[vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern” padding_top=”50″ css_animation=””][vc_column][vc_column_text]<\/p>\n
[\/vc_column_text][\/vc_column][\/vc_row][vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”center” background_image_as_pattern=”without_pattern” padding_top=”50″ padding_bottom=”50″ css_animation=””][vc_column css=”.vc_custom_1517373139965{background-image: url(http:\/\/asiallians.com\/wp-content\/uploads\/2018\/01\/Picture1.png?id=18554) !important;}”][vc_empty_space][vc_column_text]Newly Released PRC Measures for Cyber Security Review<\/span><\/strong>1<\/a><\/sup>[\/vc_column_text][vc_empty_space height=”70px”][\/vc_column][\/vc_row][vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern” css_animation=””][vc_column][vc_column_text]On April 27, 2020, the Cyberspace Administration of China (\u201cCAC\u201d) and other 11 departments2<\/a><\/sup>\u00a0jointly released the Measures for Cyber Security Review (the \u201cMeasures\u201d) which will be implemented since June 1, 2020. The core idea of the Measures is to require Critical Information Infrastructure Operators (\u201cCIIO\u201d) procuring network products and services that affect or may affect national security or network security launch the cyber security review process. Further, the Measures emphasize the legislative intent is to protect national security and the safety of CII supply chain without restricting or discriminating against foreign products and services. Finally, the Measures design a review procedure along with protecting intellectual property of enterprises. We hereby summarized the most eye-catching contents for your kind reference.<\/p>\n I. Implementing proactively reporting system\u2014take CIIO as the initiator to launch the review process<\/strong><\/p>\n The Measures impose an obligating upon CIIO3<\/a><\/sup>\u00a0to report Cyber Security Review Office4<\/a><\/sup>\u00a0where the CIIO procures network products and services5<\/a><\/sup>\u00a0and predicts such products and services may bring national security risks.<\/p>\n To conduct risk assessment, CIIO may consider the following aspects:<\/p>\n \u2022 Relevant industrial standards<\/strong><\/em>: relevant industrial standards can be made by critical information infrastructure protection department to serve as an important guidance for CIIO to predict the risks. Companies may conduct risk assessment by referring these guidance.<\/p>\n \u2022 Factors balanced by Cybersecurity Review Office during the preliminary review:<\/em><\/strong><\/p>\n 1. the risks of illegal control, interference or damage to the Critical Information Infrastructure caused by the use of products and services, and the theft, leakage and damage to the important data; To fulfill reporting obligation, the CIIO shall submit the following materials:<\/p>\n \u2022 Declaration; In addition, the Measures impose an obligation upon CIIO to require the network product and service provider to cooperate with the network security review through signing procurement documents, agreements. To be specific, the provider shall commit not to illegally obtain user data by using the convenience of providing products and services, not to illegally control and manipulate user equipment, and not to interrupt the product supply or necessary technical support services without justifiable reasons.<\/p>\n II. The review process and timeframe<\/strong>[\/vc_column_text][vc_empty_space][vc_single_image image=”34456″ img_size=”full” onclick=”custom_link” qode_css_animation=”” link=”#_ftn9″][vc_empty_space][vc_column_text]III. IP protections during the cybersecurity review<\/strong><\/p>\n The Measures emphasize the business secrets and intellectual property rights protection by imposing confidential obligation upon departments and personnel participating in the network cybersecurity review:<\/p>\n \u2022 They shall strictly protect the unpublished materials submitted by CIIO, products and services providers, as well as other unpublished information learned in the review work. If the CIIO or the network product and service provider consider that the relevant departments or personnel fail to perform the confidentiality obligation, they may report to the Cybersecurity Review Office or other relevant departments.<\/p>\n IV. Administrative liabilities for failing to comply with the Measures<\/strong><\/p>\n In the scenario of CIIO using network products and services without undergoing or has failed to pass cybersecurity review, it might face dual-liability penalty:[\/vc_column_text][vc_empty_space][vc_single_image image=”34457″ img_size=”full” onclick=”custom_link” qode_css_animation=”” link=”#_ftn9″][vc_empty_space][\/vc_column][\/vc_row][vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern” padding_bottom=”100″ css_animation=””][vc_column][vc_column_text]We will keep following up the implementation of the Measures and other details. Should you have any inquiries, please contact\u00a0asiallians@asiallians.com<\/a>. As always, Asiallians remains at your services and our teams are currently mobilized in all our offices in China, but also in Hong Kong, Taipei.<\/p>\n <\/p>\n 1.<\/a>\u00a0See:\u00a0http:\/\/www.cac.gov.cn\/2020-04\/27\/c_1589535450769077.htm<\/a>\u00a0(last visited on May 7, 2020).<\/p>\n 2.<\/a>\u00a0The 11 departments include: 1) National Development and Reform Commission, 2) Ministry of Industry and Information Technology, 3) Ministry of Public Security, 4) Ministry of National Security, 5) Ministry of Finance, 6) Ministry of Commerce, 7) People’s Bank of China, 8) State Administration of market supervision, 9) State Administration of Radio and Television, 10) State Security Administration, 11) State Password Administration<\/p>\n 3.<\/a>\u00a0CIIO is generally defined as enterprise-operators that run critical information infrastructure. According to the CAC spokesperson\u2019s remarks on Measures, operators of important networks and information systems in the fields of telecommunications, radio and television, energy, finance, road and waterway transportation, railway, civil aviation, post, water conservancy, emergency management, health and health, social security, national defense science and technology industry shall comply with obligations under Measures when they are purchasing network products and services.\u00a0http:\/\/www.cac.gov.cn\/2020-04\/27\/c_1589535446378477.htm<\/a>\u00a0(last visited on May 7, 2020).<\/p>\n 4.<\/a>\u00a0Cyber Security Review Office is set up in CAC.<\/p>\n 5.<\/a>\u00a0Network products and services mainly refer to core network equipment, high-performance computers and servers, large capacity storage equipment, large database and application software, network security equipment, cloud computing services, and other network products and services that have an important impact on the security of key information infrastructure.<\/p>\n
\n2. the damage to business continuity of Critical Information Infrastructure caused by the disruption of the supply of products and services;
\n3. the security, openness, transparency, source diversity of products and services, the reliability of supply channels and the risks of supply disruption due to political, diplomatic and trade factors, etc.;
\n4. product and service providers\u2019 compliance with Chinese laws, administrative regulations and department regulations;
\n5. other factors that may jeopardize the security of Critical Information Infrastructure and national security,<\/p>\n
\n\u2022 Analysis report on the impact or possible impact on national security;
\n\u2022 Purchase documents, agreements, contracts to be signed;
\n\u2022 Other materials required for network security review.<\/p>\n
\n\u2022 They shall not disclose these unpublished materials to the unrelated parties or use for purposes other than the cybersecurity review.<\/p>\n