Start with the activity, not the report template
Article 2 covers risk identification, analysis and evaluation of network data and its processing in China. Important-data status is the gateway to the annual obligation in Article 5; the measures do not declare every dataset important. Keep the sector catalogue, notification or other classification basis with the assessment record.
The 2025 consultation draft is historical material, not a second current compliance route. Its report annex and proposed mutual-recognition provision cannot be used as if they were adopted. The final text and the August implementation Q&A should anchor current procedures.
Three assessment tracks, different triggers
Article 5 retains the annual obligation and a separate change-triggered duty. A material change in important-data security conditions that may adversely affect security calls for timely assessment of the changed and affected parts; waiting for the next annual cycle can miss that duty.
The three-year language for general-data processors is encouragement, not a universal mandatory deadline. An authority-ordered assessment under Article 17 is a different track and may concern a processor facing a specified risk or incident, not only its routine annual work.
| Track | Trigger and scope | Planning consequence |
|---|---|---|
| Annual | Important-data processor; Article 5 | Set an annual owner, scope and report submission workflow. |
| Material change | Adverse security implications from a major change; Article 5 | Record the change and assess the affected parts promptly. |
| Authority-ordered | Specified risk or incident; Articles 17–18 | Use a certified institution when required and follow the authority's timetable. |
Choosing an assessor and controlling its access
Article 7 allows self-assessment with a designated responsible person or engagement of a third party. Article 8 encourages certification; it does not require a certified institution for every voluntary engagement. Article 17 separately permits authorities to require one in specified cases. The August Q&A explains the certification application channel, not a blanket outsourcing requirement.
Articles 10–14 require objective reporting, prohibit onward subcontracting and protect assessment information. Article 12 prohibits the same institution and its affiliates from conducting three or more consecutive annual assessments for the same processor. Check the affiliate relationship and prior annual engagements before signing.
As an original procurement checklist, document the assessment scope, responsible people, independence, necessary access, evidence handling, escalation and end-of-engagement disposal. Article 14 permits timely deletion or proper disposal as contractually agreed; it is not permission for unrestricted retention. Retaining the final report for at least three years under Article 15 is a separate requirement.
Do not combine the 20-, 10- and 15-working-day clocks
The annual report deadline is measured from completion of the annual assessment, not from the publication or effective date of the measures. Keep a defensible completion record, the applicable authority's instructions and proof of submission. Do not assume ordinary calendar days are working days.
Where the competent authority is unclear, Article 16 permits submission to the provincial or national cyberspace authority. The August Q&A publishes contact information for consultation. Confirm the current receiving channel through that official page rather than inventing an email address or a universal filing portal.
| Clock | Who and when | What it is not |
|---|---|---|
| 20 working days | Important-data processor after annual assessment completion; Article 16. | Not 10 working days under the old draft. |
| 10 working days | Receiving authority forwards the report to the same-level CAC after receipt; Article 16. | Not the processor's annual filing deadline. |
| 15 working days | Processor reports rectification after completing it in the authority-ordered track; Article 18(4). | Not a universal period to finish all rectification. |
Build the report from current requirements
Article 6 requires compliance with the Data Security Law and Network Data Security Regulation, with reference to relevant national standards; applicable sector rules take precedence as specified. Article 15 directs report preparation to competent-authority requirements, or reference to relevant standards where those requirements are absent. The final measures do not carry forward the draft's attached report template.
The following is an editorial evidence map, not an official mandatory form. Its purpose is to make findings reproducible: each finding should connect a processing activity, an observed weakness, a consequence, a response and supporting evidence. A copied policy without proof of operation does not demonstrate that a control works.
| Workstream | Evidence to assemble | Review question |
|---|---|---|
| Scope and classification | Data inventory, processing flows and classification basis. | Does the scope match the activities actually assessed? |
| Controls and findings | Access samples, configuration checks, incident records and test results. | Can another reviewer reproduce the finding? |
| Remediation and residual risk | Named owner, remedy, retest result and unresolved limitation. | Has closure been evidenced rather than merely promised? |
| Report custody | Approved report, version record and restricted storage. | Is the report retained for at least three years? |
When the authority orders a certified assessment
Article 17 covers substantial security risk that may endanger national security or public interests, incidents causing leakage or theft of important data or large-scale personal information, and other stipulated circumstances. The final wording gives authorities a power to require certified assessment; it does not make every internal finding an automatic outsourcing trigger. The same incident or risk must not lead to repeated demands for commissioned assessment under that article.
Under Article 18, provide necessary support and access, complete work within the imposed period or obtain an approved extension, submit the signed and stamped institutional report, and report rectification within 15 working days after completion. Do not pressure the institution to change an inconvenient conclusion. The draft's express fee-bearing sentence was removed; that does not establish a right to free commissioned services.
What changed, and what this assessment does not replace
The final text lengthens annual report submission, changes report preparation, narrows the rotation wording to annual assessments and permits contract-based proper disposal. It also omits the draft's express results-mutual-recognition clause. Evidence may be useful across workstreams, but this final instrument does not itself grant the draft's blanket acceptance of overlapping assessment, audit or certification results.
Network-data risk assessment is not an export permission and does not replace a PIPIA, personal-information compliance audit or a sector-specific assessment. Article 23 separately preserves core-data arrangements and addresses commercial-cryptography application security assessment for relevant important-data encryption measures. Article 24 preserves secrecy-law requirements. Map each applicable obligation and its own result; do not relabel one report as approval for all of them.
Two hypothetical planning examples
Example A: an important-data processor finishes its annual assessment, then receives a request to confirm its receiving authority. Its annual report clock remains tied to assessment completion. Record the consultation and use the provincial or national CAC fallback where the competent authority is unclear; do not treat uncertainty as an automatic extension.
Example B: a general-data processor adopts a three-year internal review cycle. That is a voluntary planning choice under Article 5, not evidence that other security duties pause for three years. If a qualifying incident leads to an Article 17 order, follow the separate certified-assessment process and the authority's time limit. These examples illustrate workflow boundaries, not findings about a real organization.
Official sources & revisions
- Final measures, Order No. 24 (Articles 1–25)
- December 2025 consultation draft (Articles 1–25 and annex)
- CAC implementation Q&A, 20 August 2026 (questions 1–2)
: Replaced the short overview with assessment tracks, three separate clocks, assessor controls, report evidence, implementation Q&A and hypothetical examples. Rechecked the controlling final text and draft; linked the bilingual article-level comparison.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction