Regulation 2025
国家网络安全事件报告管理办法 (National Cybersecurity Incident Reporting Management Measures)
Issued by Cyberspace Administration of China
Effective: 1 Nov 2025
Plain-English summary
Adopted by the CAC on 11 September 2025 and effective 1 November 2025 (Art. 14). For incidents rated larger or above, critical information infrastructure operators report within 1 hour, central government departments and their direct subordinate units within 2 hours, and other operators to the provincial cyberspace authority within 4 hours (Art. 4); a summary report is due within 30 days after handling ends (Art. 8). Late, false or concealed reports draw heavier penalties (Art. 10).
Who it applies to
All industries
Topics
Cybersecurity & IT Risk
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Report cybersecurity incidents within 1, 2 or 4 hours | Deadline 1 hour (CII operators), 2 hours (central government departments), 4 hours (others) | CAC | official | |
For incidents rated larger or above, Art. 4 requires critical information infrastructure operators to report as soon as possible and within 1 hour, central government departments and their direct subordinate units within 2 hours, and other operators to the provincial cyberspace authority within 4 hours. Art. 8 requires a summary report within 30 days after handling ends. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.