China CII Protection and Cybersecurity Review: operator duties, supplier exposure and review timelines

If your organisation runs, or sells into, critical information infrastructure (CII) in China, two instruments decide whether you can operate and whether your products can be bought: the CII Security Protection Regulations and the Cybersecurity Review Measures. The first sets out how CII is identified and what its operators must do; the second creates a national security review of CII procurement and of certain data processing and foreign listings. This guide goes deeper than our China Cybersecurity Law Guide, which covers the parent law and its 2026 penalty changes. It is for security, procurement, legal and product leads at CII operators in China and at foreign and domestic suppliers whose network products or cloud services reach them. Status line: checked against the State Council text of the CII Regulations and the CAC text of the Cybersecurity Review Measures on 11 November 2026.

Key takeaways

• CII status is assigned, not self-declared: sector protection departments write identification rules, identify CII and notify the operator, and must re-identify within 3 months after an operator reports a significant change (CII Regulations Articles 9 to 11).
• Operators carry named, auditable duties: a dedicated security management body with background-checked leaders, security testing and risk assessment at least once a year, incident reporting, and signed security and confidentiality agreements with suppliers (Articles 14 to 20).
• Procurement can trigger a national security review: a CII operator must predict the national security risk of a network product or service and apply to the Cybersecurity Review Office where it may affect national security (Review Measures Article 5).
• Suppliers are bound by contract: the operator must require suppliers to cooperate with review and commit not to obtain user data illegally, not to control user equipment illegally and not to cut off supply or support without a proper reason (Article 6).
• The money and the market are at stake: using an unreviewed product that required review can bring a fine of 1 to 10 times the purchase amount (CII Regulations Article 41), and a failed review can close the CII market to a supplier, as the 2023 Micron conclusion showed.

The two instruments and how they fit

Both rest on the Cybersecurity Law, which created the CII concept and the procurement review duty. The Data Security Law and the Personal Information Protection Law add data duties that CII operators must meet as well; see the China Data Security Law and Network Data Security Regulations Guide and the China PIPL Guide.

Is it CII? Scope and identification

Article 2 of the CII Regulations defines CII as important network facilities and information systems in key sectors whose damage, loss of function or data leakage could seriously endanger national security, the national economy and people's livelihood, or the public interest. The listed sectors are public communications and information services, energy, transport, water conservancy, finance, public services, e-government, and the national defence science and technology industry, plus other important industries and fields.

How identification works

1. Protection departments: the regulator or supervisor of each sector is its protection department, responsible for CII security in that sector (Article 8).
2. Identification rules: each protection department writes rules for its sector and files them with the State Council public security department. The rules must consider how important the network facility or system is to core business, the harm from damage, loss of function or data leakage, and the knock-on effect on other sectors (Article 9).
3. Notice: the department identifies CII under its rules, notifies the operator and informs public security (Article 10).
4. Changes: an operator must report significant changes that may affect identification; the department completes re-identification within 3 months of the report (Article 11).

The sector identification rules are generally not published, so the practical test for an operator is whether it has received a notice. Suppliers usually learn their customer is CII through procurement terms, which is why the supplier section below matters.

Operator obligations under the CII Regulations

Incident reporting deadlines now come from the CAC's National Cybersecurity Incident Reporting Measures, in force since 1 November 2025: CII operators report within 1 hour. See the China Cybersecurity Incident Reporting Measures Guide.

GB/T 39204-2022 in practice

The national standard turns the Regulations into testable requirements. It rests on three principles: holistic protection centred on critical business, dynamic protection guided by risk management, and coordinated joint defence based on information sharing. Its 111 requirements are grouped into six activity areas: analysis and identification, security protection, detection and evaluation, monitoring and early warning, active defence, and incident handling. It is a recommended (GB/T) standard, but CII assessments are commonly run against it, so operators should map their control set to it.

Cybersecurity review: triggers and procedure

The Cybersecurity Review Office sits in the CAC and runs the review mechanism on behalf of 13 departments, including the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the People's Bank of China, the China Securities Regulatory Commission and the State Cryptography Administration (Article 4).

What triggers a review

Article 21 lists the products and services in scope: core network equipment, important communications products, high-performance computers and servers, mass storage equipment, large databases and application software, network security equipment, cloud computing services, and other products and services with an important effect on CII, network and data security.

Risk factors the Office weighs (Article 10)

• Control or sabotage: risk that CII is illegally controlled, interfered with or damaged after the product is used.
• Supply interruption: harm to CII business continuity from interrupted supply.
• Supply chain reliability: the security and reliability of the supply chain, including the risk of supply being cut off because of political, diplomatic or trade factors.
• Legal compliance of the supplier: whether the provider complies with Chinese laws, administrative regulations and departmental rules.
• Data: risk that core data, important data or large amounts of personal information are stolen, leaked, damaged, illegally used or illegally sent abroad.
• Listings: risk that CII, core data, important data or large amounts of personal information are influenced, controlled or maliciously used by foreign governments after a listing.

Timeline

Time spent supplying extra materials does not count towards these deadlines (Article 15). Plan procurement and listing calendars around the worst case: a review that enters the special procedure can run well beyond six months of elapsed time. Reviewers must protect trade secrets and unpublished materials (Article 17), and the party must make sure the supplier honours commitments made during review, which the Office monitors before, during and after (Article 19).

What suppliers need to do

Most foreign security, cloud and network vendors are not CII operators, yet the regime reaches them through their customers. Article 6 makes the operator write supplier cooperation into contracts, and Article 20 of the CII Regulations requires security and confidentiality agreements.

• Expect review clauses: commitments not to use the provision of the product to obtain user data illegally, not to illegally control or manipulate user equipment, and not to interrupt supply or necessary technical support without proper cause.
• Prepare a review pack: architecture, data flows, remote access and update paths, where support staff sit, cryptography in use, and the supply chain for key components. These feed the operator's national security impact analysis.
• Control remote access by design: vendor support accounts, telemetry and update channels into CII are exactly what the control and data leakage risk factors look at.
• Plan for continuity questions: the supply interruption factor includes political and trade risk, so be ready to evidence local spares, escrow or support arrangements.
• Know the precedent: on 21 May 2023 the CAC announced that Micron's products sold in China had not passed cybersecurity review because of serious network security risks to the CII supply chain, and that CII operators should stop buying them. A conclusion against one supplier applies across every CII customer at once.

For the wider supplier risk programme, see the Third-Party Risk Management Guide.

Enforcement and penalties

From 1 January 2026 the amended Cybersecurity Law adds consequence-tiered fines up to RMB 10 million for especially serious outcomes such as a CII losing its main functions; see the China Cybersecurity Law Guide. The best-known review case is Didi: after a cybersecurity review linked to its US listing, the CAC announced on 21 July 2022 (as reported by China Daily) a fine of RMB 8.026 billion for 16 violations of the Cybersecurity Law, Data Security Law and PIPL, saying some findings involved national security and would not be published.

Where identity fits

Several review risk factors are, in practice, questions about privileged and machine access. Reviewers ask whether a supplier could control CII or extract data, and the answer usually depends on vendor support accounts, update signing keys, telemetry agents and API tokens.

• Vendor accounts: no standing vendor access into CII; time-bound, approved and recorded sessions. Apply your privileged access standard to every supplier session.
• Machine identities: one identity per integration and agent, with logs attributable to it, so a 1-hour incident report can say which credential acted.
• Cross-border paths: service accounts used by global SaaS, monitoring and AI tools can move important data abroad, which the data risk factor and localisation rules both catch.

See the Service Account Security Guide.

Compliance steps

1. Confirm status: record for each China entity whether a protection department has notified CII status, and for each product line whether customers are CII.
2. Stand up the governance: name the main person in charge, create the dedicated security management body, complete background checks for its head and key staff.
3. Map to GB/T 39204-2022 and MLPS: run a gap assessment against the six activity areas and the MLPS level of each system.
4. Build the procurement gate: add a national security risk prediction step for every network product and service in the Article 21 list; record the decision to apply or not and why.
5. Update contracts: add Article 6 commitments and Article 20 security and confidentiality terms to supplier templates; for suppliers, pre-agree acceptable wording.
6. Schedule the annual assessment: book testing and risk assessment at least once a year and track remediation.
7. Rehearse reporting: test a 1-hour report to the protection department and public security with a China-based decision maker.
8. Review transactions and listings: add the Article 21 change notice and the Article 7 listing review to M&A and capital markets checklists.

Decision guidance

• Notified CII operator: run the full programme, assume most core network, cloud and security purchases need a documented risk prediction, and apply where the answer is unclear.
• Supplier to CII: invest in a review pack and local support model before bidding; a late review can stall a sale for months.
• Network platform with large user base: treat any foreign listing plan as a review trigger above 1 million users and build the timeline in from the start.
• Small foreign subsidiary, no notice: follow MLPS and incident reporting; watch for CII terms in customer contracts.

Measurement and framework mapping

• Procurement coverage: share of in-scope purchases with a recorded national security risk prediction.
• Contract coverage: share of active CII suppliers with signed security and confidentiality agreements including Article 6 commitments.
• Assessment timeliness: days since the last annual assessment, and overdue remediation items.
• Reporting speed: share of reportable incidents reported within 1 hour.
• Vendor access: number of standing vendor accounts into CII (target zero).

Common failure patterns

• Treating review as the supplier's problem: the duty to predict risk and apply sits with the CII operator, and so does the fine of up to 10 times the purchase amount.
• No record of the risk prediction: deciding informally that a purchase does not need review leaves nothing to show an inspector.
• Calendar blindness: procurement or listing plans that ignore the 10, 30, 15 and 90 working day stages and supplementary material time.
• Standing vendor access: permanent remote support accounts undermine the very commitments Article 6 requires.
• Forgetting the change notice: mergers and carve-outs that move CII without telling the protection department.
• Relying on old article numbers: internal policy citing 2016 Cybersecurity Law numbering after the 2026 renumbering.

Practitioner checklist

• Record CII notification status for each China entity and customer segment.
• Appoint the main person in charge and the dedicated security body; complete background checks.
• Map controls to GB/T 39204-2022 and MLPS.
• Add a documented national security risk prediction to procurement for Article 21 product types.
• Update supplier templates with Article 6 and Article 20 terms.
• Run and document security testing and risk assessment at least once a year.
• Rehearse 1-hour incident reporting with a local decision maker.
• Remove standing vendor and integration access into CII.
• Add change notices and listing review to M&A and IPO checklists.

Standards and references

• State Council of the PRC: Critical Information Infrastructure Security Protection Regulations
• Cyberspace Administration of China: Cybersecurity Review Measures
• Cyberspace Administration of China: Decision on Amending the Cybersecurity Law
• Cyberspace Administration of China: Measures for the Administration of National Cybersecurity Incident Reporting
• Secrss: Interpretation of GB/T 39204-2022 Critical Information Infrastructure Security Protection Requirements
• China Daily: Micron products fail cybersecurity review
• China Daily: CAC penalty decision on Didi Global
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: China Cybersecurity Law Guide · China MLPS 2.0 Guide · China Data Security Law and Network Data Security Regulations Guide · China Cross-Border Data Transfers. This guide summarises China's CII Security Protection Regulations and Cybersecurity Review Measures and is not legal advice. Source note: Chinese texts were read through translation; the Chinese versions are authoritative. Confirm against the official text before relying on it.