China's cybersecurity incident reporting measures (2025)

Summary

The measures govern how network operators in China report cybersecurity incidents. Incidents must be graded under an annexed four-level guide, and those rated "relatively major" or above must be reported: within 1 hour by critical information infrastructure operators to their protection department and the police, within 2 hours by central and state bodies to their own cyberspace unit, and within 4 hours by all other operators to the provincial office of the Cyberspace Administration. Reports cover the affected systems, type, level, impact and measures taken and, for ransomware, the amount and method of the ransom demanded; missing details may follow later. Within 30 days after the incident is closed the operator submits a final report on causes, measures and lessons learned. Late, missed, false or concealed reports are punished more severely, while timely reporting and adequate measures can reduce liability.

Information

Jurisdiction

China

Issuing body

Cyberspace Administration of China (CAC)

Type

Regulation

Available languages

Chinese

Topics

• Incident reporting
• Incident management / CSIRT
• Critical infrastructure

Notes

Measures of the Cyberspace Administration of China dated 11 September 2025, published on 15 September 2025 and in force since 1 November 2025. The annexed incident grading guide is based on national standard GB/T 20986-2023 and sets quantitative thresholds: for example, a complete outage of critical infrastructure for more than 6 hours, a leak of personal data of more than 100 million people or direct economic losses above 100 million yuan count as "particularly major". For major and particularly major incidents, the authorities receiving the report must inform the national level within 30 minutes or 1 hour. Reports can also be made through the 12387 hotline.

Obligations compared

Cyber incident reporting China

Cyberspace Administration of China (CAC). (2025). 国家网络安全事件报告管理办法. https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm

Cyberspace Administration of China (CAC). "国家网络安全事件报告管理办法." 11 September 2025. https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm.

@misc{cn_cybersecurity_incident_reporting_measures_2025,
  author       = {{Cyberspace Administration of China (CAC)}},
  title        = {{国家网络安全事件报告管理办法}},
  year         = {2025},
  url          = {https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm},
  urldate      = {2026-10-29}
}