within 2 days and fix. See the PSIRT Guide.
- AI products are network products: software that embeds models or agents and is sold or used in China falls within "network products" when it is software or hardware in scope; vulnerabilities in agent tool-calling, authorisation or prompt handling should enter the same workflow.
- Do not let automation leak embargoed data: AI triage assistants, ticket integrations and agentic pipelines that send vulnerability details to services outside China could breach Article 9(7) if the information is unpublished. Restrict where embargoed findings flow.
- Protect the reporting account: the MIIT platform account used by the PSIRT is a sensitive credential. Keep it in a vault, bind it to named staff and log its use.
- Operator duties reach your NHI estate: under Article 8, an operator that learns of a vulnerability in its own systems, such as an exposed API key flaw in an internal platform, must verify and fix it immediately. See the Secrets Management Guide.
Compliance steps
- Decide applicability: list products sold, supplied or operated in mainland China and the Chinese entities that provide them.
- Open the intake channel: publish a vulnerability reporting address for China products and keep intake logs for at least 6 months.
- Register on the MIIT platform: set up the PSIRT account in advance, agree who files, and prepare the report template with product name, model, version, technical characteristics, harm and scope.
- Embed the two-day clock: start the timer at verification, in the PSIRT ticketing system, with escalation at 24 hours.
- Handle upstream and downstream: notify component suppliers immediately and prepare user and downstream vendor notices with fixes and support.
- Align bug bounty terms: if you run a collection platform in China, file it with MIIT; update researcher terms to reflect Article 9 publication rules and the ban on exploit tools.
- Control cross-border flow: decide how unpublished findings from China researchers reach global teams lawfully, given the overseas restriction on parties other than the product provider.
- Review annually: check for implementing notices from MIIT and changes from the amended Cybersecurity Law.
Measuring it
- Time to MIIT report: hours from verification to submission; target under 48.
- Upstream notification time: hours from verification to supplier notice for component vulnerabilities.
- Fix and notice time: days from verification to fix release and user notice.
- Log retention compliance: intake logs available for the last 6 months, checked quarterly.
- Embargo breaches: count of unpublished findings that left approved channels.
Framework mapping
| Obligation | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Intake channel and handling | ID.RA-08 | RA-5(11) | 8.8 Management of technical vulnerabilities |
| Reporting to authorities | RS.CO-02 | IR-6 | 5.5 Contact with authorities |
| Fixing and notifying users | ID.RA-06 | SI-2, SA-11 | 8.8 Management of technical vulnerabilities |
| Supplier notification and contracts | GV.SC-05 | SR-8 | 5.20 Addressing information security within supplier agreements |
| Knowing legal duties | GV.OC-03 | PL-2 | 5.31 Legal, statutory, regulatory and contractual requirements |
Common failure patterns
- Global PSIRT unaware of the rule: China reports are not filed because the global process only notifies customers at fix time.
- No MIIT account ready: registration starts after verification, and the two days pass.
- Bounty terms that permit early publication: standard 90-day disclosure deadlines conflict with Article 9(1) for China-based researchers.
- Proof of concept in advisories: exploit code attached to advisories or researcher write-ups conflicts with Article 9(4).
- Logs not kept: intake mailboxes purged on short retention, below the 6-month minimum.
- Ignoring end-of-support duties: ending maintenance during an agreed support period, contrary to Article 24 of the amended law.
Practitioner checklist
- Products in scope for China are listed with the responsible Chinese entity.
- A vulnerability intake channel exists and logs are kept for at least 6 months.
- The MIIT platform account is set up, vaulted and assigned to named staff.
- The PSIRT workflow starts a 2-day clock at verification with escalation.
- Upstream suppliers are notified immediately for component flaws.
- User and downstream notices include fixes and technical support.
- Bug bounty and researcher terms reflect Article 9 publication rules.
- Any China collection platform is filed with MIIT.
- Unpublished findings do not flow to overseas parties other than the provider, including through AI tools.
Standards and references
- State Council of the PRC: Notice on the Provisions on the Management of Network Product Security Vulnerabilities (工信部联网安〔2021〕66号)
- Cyberspace Administration of China: Cybersecurity Law of the People's Republic of China (amended text)
- Cyberspace Administration of China: Measures for the Administration of National Cybersecurity Incident Reporting
- Cyberspace Administration of China: Laws (法律) listing
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Bug Bounty and Vulnerability Disclosure Guide · PSIRT Guide · China Cybersecurity Incident Reporting Measures Guide · EU Cyber Resilience Act Guide. This guide summarises China's Provisions on the Management of Network Product Security Vulnerabilities and related Cybersecurity Law provisions and is not legal advice.