Information Security Multi-Level Protection Management Rules (Trial)

Ministry of Public Security, National Administration of State Secrets Protection, State Cryptography Administration, Staten Council Informatization Work Office

17 January 2006

(GTZ No. [2006]7)

Chapter I: General Provisions

Article 1: In order to strengthen information security multi-level protection, standardize information security multi-level protection management, raise information security protection capabilities and levels, safeguard national security, social stability and the public interest, ensure and stimulate informatization construction, on the basis of national relevant laws and regulations such as the “Computer and Information System Security Protection Regulations of the People’s Republic of China”, these Rules are formulated.

Article 2: Information security multi-level protection refers to implementing security protection in a tiered manner for national secrets information and proprietary information of citizens, legal persons and other organizations as well as the information systems storing, transmitting and processing this information, implementing tiered management of information security products used in information systems, and responding to and handling information security incidents occurring on information systems in a tiered manner. 

Article 3: Security protection tiers of information systems shall be determined on the basis of the degree of importance of the information and information system in national security, economic construction and social life, the degree of harm to national security, social order, the public interest as well as the lawful rights and interests of citizens, legal persons and other organizations if the information or information systems are destroyed, the basic security protection levels the information and information systems should reach, and other such factors.

Article 4: Security protection tiers for information systems are divided into the following five levels:

(1) The first tier is the self-protection tier, it applies to ordinary information system where, after they are destroyed, harm is created to the lawful rights and interests of citizens, legal persons and other organizations, but national security, social order and the public interest is not harmed.

(2) The second tier is the guided protection tier, it applies to ordinary information systems where, after they are destroyed, light harm is created to social order and the public interest, but national security is not harmed.

(3) The third tier is the supervised protection tier, it applies to important information systems involving national security, social order and the public interest where, after they are destroyed, harm is created to national security, social order and the public interest.

(4) The fourth tier is the mandatory protection tier, it applies to important information systems involving national security, social order and the public interest where, after they are destroyed, grave harm is created to national security, social order and the public interest.

(5) The fifth tier is the special control protection level, it applies to core sub-systems of important information systems involving national security, social order and the public interest where, after they are destroyed, especially grave harm is created to national security, social order and the public interest.

Article 5: Information system operating and using work units and individual conduct protection of information system according to these Rules and related technical standards, relevant State information security functional departments conduct supervision and management over information security multi-level protection work.

(1) First-tier information system operating and using work units or individuals may conduct protection on the basis of State management norms and technical standards.

(2) Second-tier information system operating and using work units or individuals shall conduct protection on the basis of State management norms and technical standards. When necessary, relevant State information security functional departments may conduct guidance over their information security multi-level protection work.

(3) Third-tier information system operating and using work units shall conduct protection on the basis of State management norms and technical standards, relevant State information security functional departments conduct supervision and inspection of their information security multi-level protection work.

(4) Fourth-tier information system operating and using work units shall conduct protection on the basis of State management norms and technical standards, relevant State information security functional departments conduct mandatory supervision and inspection of their information security multi-level protection work.

(5) Fifth-tier information system operating and using work units shall conduct protection on the basis of State management norms and technical standards, State-appointed specialized departments or specialized bodies conduct specialized supervision and inspection of their information security multi-level protection work.

Article 6: Public security bodies are responsible for the supervision, inspection and guidance of information security multi-level protection work. State secrecy protection work departments are responsible for the supervision, inspection and guidance of state secret-related work in information security multi-level protection work. State encryption management departments are responsible for the supervision, inspection and guidance of encryption-related work in information security multi-level protection work. 

Matters involving the scope of jurisdiction of other functional departments are managed by the relevant department according to the provisions of State laws and regulations.

The State Council Informatization Work Office and local informatization leading group office bodies are responsible for interdepartmental coordinating of multi-level protection work.

Chapter II: Information security multi-level protection work security management

Article 7: Information system operating and using work units shall, on the basis of these Rules and relevant standards, determine the security protection tier of information systems. Where they have a competent department, they shall report to the competent department for examination and approval.

Article 8: Information system operating and using work units shall conduct information system construction, on the basis of already determined security protection tiers, according to these Rules and relevant technical standards, and use information technology products that conform to relevant State regulations and satisfy information system security protection tier requirements.

Article 9: Information system operating and using work units shall implement the following security multi-level protection duties and responsibilities:

(1) Implementing responsible departments and personnel for information security multi-level protection, to be responsible for information system security multi-level protection management work;

(2) Establishing and completing security multi-level protection management structures;

(3) Implementing the requirements of security multi-level protection technical standards;

(4) Regularly conducting security state monitoring and risk assessment;

(5) Establishing information security incident tiered response and processing systems;

(6) Being responsible for security multi-level protection education and training of information system users;

(7) Other security multi-level protection duties and responsibilities they should fulfil.

Article 10: After information system constructions are complete, their operating and using work unit shall, on the basis of these Rules, select a monitoring work unit holding relevant State technical qualifications and security qualifications, to conduct security monitoring according to technical standards, and only when they conform to requirements, may they be put into use.

Article 11: Work units engaging in information security security tiered monitoring shall abide by the provisions of relevant State laws and regulations, and technical standards, protect State secrets, commercial secrets and personal privacy they learn during monitoring activities, and provide secure, objective and fair monitoring and assessment services.

Monitoring work unit qualification management rules will be formulated separately by relevant departments.

Article 12: Third-tier and higher information system operating and using work units shall, within 30 days from the day of starting the operation of a system, go to a receiving body appointed by the local provincial, autonomous region or municipal public security body to conduct filing procedures, and fill out an “Information System Security Protection Tier Filing Registration Form”. Except where the State has provided otherwise.

When a change occurs in the filed matter, the information system operating and using work unit or their competent department shall report the changed circumstances to the original filing body within 30 days after the day of change.

Article 13: Public security bodies shall grasp the filing situation of information system operating and using work units, establish file dossiers, and conduct filing management. Where someone is discovered not to follow these Regulations and other relevant standards, they shall notify them and order rectification.

Article 14: Public security bodies shall supervise and inspect the situation of security multi-level protection duties and responsibilities fulfilled by work units operating and using third-tier and fourth-tier information systems.

Information systems of a third-tier security protection level will be subject to at least one inspection per year, information system of a fourth-tier protection level shall be inspected at least once every half year.

Article 15: Where public security bodies discover an information system operating or using work unit has not fulfilled security multi-level protection duties and responsibilities, or has not met security protection requirements, they shall notify them in writing and have them rectify.

Chapter III: Secrecy protection management in information security multi-level protection

Article 16: Information systems involving state secrets shall conduct protection on the basis of the basic requirements of State information security multi-level protection, according to management regulations of the State secrecy protection work department on secret-related information systems’ tiered protection and technical standards, an in integration with the actual situation of the system. 

Information systems not involving State secrets may not process State secret information.

Article 17: Information systems involving State secrets will be divided into three levels from high to low, secret-level, top secret-level and absolute secret-level, according to the highest secrecy level of the information they process, their overall protection levels will respectively not be lower than the requirements for the third tier, fourth tier and fifth tier.

Work units constructing information systems involving State secrets shall determine the highest secrecy level of the information the system processes and the protection tier of the system according to the “Law for the Protection of State Secrets of the People’s Republic of China” and relevant State regulations concerning secrets and the concrete scope of their secrecy levels.

Article 18: The design and implementation, examination, approval and filing, operation and maintenance, and daily secrecy protection management of information systems involving State secrets will be implemented according to relevant State regulations on secrecy protection work and technical standards.

Article 19: All levels’ secrecy protection work departments shall organize inspection and assessment of information systems involving State secrets they put into use. Where they discover that security vulnerabilities exist on the system or technical protection measures to not conform to tiered protection management regulations and technical standards, they shall notify the system-using work unit and management department for rectification within a limited time.

Information systems of the secret or top secret-level will be subject to secrecy protection inspection or system assessment at least once per two years; absolute secret-level information systems will be subject to secrecy protection inspection or system assessment at least once per year.

Chapter IV: Information security multi-level protection encryption management

Article 20: The State encryption management department will conduct categorized and tiered management of information security multi-level protection encryption. On the basis of the role and degree of importance of the protected counterpart in national security, social stability and economic construction, the protected counterpart’s security protection requirements and degree of involvement with secrets, the degree of harm after the destruction of the protected counterpart as well as the nature of the encryption-using department, etc., encryption protection tiering norms will be determined.

Where an information system operating or using work units adopts encryption to conduct tiered protection, they shall abide by information security multi-level protection encryption management regulations and related standards.

Article 21: The provision, use and management of encryption in information security multi-level protection shall strictly implement relevant State regulations on encryption management.

Article 22: Encryption technology must be fully used to protect information systems. Where encryption is adopted to protect information and information systems involving State secrets, the design, implementation, use, operation, maintenance and daily management of the encryption shall be executed according to relevant State regulations on encryption management and technical standards; where encryption is used to protect information and information systems not involving State secrets, the “Commercial Encryption Management Regulations”, categorized and tiered encryption-related regulations and relevant technical standards must be followed.

Article 23: All levels’ encryption management departments may, at regular or irregular intervals, conduct inspection and assessment of the provision, use and management of encryption in information security multi-level protection work, they will conduct inspection and assessment of the provision, use and management of encryption on important secret-related information systems at least once every two years. Where they discover the existence of security vulnerabilities, violations of encryption management-related regulations or failure to meet the requirements of encryption-related standards in the process of supervision and inspection, the matter will be dealt with according to State encryption management-related regulations. 

Chapter V: Legal liability

Article 24: Where the competent departments and operating or using work units of third-tier or fourth-tier information systems and State secret-related information systems violate the provisions of these Rules, and one of the following acts is present, resulting in grave harm, the relevant department will handle the matter according to relevant laws and regulations:

(1) Not reporting for filing, examination and approval according to these Rules;

(2) Not conducting system security facility construction and structural construction according to the requirements of multi-level protection technology standards;

(3) Refusing rectification after receiving rectification notices;

(4) Violating secrecy protection management regulations;

(5) Violating encryption management regulations;

(6) Violating these Rules and other regulations.

Chapter VI: Supplementary provisions

Article 25: Military computer information system security protection work will be executed according to relevant military regulations

Article 26: These Management Rules take effect on 1 March 2006.

信息安全等级保护管理办法(试行)

　　（公安部公通字[2006]7号文件颁布)　
　　第一章　总则
　　第一条　为加强信息安全等级保护，规范信息安全等级保护管理，提高信息安全保障能力和水平，维护国家安全、社会稳定和公共利益，保障和促进信息化建设，根据《中华人民共和国计算机信息系统安全保护条例》等国家有关法律法规，制定本办法。
　　第二条　信息安全等级保护，是指对国家秘密信息及公民、法人和其他组织的专有信息以及公开信息和存储、传输、处理这些信息的信息系统分等级实行安全保护，对信息系统中使用的信息安全产品实行按等级管理，对信息系统中发生的信息安全事件分等级响应、处置。
　　第三条　信息系统的安全保护等级应当根据信息和信息系统在国家安全、经济建设、社会生活中的重要程度，信息和信息系统遭到破坏后对国家安全、社会秩序、公共利益以及公民、法人和其他组织的合法权益的危害程度，信息和信息系统应当达到的基本的安全保护水平等因素确定。
　　第四条　信息系统的安全保护等级分为以下五级：
　　（一）　第一级为自主保护级，适用于一般的信息系统，其受到破坏后，会对公民、法人和其他组织的合法权益产生损害，但不损害国家安全、社会秩序和公共利益。
　　（二）　第二级为指导保护级，适用于一般的信息系统，其受到破坏后，会对社会秩序和公共利益造成轻微损害，但不损害国家安全。
　　（三）　第三级为监督保护级，适用于涉及国家安全、社会秩序和公共利益的重要信息系统，其受到破坏后，会对国家安全、社会秩序和公共利益造成损害。
　　（四）　第四级为强制保护级，适用于涉及国家安全、社会秩序和公共利益的重要信息系统，其受到破坏后，会对国家安全、社会秩序和公共利益造成严重损害。
　　（五）　第五级为专控保护级，适用于涉及国家安全、社会秩序和公共利益的重要信息系统的核心子系统，其受到破坏后，会对国家安全、社会秩序和公共利益造成特别严重损害。
　　第五条　信息系统运营、使用单位及个人依据本办法和相关技术标准对信息系统进行保护，国家有关信息安全职能部门对其信息安全等级保护工作进行监督管理。
　　（一）　第一级信息系统运营、使用单位或者个人可以依据国家管理规范和技术标准进行保护。
　　（二）　第二级信息系统运营、使用单位应当依据国家管理规范和技术标准进行保护。必要时，国家有关信息安全职能部门可以对其信息安全等级保护工作进行指导。
　　（三）　第三级信息系统运营、使用单位应当依据国家管理规范和技术标准进行保护，国家有关信息安全职能部门对其信息安全等级保护工作进行监督、检查。
　　（四）　第四级信息系统运营、使用单位应当依据国家管理规范和技术标准进行保护，国家有关信息安全职能部门对其信息安全等级保护工作进行强制监督、检查。
　　（五）　第五级信息系统运营、使用单位应当依据国家管理规范和技术标准进行保护，国家指定的专门部门或者专门机构对其信息安全等级保护工作进行专门监督、检查。
　　第六条　公安机关负责信息安全等级保护工作的监督、检查、指导。国家保密工作部门负责等级保护工作中有关保密工作的监督、检查、指导。国家密码管理部门负责等级保护工作中有关密码工作的监督、检查、指导。
　　涉及其他职能部门管辖范围的事项，由有关职能部门依照国家法律法规的规定进行管理。
　　国务院信息化工作办公室及地方信息化领导小组办事机构负责等级保护工作的部门间协调。
　　第二章　信息安全等级保护工作的安全管理
　　第七条　信息系统的运营、使用单位应当依据本办法和有关标准，确定信息系统的安全保护等级。有主管部门的，应当报主管部门审核批准。
　　第八条　信息系统的运营、使用单位应当根据据已确定的安全保护等级，依照本办法和有关技术标准，使用符合国家有关规定，满足信息系统安全保护等级需求的信息技术产品，进行信息系统建设。
　　第九条　信息系统的运营、使用单位应当履行下列安全等级保护职责：
　　（一）　落实信息安全等级保护的责任部门和人员，负责信息系统的安全等级保护管理工作；
　　（二）　建立健全安全等级保护管理制度；
　　（三）　落实安全等级保护技术标准要求；
　　（四）　定期进行安全状况检测和风险评估；
　　（五）　建立信息安全事件的等级响应、处置制度；
　　（六）　负责对信息系统用户的安全等级保护教育和培训；
　　（七）　其他应当履行的安全等级保护职责。
　　第十条　信息系统建设完成后，其运营、使用单位应当依据本办法选择具有国家相关技术资质和安全资质的测评单位，按照技术标准进行安全测评，符合要求的，方可投入使用。
　　第十一条　从事信息系统安全等级测评的单位，应当遵守国家有关法律法规和技术标准规定，保守在测评活动中知悉的国家秘密、商业秘密和个人隐私，提供安全、客观、公正的检测评估服务。
　　测评单位资质管理办法由有关部门另行制定。
　　第十二条　第三级以上信息系统的运营、使用单位应当自系统投入运行之日起三十日内，到所在地的省、自治区、直辖市公安机关指定的受理机构办理备案手续，填写《信息系统安全保护等级备案登记表》。国家另有规定的除外。
　　备案事项发生变更时，信息系统运营、使用单位或其主管部门应当自变更之日起三十日内将变更情况报原备案机关。
　　第十三条　公安机关应当掌握信息系统运营、使用单位的备案情况，建立备案档案，进行备案管理。发现不符合本办法及有关标准的，应通知其予以纠正。
　　第十四条　公安机关应当监督、检查第三级和第四级信息系统运营、使用单位履行安全等级保护职责的情况。
　　对安全保护等级为三级的信息系统每年至少检查一次，对安全保护等级为四级的信息系统每半年至少检查一次。
　　第十五条　公安机关发现信息系统运营、使用单位未履行安全等级保护职责或未达到安全保护要求的，应当书面通知其整改。
　　第三章　信息安全等级保护的保密管理
　　第十六条　涉及国家秘密的信息系统应当依据国家信息安全等级保护的基本要求，按照国家保密工作部门涉密信息系统分级保护的管理规定和技术标准，结合系统实际情况进行保护。
　　不涉及国家秘密的信息系统不得处理国家秘密信息。
　　第十七条　涉及国家秘密的信息系统按照所处理信息的最高密级，由低到高划分为秘密级、机密级和绝密级三个级别，其总体防护水平分别不低于三级、四级、五级的要求。
　　涉及国家秘密的信息系统建设单位应当依据《中华人民共和国保守国家秘密法》和国家有关秘密及其密级具体范围的规定，确定系统处理信息的最高密级和系统的保护级别。
　　第十八条　涉及国家秘密的信息系统的设计实施、审批备案、运行维护和日常保密管理，按照国家保密工作部门的有关规定和技术标准执行。
　　第十九条　各级保密工作部门应当对已投入使用的涉及国家秘密的信息系统组织检查和测评。发现系统存在安全隐患或系统保护措施不符合分级保护管理规定和技术标准的，应当通知系统使用单位和管理部门限期整改。
　　对秘密级、机密级信息系统，每两年至少进行一次保密检查或系统测评；对绝密级信息系统，每年至少进行一次保密检查或系统测评。
　　第四章　信息安全等级保护的密码管理
　　第二十条　国家密码管理部门对信息安全等级保护的密码实行分类分级管理。根据被保护对象在国家安全、社会稳定、经济建设中的作用和重要程度，被保护对象的安全防护要求和涉密程度，被保护对象被破坏后的危害程度以及密码使用部门的性质等，确定密码的等级保护准则。
　　信息系统运营、使用单位采用密码进行等级保护的，应当遵照信息安全等级保护密码管理规定和相关标准。
　　第二十一条　信息系统安全等级保护中密码的配备、使用和管理等，应严格执行国家密码管理的有关规定。
　　第二十二条　要充分运用密码技术对信息系统进行保护。采用密码对涉及国家秘密的信息和信息系统进行保护的，密码的设计、实施、使用、运行维护和日常管理等，应当按照国家密码管理有关规定和技术标准执行；采用密码对不涉及国家秘密的信息和信息系统进行保护的须遵照《商用密码管理条例》和密码分类分级保护有关规定与相关标准。
　　第二十三条　各级密码管理部门可以定期或者不定期对信息系统等级保护工作中密码配备、使用和管理的情况进行检查和测评，对重要涉密信息系统的密码配备、使用和管理情况每两年至少进行一次检查和测评。　在监督检查过程中，发现存在安全隐患或违反密码管理相关规定或者未达到密码相关标准要求的，按照国家密码管理的相关规定进行处置。
　　第五章　法律责任
　　第二十四条　三级、四级信息系统和涉及国家秘密的信息系统的主管部门和运营、使用单位违反本办法规定，有下列行为之一，造成严重损害的，由相关部门依照有关法律、法规予以处理：
　　（一）　未按本办法规定报请备案、审批的；
　　（二）　未按等级保护技术标准要求进行系统安全设施建设和制度建设的；
　　（三）　接到整改通知后，拒不整改的；
　　（四）　违反保密管理规定的；
　　（五）　违反密码管理规定的；
　　（六）　违反本办法和其他规定的。
　　第六章　附则
　　第二十五条　军队的计算机信息系统安全保护工作，按照军队的有关法规执行。
　　第二十六条　本管理办法自2006年3月1日起施行。