Systems in China that must be protected with cryptography are judged not only on whether data is encrypted, but on whether the algorithms, products, keys and assessment reports meet a separate Chinese regime. That regime rests on the Cryptography Law, in force since 1 January 2020, the revised Commercial Cryptography Administration Regulations, in force since 1 July 2023, the assessment measures of November 2023, and rules for critical information infrastructure (CII) in force since 1 August 2025. This guide explains the legal layers, who has to run a commercial cryptography application security assessment, how often, what the ShangMi (SM) algorithms are, and how certificates and keys used by workloads fit in. It is written for security architects, PKI and platform teams, and compliance leads at organisations running systems in mainland China, including foreign-invested enterprises. The classified protection scheme itself is covered in the China MLPS 2.0 Guide; this page goes deeper on the cryptography layer only.
Source note, checked 9 November 2026: the laws, regulations and orders below were read on NPC, State Council and cryptography administration sites. The GB/T 39786-2021 details rely on secondary sources, secrss.com and the Chinese Standard catalogue entry, because the standard text was not accessed. Confirm against the official text before relying on it.
Key takeaways
- Three categories, one that matters to business. Article 6 of the Cryptography Law splits cryptography into core, common and commercial; companies use commercial cryptography for information that is not a state secret (Article 8).
- CII must pass an assessment before going live. Article 38 of the 2023 Regulations requires CII to pass a commercial cryptography application security assessment before operation and to be assessed at least once a year after that.
- Reports are filed within 30 days. The 2023 assessment measures require operators to file assessment reports with the State Cryptography Administration or the provincial cryptography authority within 30 days of completion.
- CII operators report every January. Order No. 5 of 2025 requires CII operators to report the previous year's cryptography use and assessment status by 31 January each year.
- Machine identities are in scope. Certificates, keys and service credentials that authenticate systems are exactly what the assessment examines, so key management for non-human identities is a compliance item, not only a hygiene one.
The legal layers
| Instrument | Issuer | In force | What it adds |
|---|---|---|---|
| Cryptography Law | NPC Standing Committee, adopted 26 October 2019 | 1 January 2020 | Core, common and commercial categories; equal treatment of foreign-invested enterprises; product testing; CII duties; import and export controls; penalties |
| Commercial Cryptography Administration Regulations (State Council Order No. 760, 67 articles) | State Council, promulgated 27 April 2023 | 1 July 2023 | Detailed product certification, electronic authentication services, CII assessment before operation and annually, duties under classified protection |
| Measures for the Administration of Commercial Cryptography Application Security Assessment (Order No. 3) | State Cryptography Administration, issued 26 September 2023 | 1 November 2023 | Assessment at planning, before operation and annually; self-assessment conditions; 30-day filing; six-year record keeping |
| Administrative Provisions on the Use of Commercial Cryptography in Critical Information Infrastructure (Order No. 5, 25 articles) | State Cryptography Administration, Cyberspace Administration of China, Ministry of Public Security, issued 11 June 2025 | 1 August 2025 | Annual reporting by 31 January, named key manager and auditor roles, budget, protection of core and important data and personal information |
| GB/T 39786-2021, Information security technology: Baseline for information system cryptography application | National standard | 1 October 2021 (as reported by secrss.com and the Chinese Standard catalogue entry; issued 9 March 2021) | The technical and management requirements an assessment tests against, aligned with classified protection levels |
The Cryptography Law treats core and common cryptography, which protect state secrets, as state secrets in their own right (Article 7). Most commercial and foreign organisations deal only with commercial cryptography, defined in Article 2 of the 2023 Regulations as technologies, products and services that encrypt or authenticate information that is not a state secret.
Who has to use and assess commercial cryptography
Duties depend on what the system is, not on who owns it. Three groups matter.
| Group | Legal basis | Duty |
|---|---|---|
| CII operators | Cryptography Law Art. 27; Regulations Art. 38 and 39; Order No. 5 | Use commercial cryptography where required, plan, build and run it alongside the system, assess before operation and at least annually, use certified products and reviewed algorithms, report annually |
| Important networks and information systems | Assessment Measures Art. 6 to 9 | Systems that laws or national rules require to be protected with commercial cryptography: plan assessment, pre-operation assessment, annual assessment, file reports |
| Network operators under classified protection | Regulations Art. 41 | Use commercial cryptography to protect the network according to the requirements of the classified protection system for its level |
The Regulations themselves do not say "Level 3 and above". In practice, MLPS Level 3 systems are usually assessed against Level 3 of GB/T 39786, according to secrss.com's analysis of the standard. Confirm with your filing authority and testing body which assessment applies to each graded system.
The assessment cycle
- Plan: prepare a cryptography application plan and have it assessed. Article 7 of the Assessment Measures and Article 11 of Order No. 5 say a plan that fails cannot be used as the basis for construction.
- Build: implement against the assessed plan. Any change to the plan needs re-assessment (Order No. 5 Art. 12).
- Pre-operation assessment: assess before go-live. A system that fails must be remediated and must not run while it is being remediated (Assessment Measures Art. 8; Order No. 5 Art. 12).
- File: send the report to the State Cryptography Administration or the provincial authority within 30 days of completion (Assessment Measures Art. 14).
- Annual assessment: at least once a year after go-live, by the operator or an accredited testing institution (Regulations Art. 38; Assessment Measures Art. 9; Order No. 5 Art. 13).
- Coordinate: align the cryptography assessment with CII security testing and MLPS testing to avoid duplication (Order No. 5 Art. 15; Cryptography Law Art. 27).
Self-assessment is allowed where the operator meets the conditions in Article 13 of the Assessment Measures, including suitable facilities, rules, staff and expertise. Self-assessment reports must be signed by the responsible officer and sealed, and records kept for at least six years. Major cryptography security incidents must be reported immediately (Art. 15).
SM algorithms and what the assessment looks at
Commercial cryptography in China is built on the ShangMi (SM) family published as national standards. Products used in CII must pass testing and certification, and their algorithms and protocols must pass state review (Regulations Art. 39; Order No. 5 Art. 9). In our reading that points to SM algorithms for most in-scope systems, and a plan that relies only on internationally standardised algorithms should be checked with the testing body before it is assessed.
| Algorithm | Purpose | Chinese standard | International reference |
|---|---|---|---|
| SM2 | Elliptic curve public key: signatures and key exchange | GB/T 32918 series | ISO/IEC 14888-3:2018 (signatures) |
| SM3 | Hash function | GB/T 32905-2016 | ISO/IEC 10118-3:2018 |
| SM4 | Block cipher | GB/T 32907-2016 | ISO/IEC 18033-3 |
| TLS 1.3 suites | TLS_SM4_GCM_SM3 (0x00,0xC6) and TLS_SM4_CCM_SM3 (0x00,0xC7), signature scheme sm2sig_sm3, group curveSM2 | GM/T 0009-2012 for certificate identifiers | RFC 8998 (Informational, March 2021) |
GB/T 39786-2021 organises technical requirements into four layers: physical and environmental, network and communication, device and computing, and application and data, plus management requirements such as procedures, personnel, construction and operation, and emergency response (secrss.com and the Chinese Standard catalogue entry). Identity authentication of entities, administrators and users runs through every layer, and secrss.com reports that failing identity authentication requirements is treated as a high-risk finding. Read the standard itself for the indicator list at your level.
What it means for non-human identities and AI agents
Most of what an assessor inspects in a modern system is machine-to-machine: TLS between services, mutual authentication of APIs, code signing, database encryption keys and the credentials used by administrators' tools.
- Certificates: service and device certificates on Level 3 systems should use SM2 with certified certificate authorities where the plan requires it. Keep an inventory of every certificate, its algorithm and its issuer. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Keys: key generation, storage, distribution, rotation and destruction are part of the assessment; Article 10 of the Assessment Measures lists key management security as a plan assessment item. Order No. 5 Article 7 requires CII operators to name a key manager. See the Cryptographic Key Management Guide.
- Workload and agent credentials: service accounts, API keys and tokens used by integrations and AI agents authenticate entities, so document how each is protected and which algorithm signs or encrypts it.
- Data protection: Order No. 5 Article 10 requires CII operators to use cryptography to protect core data, important data and personal information in storage, use and transmission. See the China Data Security Law and Network Data Security Regulations Guide.
Products, imports and foreign-invested enterprises
- Certified products: commercial cryptography products in the catalogue of key network equipment and specialised security products must be tested and certified before sale or provision (Cryptography Law Art. 26; Regulations Art. 20). Check HSMs, VPN gateways and signing appliances against the catalogue.
- Security review: CII purchases of cryptography products or services that may affect national security are subject to national security review under the Cybersecurity Law (Cryptography Law Art. 27). See the China Cybersecurity Law Guide.
- Imports and exports: import licensing applies to commercial cryptography with encryption functions that concern national security or public interests, and export controls to items concerning security, public interests or international obligations; mass consumption products are exempt (Cryptography Law Art. 28; Regulations Art. 31 to 34).
- Foreign-invested enterprises: Article 21 requires equal treatment of all commercial cryptography entities, including foreign-invested enterprises, and bars administrative bodies from forcing transfer of cryptography technology.
Enforcement and penalties
| Breach | Source | Penalty (operator) | Penalty (responsible person) |
|---|---|---|---|
| CII operator fails to use or assess commercial cryptography as required | Cryptography Law Art. 37; Regulations Art. 60; Order No. 5 Art. 19 | Correction and warning; RMB 100,000 to 1,000,000 if not corrected or serious | RMB 10,000 to 100,000 |
| CII uses products or services that did not pass security review | Cryptography Law Art. 37; Order No. 5 Art. 20 | Stop use; 1 to 10 times the purchase amount | RMB 10,000 to 100,000 |
| Network operator does not meet classified protection cryptography requirements | Regulations Art. 62 | Warning; RMB 10,000 to 100,000 if not corrected or harm results | RMB 5,000 to 50,000 |
| Obstructing supervision of CII cryptography | Order No. 5 Art. 21 | Correction and warning; RMB 50,000 to 500,000 in serious cases | See the provision |
Compliance steps
- Classify systems: list every China system, its MLPS level, and whether it is CII or another system that rules require to use commercial cryptography.
- Inventory cryptography: certificates, keys, algorithms, protocols, HSMs and libraries per system, including machine and agent credentials. See the Cryptographic Inventory and CBOM Guide.
- Write the application plan: per GB/T 39786 layers, stating algorithms, products and key management. Have it assessed before building.
- Select certified products: check catalogue status and certification for each cryptographic product and service.
- Engage the assessor: an accredited testing institution, or prepare to self-assess under Article 13, and coordinate dates with the MLPS test.
- File and track: file within 30 days, track findings to closure, and for CII submit the annual report by 31 January.
- Design for agility: keep algorithm choices configurable so SM and international suites can run per region. See the Crypto-Agility Guide.
Framework mapping
| China requirement | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Use of approved commercial cryptography | SC-13 Cryptographic Protection | PR.DS-01, PR.DS-02 |
| Key management in the plan and assessment | SC-12 Cryptographic Key Establishment and Management | PR.DS-01 |
| Identity authentication across layers | IA-3 Device Identification and Authentication, IA-5 Authenticator Management | PR.AA |
| Certified products and security review | SR-3 Supply Chain Controls and Processes | GV.SC |
The mapping is NHI Mgmt Group's own; Chinese assessors test against GB/T 39786, not NIST.
Measuring progress
- Share of China systems with an assessed cryptography application plan.
- Share of in-scope systems with a pass in the last twelve months and a report filed within 30 days.
- Certificates and keys on in-scope systems with a known algorithm, owner and expiry.
- Open high-risk assessment findings and their age.
- Cryptographic products on in-scope systems with confirmed certification.
Common failure patterns
- Treating MLPS as the whole job: passing the MLPS test while the cryptography assessment has not been run, or has been run on a different scope.
- Going live first: launching a CII system before the pre-operation assessment, which the Regulations do not allow.
- Machine credentials left out: scoping the assessment to user logins and missing service certificates, API keys and administrator tool credentials.
- Global PKI copied in: reusing a global certificate authority and RSA or ECDSA chains without checking what the assessed plan requires.
- No key manager: CII operators that have not named the key manager, operator and auditor roles Order No. 5 expects.
Practitioner checklist
- Map every China system to its MLPS level and CII status.
- Inventory certificates, keys, algorithms and cryptographic products per system, human and machine.
- Assess the cryptography application plan before construction starts.
- Do not put CII into operation until it passes the pre-operation assessment.
- Assess at least once a year and file reports within 30 days.
- Name a key manager, cryptography operator and security auditor for CII.
- Use certified cryptographic products and check catalogue status before purchase.
- Submit the CII annual cryptography report by 31 January.
- Keep assessment records for at least six years.
Standards and references
- National People's Congress: Cryptography Law of the People's Republic of China (English)
- State Council: Commercial Cryptography Administration Regulations (Order No. 760, Chinese)
- State Cryptography Administration: Measures for the Administration of Commercial Cryptography Application Security Assessment (Order No. 3, Chinese)
- State Council Gazette: Administrative Provisions on the Use of Commercial Cryptography in Critical Information Infrastructure (Order No. 5, Chinese)
- IETF: RFC 8998 ShangMi (SM) Cipher Suites for TLS 1.3
- secrss.com: analysis of GB/T 39786-2021 (Chinese)
- Chinese Standard: GB/T 39786-2021 catalogue entry (secondary)
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
Related NHI Mgmt Group resources: China MLPS 2.0 Guide · China Cybersecurity Law Guide · Crypto-Agility Guide · HSM Deployment and Operations Guide. This guide summarises China's Cryptography Law and commercial cryptography rules as at 9 November 2026 and is not legal advice.