This article explores China’s MIIT’s data security plan, providing insights into the four-tier system and its implications for organizations. The comprehensive approach aims to strengthen responses, minimize losses, and safeguard national security, contributing to the global dialogue on cybersecurity.
In a significant move towards bolstering data security, China’s Ministry of Industry and Information Technology (MIIT) recently revealed an initiative outlined in a 25-page document. The China’s MIIT data security comprehensive plan introduces a color-coded system designed to enhance the nation’s response to data security incidents. The primary objectives include fortifying the capability to respond promptly and effectively to incidents, controlling and mitigating hazards, and minimizing losses resulting from data security breaches. The initiative also aims to safeguard the rights of individuals and organizations, ensuring national security and public interests remain protected.
Data Security Incident Levels
The color-coded system categorizes data security incidents into four distinct levels based on their scope and the degree of harm inflicted:
Red: Level I (“especially significant”)
This level encompasses incidents leading to widespread shutdowns, substantial loss of business processing capability, interruptions lasting more than 24 hours, major radio interference persisting for over 24 hours, economic losses exceeding 1 billion yuan, or compromising the personal information of over 100 million people or sensitive personal information of more than 10 million people.
Orange: Level II (“significant”)
Level II includes shutdowns and operational interruptions lasting more than 12 hours, major radio interference for over 12 hours, economic losses ranging from 100 million yuan to 1 billion yuan, or affecting the personal information of over 10 million people or sensitive personal information of more than 1 million people.
Yellow: Level III (“large”)
This level pertains to operational interruptions lasting more than eight hours, major radio interference exceeding eight hours, economic losses ranging from 50 million yuan to 100 million yuan, or impacting the personal information of over 1 million people or sensitive personal information of more than 100,000 people.
Blue: Level IV (“general”)
Level IV applies to minor events causing operational interruptions lasting less than eight hours, economic losses below 50 million yuan, or affecting the personal information of less than 1 million people or sensitive personal information of less than 100,000 people.
China’s MIIT Data Security Plan Additional Keypoints
Additionally, the rules mandate affected companies to assess the severity of the incident and report it immediately to the local industry supervision department if deemed serious. Transparency is emphasized, prohibiting the omission, concealment of facts, or provision of false information. If a data security incident is classified as particularly major or major, the local industry regulatory department must report it to the Mechanism Office within the specified timeframe of ’10 minutes by phone and 30 minutes in writing.’
Depending on the activated response level (Red or Orange), the Mechanism Office is obligated to report the incident to the MIIT. The draft rules are open for public comments until January 15, 2024, reflecting a commitment to transparency and inclusivity in shaping the nation’s data security landscape.
Conclusion
This initiative aligns with the global efforts to address the escalating challenges of data breaches and cyber threats. As organizations worldwide grapple with the evolving nature of cybersecurity, China’s MIIT’s color-coded action plan emerges as a proactive and strategic approach to fortify defenses and respond effectively to the dynamic landscape of data security incidents.
As we navigate the digital age, the importance of robust data security measures cannot be overstated. By implementing innovative strategies such as the color-coded action plan, nations can foster a resilient cybersecurity framework that not only protects critical information but also upholds the rights of individuals and organizations.
Yes. Governments want their data not leaking everywhere, and desperately want information on whatever has been already compromised. Be it for taking action against the responsible citizens or managing some kind of damage control. But did you know you also have personal data in desperate need of protecting? And if you have a business you also have a series of responsabilities regarding your costumers’ and personel’s data.
You can learn everything about how to stay protected on our quick guide here. Also, do consider getting a VPN (quick guide here) to protect your connection worldwide and get other useful perks regarding geolocation tags and website access.
