China's Cybersecurity Law requires network operators to protect their systems under the Multi-Level Protection Scheme. In practice that means grading each system, filing with the public security bureau for level two and above, passing an assessment by a licensed assessment body, and fixing what it finds. Teams lose months by grading wrongly or reaching assessment with gaps they could have closed. This skill prepares the grading argument, filing, and gap list before the assessor arrives.
Write in Simplified Chinese unless asked otherwise. This is preparation, not certification: grading is confirmed through expert review and the public security bureau, and only a licensed assessor can assess. Check current requirements with the local cybersecurity police department and the assessor.
Required Inputs
Ask for these if not provided:
- The system: what it does, users, data it holds (including personal and important data), and whether it serves the public
- Impact if compromised: on individuals, organisations, social order or national security, and how severe
- Architecture: hosting (own data centre or cloud, and the cloud's own MLPS level), network zones, key components
- Existing controls and policies, and any previous assessment reports
- Deadline driving the work (a tender, a regulator, a customer)
Output Structure
1. Grading
The recommended level (1 to 5; most business systems land at 2 or 3), with reasoning on the standard's two factors: the object harmed and the degree of harm, separately for business information security and system service security. Written as the grading-report argument for expert review.
2. Filing and assessment steps
| Step | Who | Typical timing (confirm) | Grading (定级) and expert review, filing (备案) with the local public security bureau (for level two and above, usually within 30 days of grading), choosing a licensed assessor, assessment, remediation, and re-assessment (level three systems are typically assessed every year).
3. Gap checklist
Across the ten control areas of GB/T 22239-2019, at the recommended level:
- Technical: secure physical environment, secure communications network, secure zone boundaries, secure computing environment, security management centre
- Management: security management policies, security management organization, security management personnel, secure construction management, secure operations and maintenance management | Area | Requirement | Current state | Gap | Fix | Owner |
4. Remediation plan
Gaps ordered by assessment risk and effort, with owners and dates that finish before the assessment.
Quality Checks
- The recommended level states the object harmed and the degree of harm for both security aspects
- Filing applies to level two and above and is shown with its timing marked to confirm
- The gap checklist covers all ten control areas
- Every gap has a fix, an owner and a date
- Cloud-hosted systems separate the provider's controls from the operator's
- The output states that only a licensed assessor can assess
Anti-Patterns
- Grading low to save cost. Expert review and the bureau can raise it, late.
- Policies on paper only. Assessors check evidence of operation, such as logs and records.
- Assuming the cloud covers everything. The operator still owns its own layer.
- Starting remediation after the assessment begins. Close the obvious gaps first.
Example Trigger Phrases
- "Our SaaS system needs to pass MLPS Level 3; help me map out the gaps."
- "How should I write the rationale for MLPS grading? Level 2 or Level 3?"
- "What is the process for MLPS filing and assessment?"
- "Prepare our system for China's MLPS 2.0 assessment."