On 27 April 2020, Measures for the Examination of Network Security (hereinafter “Measures”), were jointly released by the Cyberspace Administration of China, the National Development and Reform Commission and other related ministries and commissions, which will come into effect on 1 June 2020.
According to the Cyberspace Administration of China, a cybersecurity review shall be carried out based on the National Security Law and the Cybersecurity Act, the purpose of which is to:
a) detect and avoid risks and hazards to the operation of critical information infrastructure while procuring products and services;
b) secure critical information of the infrastructure supply chain; and
c) maintain national security.
The Measures make it clear that the cyber security review shall focus on assessing possible risks to national security caused by the procurement of IT products and services, mainly considering the following factors:
（1） Risks of illegal control, interference or destruction of key information infrastructure caused by the use of products and services, as well as theft, leakage and damage of important data;
（2） The harm to business continuity of key information infrastructure due to product and service interruptions;
（3） Security, openness, transparency, source diversity of products and services, reliability of supply channels and risks of supply interruptions caused by political, diplomatic and trade factors;
（4） Compliance of product and service providers with China’s laws, administrative regulations and departmental rules;
（5） Other factors that may endanger the security of critical information infrastructure and national security.
As a consequence, if operators of critical infrastructure purchase IT products and services that affect or may affect national security, they shall conduct a cybersecurity review in accordance with the Measures. Related industries that are also covered by the new Measures include telecommunications, radio and television, energy, finance, road and water transport, railways, civil aviation, postal services, water conservancy, emergency management, health, social security, national defense science and technology industry and other industries.
Related link:
Measures for the Examination of Network Security
