China's cyberspace regulator requires network operators to grade incidents themselves against a national scale and report within hours, and makes outsourced security providers report to them

Event date / reported

Evidence stage

Tasks this bears on

Where this applies

A national rule for every network operator in China. Article 4 requires an operator that discovers or learns of an incident to assess it against the attached grading guide and, for incidents graded significant or above, report within one hour for critical information infrastructure, two hours for central government bodies and four hours for others. Article 5 requires operators to make providers of security and operations services report the incidents they detect to the operator and help it report. Article 10 provides heavier penalties for the operator and the responsible persons where late, missed, false or concealed reports cause serious harm. It puts the determination and the accountability on the operator; it does not say whether a person or a system does the grading.

What this means

What it does not yet show

It assigns the judgement to the operator, not to a person; nothing here shows who inside the operator grades incidents, or whether software does it.

What you can check

Does it change the assessment?

Source