China Issues New Cybersecurity Incident Reporting Measures Effective November 2025
On September 11, 2025, the Cyberspace Administration of China (CAC) issued the Measures for the Administration of Reporting National Cybersecurity Incidents.
The regulation will take effect on November 1, 2025, and establishes strict rules for how companies in China must identify, classify, and report cybersecurity incidents.
These Measures build on China’s Cybersecurity Law, Data Security Law, and Personal Information Protection Law, as well as the Regulations on the Protection of Critical Information Infrastructure (CII). They provide a unified reporting framework across industries, with clear timelines, responsibilities, and penalties.
Who Is Covered?
The Measures apply to all network operators in China, defined broadly as:
- Owners of networks
- Network managers
- Network service providers
This definition is deliberately wide. It covers Chinese companies as well as foreign-invested enterprises that build, operate, or provide services through networks in China.
In practice, whether you are a domestic business (for example, a Chinese bank, telecom provider, or e-commerce platform) or a foreign company running IT systems, apps, or online services inside China, you are subject to these rules.
What Counts as a Cybersecurity Incident?
A cybersecurity incident refers to events caused by:
- Human factors or malicious attacks
- Vulnerabilities in systems or networks
- Hardware or software defects and failures
- Force majeure (e.g. natural disasters)
Such incidents must be reported if they harm networks, information systems, data, or business operations, and create negative effects on national security, the economy, or social stability.
Classification of Incidents
Incidents are classified into four levels based on severity, following the national standard GB/T 20986-2023:
- Especially Major – System-wide paralysis, leaks of over 100 million personal records, direct economic losses above 100 million RMB, or national-level harm.
- Major – Severe disruptions, leaks of over 10 million records, losses above 20 million RMB, or regional-level harm.
- Relatively Large – Noticeable disruptions, leaks of over 1 million records, losses above 5 million RMB, or city-level harm.
- General – Incidents with lesser but still reportable impact.
Reporting Requirements
Reporting obligations vary depending on the type of operator and incident severity:
- Critical Information Infrastructure (CII) operators
- Report immediately to their protection authority and public security, no later than 1 hour.
- For major or especially major incidents, authorities must escalate to the national CAC and Ministry of Public Security within 30 minutes.
- Central government agencies and affiliated units
- Report internally within 2 hours.
- Escalate major or especially major incidents to the CAC within 1 hour.
- Other companies / network operators
- Report to provincial-level CAC offices within 4 hours.
- For major or especially major incidents, provincial CAC must escalate to the national CAC within 1 hour.
- Industry-specific rules
- Sectors such as finance, telecom, and healthcare may have additional reporting obligations.
- Suspected crimes
- If illegal activity is involved, operators must also file a police report.
What Must Be Reported
An initial incident report should include:
- Company and affected system details.
- Time, location, type, classification, impact, measures taken, and their results.
- For ransomware: ransom amount, payment method, and deadline.
- Development trends and potential further risks.
- Preliminary cause analysis.
- Tracing clues: attacker info, attack path, vulnerabilities.
- Planned countermeasures and requests for support.
- Preservation of the incident scene.
- Other relevant details.
If some details are unclear, companies may first report items (1) and (2), and submit the rest later.
Post-Incident Obligations
After an incident is resolved, the affected company (the network operator whose system was compromised) must, within 30 days, prepare and submit a comprehensive summary report through the same channel used for the original report.
- Causes and lessons learned
- Emergency measures taken
- Damage and liability assessment
- Corrective actions and improvements
Penalties for Non-Compliance
- Failure to report an incident can result in penalties under relevant laws and administrative regulations.
- Late, false, omitted, or concealed reporting leading to serious harm will bring heavier penalties on both the company and responsible individuals.
- Government departments that fail to report face accountability under the cybersecurity responsibility system.
- Leniency is possible if an operator:
- Took reasonable protective measures
- Acted under an emergency plan
- Minimized impact
- Reported in a timely manner
Key Takeaways for Businesses
- Act fast: Companies may have as little as 1–4 hours to report an incident.
- Know your classification: “Relatively large or above” incidents (较大及以上) trigger mandatory urgent reporting.
- Set contracts with vendors: Ensure IT and security providers must notify you of incidents.
- Prepare templates for initial and supplementary reports.
- Expect follow-up: A 30-day summary report is mandatory.
- Special cases: Incidents involving state secrets must be reported under separate rules.
The new Measures signal China’s push to centralize and tighten cybersecurity oversight. For companies operating in China, compliance means not only strengthening technical defenses but also building rapid reporting systems and internal coordination mechanisms.
