China Cyber Incident Reporting Measures
In force China · In force Nov 1, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Requires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.
- Who it applies to
- Network owners, managers and network service providers that build or operate networks or provide services over networks in China.
- Penalties
- Penalties under the CSL and other laws for failure to report; heavier penalties for late, missing, false or concealed reports that cause serious harm. Liability may be reduced where operators took reasonable measures and reported on time.
- Enforced by
- Cyberspace Administration of China (CAC) and provincial CAC offices, with MPS and sector regulators
- Official name
- Administrative Measures for National Cybersecurity Incident Reporting
- Citation
- CAC measures of 11 September 2025
- Topics
- cybersecurity, breach-notification
Verified 2026-09-25
Research notes
Issued by CAC on 2025-09-11 and published 2025-09-15 as a normative document without an order number. Sector rules such as the PBOC incident reporting measures apply in addition.
Related
Questions about China Cyber Incident Reporting Measures
- What are the China Cyber Incident Reporting Measures compliance deadlines?
- Nov 1, 2025: Incident reporting measures take effect.
- When does China Cyber Incident Reporting Measures take effect?
- China Cyber Incident Reporting Measures took effect on Nov 1, 2025.
- Who does China Cyber Incident Reporting Measures apply to?
- Network owners, managers and network service providers that build or operate networks or provide services over networks in China.
- What are the penalties under China Cyber Incident Reporting Measures?
- Penalties under the CSL and other laws for failure to report; heavier penalties for late, missing, false or concealed reports that cause serious harm. Liability may be reduced where operators took reasonable measures and reported on time.