关键信息基础设施安全保护条例英文

2021年8月17日，中央政府正式公布了期待已久的《关键信息基础设施安全保护条例》（以下简称“条例”），自2021年9月1日起施行。

本文概述了条例的主要条款，并阐述我们对该制度的见解。

背景

《网络安全法》（“网安法”）首次将关键信息基础设施的概念引入法律，该法于2016年11月颁布，专门有一节内容涉及关键信息基础设施的安全保护。国家互联网信息办公室（以下简称“网信办”）在2017年7月公布了关键信息基础设施安全保护条例草案并向社会公开征求意见，但是此后一直未颁布，直到本条例的此次公布。2017年和2020年曾公布过一些关于关键信息基础设施的国家标准草案并向社会公开征求意见，但目前为止均未采纳。

实施细则的缺位已成为根据《网安法》规定有效实施关键信息基础设施保护措施的主要障碍。例如，在今年7月宣布对滴滴等公司进行网络安全调查之前，网信办并没有根据网络安全审查制度开展过任何涉及关键信息基础设施运营者供应链安全和数据处理活动的执法案件。即便是在滴滴案件中，由于滴滴从未被官方确认为关键信息基础设施运营者，因此也有人质疑网络安全审查条例对滴滴的适用性。

《条例》的公布将进一步阐明如何建立和实施关键信息基础设施保护制度。

重点条款摘要

关键信息基础设施的范围

《条例》对关键信息基础设施的定义与《网安法》相同。关键信息基础设施被定义为：重要网络设施和信息系统，一旦遭到破坏、丧失功能或者数据泄露，可能严重危害国家安全、国计民生、公共利益。

《条例》强调一些可以确认存在关键信息基础设施的“重要行业和领域”，包括公共通信和信息服务、能源、交通、水利、金融、公共服务、电子政务、国防科技工业。《条例》没有明确规定任何子行业或领域。值得注意的是，其中并没有排除任何其他行业，因此任何符合定义的网络设施和信息系统都有可能被视为“关键信息基础设施”。

有一些行业曾出现在2017年的征求意见稿中，例如环保、化工、食品药品等行业，而在正式文本的重点行业和领域中被删除。但是，特定系统是否会被视为关键信息基础设施，将根据以下认定流程决定。

关键信息基础设施的认定

在重要行业和领域中，相关监管部门将负责保护本行业和领域中的关键信息基础设施，这些部门统称为“保护工作部门”。

特别强调，保护工作部门有权制定关键信息基础设施认定规则并根据规则开展认定工作。保护工作部门在制定认定规则时将考虑以下因素：

网络设施、信息系统等对于本行业、本领域关键核心业务的重要程度；
网络设施、信息系统等一旦遭到破坏、丧失功能或者数据泄露可能带来的危害程度；
对其他行业和领域的关联性影响。

保护工作部门在认定关键信息基础设施后，必须将认定结果通知运营者，并报送公安部门。

从《条例》中无法看出政府将如何认定重要行业和领域之外的关键信息基础设施。网信办是否会就此发布任何指引，尚有待观察。

关键信息基础设施运营者的义务

《条例》阐述了关键信息基础设施运营者的责任义务，规定运营者必须

建立网络安全保护制度和责任制，分配充足资源以保障制度顺利实施，特别规定运营者的负责人对关键信息基础设施的安全负主要责任；
设置专门安全管理机构（简称“安全管理机构”），保障运行经费并配备相应人员，并对负责人和关键岗位人员进行安全背景审查；
每年至少进行一次网络安全检测和风险评估，并向主管的保护工作部门报告；
向保护工作部门和公安机关报告重大网络安全事件或威胁，包括整体运行中断、主要功能障碍、国家基础信息（条例未明确定义）以及其他重要数据泄露、大规模个人信息泄露、违法信息大范围传播以及造成较大经济损失的事件；
采购“安全可信”的网络产品和服务，采购的产品和服务可能影响国家安全的，应当进行网络安全审查；
与网络产品和服务提供商签订安全保密协议；
运营者发生合并、分立、解散等情况，应向保护工作部门报告；
配合保护工作部门和其他主管部门开展调查工作。

安全管理机构有义务：

建立健全网络安全管理、评价考核制度，拟订关键信息基础设施安全保护计划；
提升网络安全保护能力，开展网络安全监测、检测和风险评估；
制定应急预案，定期开展应急演练，处置网络安全事件；
认定网络安全关键岗位，组织开展工作考核；
组织网络安全培训；
履行个人信息和数据安全保护责任；
管理关键信息基础设施的设计、建设、运行和维护；
报告网络安全事件和重要事项。

值得注意的是，《条例》要求上述安全保护能力和措施与关键信息基础设施同步规划、同步建设、同步使用。这里存在一个问题，即保护工作部门如何能够在规划阶段认定关键信息基础设施，希望在后续发布的认定规则中能进一步阐明这一问题。

处罚

违反《条例》的运营者将被责令整改、给予警告；情节严重的，将对运营者处100万元以下罚款，对直接责任人员处以10万元以下罚款。运营者在采购网络产品和服务的过程中未按照规定进行安全审查的，网信办可处以采购金额1倍以上10倍以下罚款。

监管部门

网信办再次承担协调监管工作的职责，公安部门负责监督指导关键信息基础设施的安全保护工作。保护工作部门和其他政府部门负责本行业和本领域的关键信息基础设施保护工作。省级人民政府将负责本省关键信息基础设施保护工作。

除上述部门外，国家安全部、国家保密局和国家密码管理局还有权检查关键信息基础设施的安全防护工作。

根据《条例》，国家将优先保障能源、电信行业关键信息基础设施的安全运行，而相关监管部门预计将在保护工作部门中率先开始进行监管工作。

鸿鹄见解

I. 关键信息基础设施的范围有待重新界定

《条例》并未描述重要行业和领域的边界，也没有提供保护工作部门名单，关于关键信息基础设施范围的所有细节都有待在保护工作部门公布的认定规则中进行阐述。

更重要的是，《条例》并没有透露如何认定重要行业和领域之外的关键信息基础设施。我们希望网信部会在未来的法规中对此进行明确阐述。

II. 未涉及跨境数据传输

《网安法》、《数据安全法》和《个人信息保护法》均规定，关键信息基础设施运营者应对个人信息和重要数据进行本地化处理，并提交跨境数据传输申请，通过安全评估。令人诧异的是，《条例》对此完全没有提及。

目前尚不清楚回避数据出境问题是有意为之，还是单纯疏忽，但是政府部门没有借此契机进一步详细阐述安全评估流程，还是留下了一些遗憾。

III. 与网络安全等级保护制度（“等保”）的关系

《条例》尚未解决的一个问题是，关键信息基础设施运营者如何处理等保制度与关键信息基础设施保护制度之间的重叠内容。从已公布的关键信息基础设施标准草案来看，关键信息基础设施运营者需要同时遵守等保制度和关键信息基础设施保护制度，而后者的评估和调查标准更高。对网络安全等级保护制度的遵守情况，也将成为关键信息基础设施安全保护能力评估中不可或缺的一个因素。毫无疑问，此举将增加关键信息基础设施运营者的合规负担。

总结

《条例》的公布为执行关键信息基础设施保护制度铺平了道路。各家公司，特别是处于重要行业和领域的公司，应及时了解保护工作部门发布的关键信息基础设施认定规则，对自身的网络设施和信息系统被认定为关键信息基础设施的可能性进行评估。

关键信息基础设施安全保护条例国务院令第745号《关键信息基础设施安全保护条例》已经2021年4月27日国务院第133次常务会议通过，现予公布，自2021年9月1日起施行。总理　　李克强2021年7月30日关键信息基础设施安全保护条例		Security Protection Regulations for Critical Information InfrastructureDecree No. 745 of the State CouncilThe Security Protection Regulations for Critical Information Infrastructure, adopted at the 133rd executive meeting of the State Council on April 27, 2021, are hereby promulgated, effective September 1, 2021.Li Keqiang, PremierJuly 30, 2021Security Protection Regulations for Critical Information Infrastructure
第一章总则		Chapter I General Provisions
第一条为了保障关键信息基础设施安全，维护网络安全，根据《中华人民共和国网络安全法》，制定本条例。		Article 1 These Regulations are enacted in accordance with the Cybersecurity Law of the People’s Republic of China for the purposes of protecting the security of critical information infrastructure and maintaining cyber security.
第二条本条例所称关键信息基础设施，是指公共通信和信息服务、能源、交通、水利、金融、公共服务、电子政务、国防科技工业等重要行业和领域的，以及其他一旦遭到破坏、丧失功能或者数据泄露，可能严重危害国家安全、国计民生、公共利益的重要网络设施、信息系统等。		Article 2 For the purpose of these Regulations, critical information infrastructure refer to the important network facilities and information systems in important industries and fields such as public telecommunications, information services, energy, transportation, water conservancy, finance, public services, e-government and national defense science, technology and industry, as well as other important network facilities and information systems which, in case of destruction, loss of function or leak of data, may result in serious damage to national security, the national economy and the people’s livelihood and public interests.
第三条在国家网信部门统筹协调下，国务院公安部门负责指导监督关键信息基础设施安全保护工作。国务院电信主管部门和其他有关部门依照本条例和有关法律、行政法规的规定，在各自职责范围内负责关键信息基础设施安全保护和监督管理工作。省级人民政府有关部门依据各自职责对关键信息基础设施实施安全保护和监督管理。		Article 3 Under the overall planning and coordination of the Cyberspace Administration of China (hereinafter referred to as the CAC), the public security department under the State Council is responsible for guiding and supervising the protection of the security of critical information infrastructure. The competent telecommunications department of the State Council and other relevant departments shall, in accordance with provisions of these Regulations and relevant laws and administrative regulations, be responsible for protecting, supervising and administering the security of critical information infrastructure within the scope of their respective duties. Relevant departments of the provincial people’s government shall protect, supervise and administer the security of critical information infrastructure ex officio.
第四条关键信息基础设施安全保护坚持综合协调、分工负责、依法保护，强化和落实关键信息基础设施运营者（以下简称运营者）主体责任，充分发挥政府及社会各方面的作用，共同保护关键信息基础设施安全。		Article 4 For the security protection of critical information infrastructure, it is imperative to the principles of comprehensive coordination, division of responsibilities and legal protection, strengthen and implement the responsibilities of critical information infrastructure operators (hereinafter referred to as the “operators”) as subjects, and give full play to the role of the government and all sectors of society, so as to jointly protect the security of critical information infrastructure.
第五条国家对关键信息基础设施实行重点保护，采取措施，监测、防御、处置来源于中华人民共和国境内外的网络安全风险和威胁，保护关键信息基础设施免受攻击、侵入、干扰和破坏，依法惩治危害关键信息基础设施安全的违法犯罪活动。任何个人和组织不得实施非法侵入、干扰、破坏关键信息基础设施的活动，不得危害关键信息基础设施安全。		Article 5 The State gives priority to the protection of critical information infrastructure, takes measures to monitor, defends against and deal with cyber security risks and threats from both within and outside the territory of the People’s Republic of China, protects critical information infrastructure from attacks, intrusions, interference and damage, and punishes illegal and criminal activities endangering the security of critical information infrastructure in accordance with the law. No individual or organization may illegally invade, interfere with or destroy the critical information infrastructure, or endanger the security of the critical information infrastructure.
第六条运营者依照本条例和有关法律、行政法规的规定以及国家标准的强制性要求，在网络安全等级保护的基础上，采取技术保护措施和其他必要措施，应对网络安全事件，防范网络攻击和违法犯罪活动，保障关键信息基础设施安全稳定运行，维护数据的完整性、保密性和可用性。		Article 6 Operators shall, in accordance with the provisions of these regulations, relevant laws and administrative regulations and compulsory requirements of national standards, take technical protection measures and other necessary measures based on the graded protection for cyber security, respond to cyber security incidents, prevent cyber attacks and illegal and criminal activities, guarantee the safe and stable operation of critical information infrastructure, and maintain the integrity, confidentiality and availability of data.
第七条对在关键信息基础设施安全保护工作中取得显著成绩或者作出突出贡献的单位和个人，按照国家有关规定给予表彰。		Article 7 Entities and individuals that have made remarkable achievements in or outstanding contributions to the security protection of critical information infrastructure shall be commended in accordance with relevant provisions of the State.
第二章关键信息基础设施认定		Chapter II Identification of Critical Information Infrastructure
第八条本条例第二条涉及的重要行业和领域的主管部门、监督管理部门是负责关键信息基础设施安全保护工作的部门（以下简称保护工作部门）。		Article 8 For the important industries and fields mentioned in Article 2 hereof, the competent authorities and supervisory authorities are the authorities responsible for the security protection of critical information infrastructure (hereinafter referred to as the “protection authorities”).
第九条保护工作部门结合本行业、本领域实际，制定关键信息基础设施认定规则，并报国务院公安部门备案。制定认定规则应当主要考虑下列因素：（一）网络设施、信息系统等对于本行业、本领域关键核心业务的重要程度；（二）网络设施、信息系统等一旦遭到破坏、丧失功能或者数据泄露可能带来的危害程度；（三）对其他行业和领域的关联性影响。		Article 9 The protection authorities shall, in light of the actual conditions of respective industries and fields, develop rules for the identification of critical information infrastructure, and file such rules with the public security department under the State Council for the record. The following factors shall be taken into account in the formulation of identification rules: (I) the degree of importance of network facilities, information systems, etc. for the key and core business of the industry and field concerned;(II) the degree of harm that may be caused in the event of any destruction, loss of function or leak of data of network facilities or information systems; and(III) the impact on the relevance to other industries and fields.
第十条保护工作部门根据认定规则负责组织认定本行业、本领域的关键信息基础设施，及时将认定结果通知运营者，并通报国务院公安部门。		Article 10 The protection authorities shall, in accordance with identification rules, be responsible for organizing the identification of critical information infrastructure of respective industries and fields, notify the operators concerned of the identification results in a timely manner, and report the same to the public security department under the State Council.
第十一条关键信息基础设施发生较大变化，可能影响其认定结果的，运营者应当及时将相关情况报告保护工作部门。保护工作部门自收到报告之日起3个月内完成重新认定，将认定结果通知运营者，并通报国务院公安部门。		Article 11 Operators shall report relevant information on any material change in critical information infrastructure that may affect the identification results to the protection authorities in a timely manner. The protection authorities shall complete the identification again within three months upon receipt of the report, notify the operator concerned of the identification results, and report the same to the public security department under the State Council.
第三章运营者责任义务		Chapter III Responsibilities and Obligations of an Operator
第十二条安全保护措施应当与关键信息基础设施同步规划、同步建设、同步使用。		Article 12 The security protection measures shall be planned, established and put into use simultaneously with the critical information infrastructure.
第十三条运营者应当建立健全网络安全保护制度和责任制，保障人力、财力、物力投入。运营者的主要负责人对关键信息基础设施安全保护负总责，领导关键信息基础设施安全保护和重大网络安全事件处置工作，组织研究解决重大网络安全问题。		Article 13 An operator shall establish sound cyber security protection system and the responsibility system to ensure the input of manpower, financial and material resources. The person chiefly in charge of the operator shall take overall responsibility for the protection of the security of critical information infrastructure, lead the security protection of critical information infrastructure and the disposal of major cyber security incidents, and organize the study and resolution of major cyber security issues.
第十四条运营者应当设置专门安全管理机构，并对专门安全管理机构负责人和关键岗位人员进行安全背景审查。审查时，公安机关、国家安全机关应当予以协助。		Article 14 An operator shall set up a specialized security management body, and conduct security background review of the person in charge of the specialized security management body and persons in key positions. During the review, the public security authority and national security authority shall provide assistance.
第十五条专门安全管理机构具体负责本单位的关键信息基础设施安全保护工作，履行下列职责：（一）建立健全网络安全管理、评价考核制度，拟订关键信息基础设施安全保护计划；（二）组织推动网络安全防护能力建设，开展网络安全监测、检测和风险评估；（三）按照国家及行业网络安全事件应急预案，制定本单位应急预案，定期开展应急演练，处置网络安全事件；（四）认定网络安全关键岗位，组织开展网络安全工作考核，提出奖励和惩处建议；（五）组织网络安全教育、培训；（六）履行个人信息和数据安全保护责任，建立健全个人信息和数据安全保护制度；（七）对关键信息基础设施设计、建设、运行、维护等服务实施安全管理；（八）按照规定报告网络安全事件和重要事项。		Article 15 The specialized security management body of an operator shall be specifically responsible for the security protection of critical information infrastructure of the operator, and shall perform the following duties: (I) Establishing the sound cyber security management, evaluation and assessment system, and drafting the security protection plan for critical information infrastructure; (II) Organizing and promoting the development of cyber security protection capacity, and conducting the monitoring, testing and risk assessment of cyber security;(III) Developing the operator’s own emergency plans, conducting regular emergency drills, and disposing of cyber security incidents in accordance with the national and industrial emergency plans for cyber security incidents;(IV) Identifying key positions for cyber security, organizing the assessment of cyber security work, and proposing rewards and punishments;(V) Organizing cyber security education and training;(VI) Performing the responsibility of personal information and data security protection, and establishing the sound personal information and data security protection system;(VII) Conducting security management of services such as design, construction, operation and maintenance of critical information infrastructure; and(VIII) Reporting cyber security incidents and important matters as required.
第十六条运营者应当保障专门安全管理机构的运行经费、配备相应的人员，开展与网络安全和信息化有关的决策应当有专门安全管理机构人员参与。		Article 16 An operator shall ensure the operation funds for its specialized security management body, allocate corresponding personnel, and have the personnel of the specialized security management body participate in making decisions relating to cyber security and informatization.
第十七条运营者应当自行或者委托网络安全服务机构对关键信息基础设施每年至少进行一次网络安全检测和风险评估，对发现的安全问题及时整改，并按照保护工作部门要求报送情况。		Article 17 An operator shall conduct by itself or entrust a cyber security service agency to conduct cyber security testing and risk assessment on its critical information infrastructure at least once a year, timely rectify security problems discovered, and report information as required by the protection authorities.
第十八条关键信息基础设施发生重大网络安全事件或者发现重大网络安全威胁时，运营者应当按照有关规定向保护工作部门、公安机关报告。发生关键信息基础设施整体中断运行或者主要功能故障、国家基础信息以及其他重要数据泄露、较大规模个人信息泄露、造成较大经济损失、违法信息较大范围传播等特别重大网络安全事件或者发现特别重大网络安全威胁时，保护工作部门应当在收到报告后，及时向国家网信部门、国务院公安部门报告。		Article 18 In the event of occurrence of any major cyber security incident or discovery of any major cyber security threat for the critical information infrastructure, the operator shall report to the protection authorities and the public security authorities as required. For any particularly major cyber security incident such as disruption of the operation of critical information infrastructure in whole or major function failure, divulgence of national basic information and other important data, divulgence of large scale personal information, large economic losses or spread of illegal information over a large scale, or discovery of any particularly major cyber security threat, the protection authorities shall, after receiving such report, timely report to the CAC and the public security department under the State Council.
第十九条运营者应当优先采购安全可信的网络产品和服务；采购网络产品和服务可能影响国家安全的，应当按照国家网络安全规定通过安全审查。		Article 19 Operators shall give priority to safe and reliable networking products or services purchased. If the purchase of networking products or services may affect national security, it is required to pass the security review in accordance with the national cyber security provisions.
第二十条运营者采购网络产品和服务，应当按照国家有关规定与网络产品和服务提供者签订安全保密协议，明确提供者的技术支持和安全保密义务与责任，并对义务与责任履行情况进行监督。		Article 20 In purchasing networking products or services, operators shall enter into a security confidentiality agreement with a networking product or service provider in accordance with the relevant provisions of the State, specifying the technical support and security confidentiality obligations and responsibilities of the provider, and supervise the fulfillment of the obligations and responsibilities.
第二十一条运营者发生合并、分立、解散等情况，应当及时报告保护工作部门，并按照保护工作部门的要求对关键信息基础设施进行处置，确保安全。		Article 21 In the event of merger, division or dissolution, an operator shall report to the protection department in a timely manner, and deal with the critical information infrastructure as required by the protection department to ensure security.
第四章保障和促进		Chapter IV Guarantee and Promotion
第二十二条保护工作部门应当制定本行业、本领域关键信息基础设施安全规划，明确保护目标、基本要求、工作任务、具体措施。		Article 22 The protection authorities shall work out a security plan for the critical information infrastructure of the industry or field, specifying protection objectives, basic requirements, tasks and specific measures.
第二十三条国家网信部门统筹协调有关部门建立网络安全信息共享机制，及时汇总、研判、共享、发布网络安全威胁、漏洞、事件等信息，促进有关部门、保护工作部门、运营者以及网络安全服务机构等之间的网络安全信息共享。		Article 23 The CAC shall coordinate with the relevant authorities to establish a cyber security information sharing mechanism, timely summarize, study, judge, share and release cyber security threats, vulnerabilities, incidents and other information, and promote cyber security information sharing among the relevant authorities, protection authorities, operators and cyber security service agencies.
第二十四条保护工作部门应当建立健全本行业、本领域的关键信息基础设施网络安全监测预警制度，及时掌握本行业、本领域关键信息基础设施运行状况、安全态势，预警通报网络安全威胁和隐患，指导做好安全防范工作。		Article 24 The protection authorities shall establish a sound monitoring and early warning system for the cyber security of the critical information infrastructure of the industry or field, timely learn about the operation status and security situation of the critical information infrastructure of the industry or field, give an early warning and notify threats and hazards to cyber security, and guide the security prevention work.
第二十五条保护工作部门应当按照国家网络安全事件应急预案的要求，建立健全本行业、本领域的网络安全事件应急预案，定期组织应急演练；指导运营者做好网络安全事件应对处置，并根据需要组织提供技术支持与协助。		Article 25 The protection authorities shall, in accordance with the requirements of the State emergency plan for cyber security incidents, establish the sound emergency plan for cyber security incidents of the industry or field, regularly organize emergency drills, guide the operator to respond to and deal with cyber security incidents, and organize to provide technical support and assistance as needed.
第二十六条保护工作部门应当定期组织开展本行业、本领域关键信息基础设施网络安全检查检测，指导监督运营者及时整改安全隐患、完善安全措施。		Article 26 The protection authorities shall regularly organize inspections and testing of the cyber security of the critical information infrastructure of the industry or field, and guide and supervise the operator to promptly rectify potential security risks and improve security measures.
第二十七条国家网信部门统筹协调国务院公安部门、保护工作部门对关键信息基础设施进行网络安全检查检测，提出改进措施。有关部门在开展关键信息基础设施网络安全检查时，应当加强协同配合、信息沟通，避免不必要的检查和交叉重复检查。检查工作不得收取费用，不得要求被检查单位购买指定品牌或者指定生产、销售单位的产品和服务。		Article 27 The CAC shall coordinate with the public security department under the State Council and the protection authorities to inspect and test cyber security of the critical information infrastructure and propose improvement measures. When carrying out inspections of the cyber security of the critical information infrastructure, relevant authorities shall strengthen cooperation and information communication to avoid unnecessary inspections and cross and repeated inspections. No fees shall be charged for the inspections, and the inspected entities shall not be required to purchase the products or services of designated brands or designated manufacturers or sellers.
第二十八条运营者对保护工作部门开展的关键信息基础设施网络安全检查检测工作，以及公安、国家安全、保密行政管理、密码管理等有关部门依法开展的关键信息基础设施网络安全检查工作应当予以配合。		Article 28 Operators shall cooperate with the inspections and testing of the cybersecurity of the critical information infrastructure carried out by the protection authorities, and the inspections of the cybersecurity of the critical information infrastructure carried out by the public security department, State security department, secrecy administration, password administration and other relevant authorities in accordance with the law.
第二十九条在关键信息基础设施安全保护工作中，国家网信部门和国务院电信主管部门、国务院公安部门等应当根据保护工作部门的需要，及时提供技术支持和协助。		Article 29 The CAC, the competent telecommunications department of the State Council and the public security department under the State Council shall, in accordance with the needs of the protection authorities, provide technical support and assistance in a timely manner during the protection of the security of the critical information infrastructure.
第三十条网信部门、公安机关、保护工作部门等有关部门，网络安全服务机构及其工作人员对于在关键信息基础设施安全保护工作中获取的信息，只能用于维护网络安全，并严格按照有关法律、行政法规的要求确保信息安全，不得泄露、出售或者非法向他人提供。		Article 30 The CAC, public security organs, protection authorities and other relevant authorities, cyber security service agencies and the staff thereof shall use the information acquired in the protection of the security of the critical information infrastructure only for the purpose of maintaining cyber security, and the security of such information shall be ensured in strict accordance with the requirements of relevant laws and administrative regulations, and such information shall not be divulged, sold or illegally provided to others.
第三十一条未经国家网信部门、国务院公安部门批准或者保护工作部门、运营者授权，任何个人和组织不得对关键信息基础设施实施漏洞探测、渗透性测试等可能影响或者危害关键信息基础设施安全的活动。对基础电信网络实施漏洞探测、渗透性测试等活动，应当事先向国务院电信主管部门报告。		Article 31 Without the approval of the CAC and the public security department under the State Council or the authorization of the protection authorities or an operator, no individual or organization may carry out vulnerability testing, penetration testing and other activities that may affect or endanger the security of the critical information infrastructure. Before carrying out vulnerability testing, penetration testing and other activities on the basic telecommunications network, it is required to report to the competent telecommunications department under the State Council in advance.
第三十二条国家采取措施，优先保障能源、电信等关键信息基础设施安全运行。能源、电信行业应当采取措施，为其他行业和领域的关键信息基础设施安全运行提供重点保障。		Article 32 The State takes measures to give priority to the safe operation of critical information infrastructure such as energy and telecommunications. Energy and telecommunications industries shall take measures to give priority to the safe operation of critical information infrastructure in other industries and fields.
第三十三条公安机关、国家安全机关依据各自职责依法加强关键信息基础设施安全保卫，防范打击针对和利用关键信息基础设施实施的违法犯罪活动。		Article 33 Public security organs and State security organs shall, ex officio, strengthen the security protection of critical information infrastructure in accordance with the law, and prevent and crack down on illegal and criminal activities against the critical information infrastructure and illegal and criminal activities by using the aforesaid information.
第三十四条国家制定和完善关键信息基础设施安全标准，指导、规范关键信息基础设施安全保护工作。		Article 34 The State formulates and improves the security standards for critical information infrastructure, guides and regulates the protection of the security of critical information infrastructure.
第三十五条国家采取措施，鼓励网络安全专门人才从事关键信息基础设施安全保护工作；将运营者安全管理人员、安全技术人员培训纳入国家继续教育体系。		Article 35 The State takes measures to encourage specialized cyber security talent to engage in the protection of the security of critical information infrastructure and includes the training of security management personnel and security technicians of the operator in the national continuing education system.
第三十六条国家支持关键信息基础设施安全防护技术创新和产业发展，组织力量实施关键信息基础设施安全技术攻关。		Article 36 The State supports technological innovation and industrial development in respect of security protection for critical information infrastructure and organizes efforts to make technological breakthroughs in respect of security protection for critical information infrastructure.
第三十七条国家加强网络安全服务机构建设和管理，制定管理要求并加强监督指导，不断提升服务机构能力水平，充分发挥其在关键信息基础设施安全保护中的作用。		Article 37 The State strengthens the construction and management of cyber security service agencies, formulates administrative requirements and reinforces supervision and guidance, constantly improves the capability of service agencies, and gives full play to their role in the protection of the security of critical information infrastructure.
第三十八条国家加强网络安全军民融合，军地协同保护关键信息基础设施安全。		Article 38 The State strengthens military and civilian integration of cyber security and protects the security of critical information infrastructure through military-civilian collaboration.
第五章法律责任		Chapter V Legal Liability
第三十九条运营者有下列情形之一的，由有关主管部门依据职责责令改正，给予警告；拒不改正或者导致危害网络安全等后果的，处10万元以上100万元以下罚款，对直接负责的主管人员处1万元以上10万元以下罚款：（一）在关键信息基础设施发生较大变化，可能影响其认定结果时未及时将相关情况报告保护工作部门的；（二）安全保护措施未与关键信息基础设施同步规划、同步建设、同步使用的；（三）未建立健全网络安全保护制度和责任制的；（四）未设置专门安全管理机构的；（五）未对专门安全管理机构负责人和关键岗位人员进行安全背景审查的；（六）开展与网络安全和信息化有关的决策没有专门安全管理机构人员参与的；（七）专门安全管理机构未履行本条例第十五条规定的职责的；（八）未对关键信息基础设施每年至少进行一次网络安全检测和风险评估，未对发现的安全问题及时整改，或者未按照保护工作部门要求报送情况的；（九）采购网络产品和服务，未按照国家有关规定与网络产品和服务提供者签订安全保密协议的；（十）发生合并、分立、解散等情况，未及时报告保护工作部门，或者未按照保护工作部门的要求对关键信息基础设施进行处置的。		Article 39 For an operator falling under any of the following circumstances, the competent authorities shall order it to make corrections and give it a warning ex officio. In case of refusal to make corrections or resulting in such consequence as endangering cyber security, it shall be subject to a fine of not less than 100,000 yuan but not more than 1 million yuan, and the person directly in charge shall be subject to a fine of not less than 10,000 yuan but not more than 100,000 yuan: (I) Failing to report relevant information to the competent protection authorities in a timely manner when the identification result may be affected due to material changes in critical information infrastructure; (II) Failing to plan, construct or put into use security protection measures and critical information infrastructure simultaneously;(III) Failing to establish a sound cyber security protection system and responsibility system;(IV) Failing to set up a specialized security management body;(V) Failing to conduct background review on the person in charge and personnel in key positions of a specialized security management body;(VI) Failing to have the personnel of a specialized security management body participate in making decisions relating to cyber security and informatization;(VII) Failing to perform the duties specified in Article 15 of these Regulations by a specialized security management body;(VIII) Failing to conduct cyber security testing and risk assessment for critical information infrastructure at least once a year, failing to make timely rectification of security problems found out, or failing to report the relevant information as required by the competent protection authorities;(IX) Failing to enter into a security confidentiality agreement with the provider of networking products or services in accordance with the relevant provisions of the State when purchasing networking products or services; or(X) Failing to report to the competent protection authorities in a timely manner in the event of merger, division or dissolution, or failing to deal with critical information infrastructure as required by the competent protection authorities.
第四十条运营者在关键信息基础设施发生重大网络安全事件或者发现重大网络安全威胁时，未按照有关规定向保护工作部门、公安机关报告的，由保护工作部门、公安机关依据职责责令改正，给予警告；拒不改正或者导致危害网络安全等后果的，处10万元以上100万元以下罚款，对直接负责的主管人员处1万元以上10万元以下罚款。		Article 40 For any operator failing to report to the competent protection authorities or the public security organ as required when a major cybersecurity incident occurs or a major cybersecurity threat is discovered with respect to critical information infrastructure, the competent protection authorities or the public security organ shall, ex officio, order it to make rectifications and give it a warning; in case of refusal to make rectifications or resulting in such consequence as endangering cybersecurity, a fine of not less than 100,000 yuan but not more than 1 million yuan shall be imposed on it, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the person directly in charge of the operator.
第四十一条运营者采购可能影响国家安全的网络产品和服务，未按照国家网络安全规定进行安全审查的，由国家网信部门等有关主管部门依据职责责令改正，处采购金额1倍以上10倍以下罚款，对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款。		Article 41 For an operator failing to conduct security review in accordance with the provisions on cybersecurity of the State when purchasing networking products or services that may affect national security, the CAC and other competent authorities shall, ex officio, order it to make rectifications, impose a fine of not less than one time but not more than ten times the purchase amount on it, and impose a fine of not less than 10,000 yuan but not more than 100,000 yuan on the person directly in charge and other persons directly liable.
第四十二条运营者对保护工作部门开展的关键信息基础设施网络安全检查检测工作，以及公安、国家安全、保密行政管理、密码管理等有关部门依法开展的关键信息基础设施网络安全检查工作不予配合的，由有关主管部门责令改正；拒不改正的，处5万元以上50万元以下罚款，对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款；情节严重的，依法追究相应法律责任。		Article 42 Where an operator refuses to cooperate with the inspection and testing of the cybersecurity of the critical information infrastructure carried out by the protection authorities, or refuses to cooperate with the inspection and testing of the cybersecurity of the critical information infrastructure carried out by the public security, national security, secrecy administration, password administration and other relevant authorities in accordance with the law, the competent authorities shall order it to make rectifications. If it refuses to make rectifications, a fine of not less than 50,000 yuan but not more than 500,000 yuan will be imposed, and a fine of not less than 10,000 yuan but not more than 100,000 yuan will be imposed on the person directly in charge and other persons directly liable. In a serious case, the operator shall be investigated for corresponding legal liability in accordance with the law.
第四十三条实施非法侵入、干扰、破坏关键信息基础设施，危害其安全的活动尚不构成犯罪的，依照《中华人民共和国网络安全法》有关规定，由公安机关没收违法所得，处5日以下拘留，可以并处5万元以上50万元以下罚款；情节较重的，处5日以上15日以下拘留，可以并处10万元以上100万元以下罚款。单位有前款行为的，由公安机关没收违法所得，处10万元以上100万元以下罚款，并对直接负责的主管人员和其他直接责任人员依照前款规定处罚。违反本条例第五条第二款和第三十一条规定，受到治安管理处罚的人员，5年内不得从事网络安全管理和网络运营关键岗位的工作；受到刑事处罚的人员，终身不得从事网络安全管理和网络运营关键岗位的工作。		Article 43 Whoever illegally intrudes into, interferes with or destroys critical information infrastructure, which endangers the security of such infrastructure, but does not constitute a crime, the public security organ concerned shall, in accordance with the Cybersecurity Law of the People’s Republic of China, confiscate his/her illegal gains, detain him/her for not more than five days, and may jointly impose a fine of not less than 50,000 yuan but not more than 500,000 yuan on him/her; if the circumstances are relatively serious, the public security organ concerned shall detain him/her for not less than five days but not more than 15 days, and impose a fine of not less than 100,000 yuan but not more than 1 million yuan on him/her. Where an entity commits any of the acts prescribed in the preceding paragraph, the public security organ concerned shall confiscate its illegal gains, impose a fine of not less than 100,000 yuan but not more than 1 million yuan on it, and punish the person directly in charge and other persons directly liable in accordance with the provisions of the preceding paragraph. Whoever violates the provisions of Paragraph 2 of Article 5 and Article 31 hereof and is subject to public security administrative penalties shall not hold key posts of cyber security management and network operation for five years, and whoever is subject to criminal penalties shall not hold key posts of cyber security management and network operation for life.
第四十四条网信部门、公安机关、保护工作部门和其他有关部门及其工作人员未履行关键信息基础设施安全保护和监督管理职责或者玩忽职守、滥用职权、徇私舞弊的，依法对直接负责的主管人员和其他直接责任人员给予处分。		Article 44 Where a cyberspace administration, public security organ, protection authorities or any other relevant authority, as well as their staff, fail to perform their duties of protecting, supervising and administering the security of critical information infrastructure, neglects their duties, abuses their powers, or plays favoritism and commits irregularities, the person directly in charge and other persons directly liable shall be punished in accordance with the law.
第四十五条公安机关、保护工作部门和其他有关部门在开展关键信息基础设施网络安全检查工作中收取费用，或者要求被检查单位购买指定品牌或者指定生产、销售单位的产品和服务的，由其上级机关责令改正，退还收取的费用；情节严重的，依法对直接负责的主管人员和其他直接责任人员给予处分。		Article 45 In conducting a cybersecurity inspection of critical information infrastructure, where a public security organ, protection authorities or any other relevant authority charges fees, or requires the inspection object to purchase products or services of designated brands or designated production or sales entities, the superior organ shall order it to make corrections and to return the fees collected; if the circumstances are serious, the person directly in charge and other persons directly liable shall be punished in accordance with the law.
第四十六条网信部门、公安机关、保护工作部门等有关部门、网络安全服务机构及其工作人员将在关键信息基础设施安全保护工作中获取的信息用于其他用途，或者泄露、出售、非法向他人提供的，依法对直接负责的主管人员和其他直接责任人员给予处分。		Article 46 Where a cyberspace administration, public security organ, protection authority or any other relevant department, a cyber security service agency and any staff thereof use the information acquired in the security protection of critical information infrastructure for any other purpose, or divulge, sell or illegally provide such information to others, the person directly in charge and other persons directly liable shall be punished in accordance with the law.
第四十七条关键信息基础设施发生重大和特别重大网络安全事件，经调查确定为责任事故的，除应当查明运营者责任并依法予以追究外，还应查明相关网络安全服务机构及有关部门的责任，对有失职、渎职及其他违法行为的，依法追究责任。		Article 47 For a major cybersecurity incident or an extremely major cybersecurity incident occurred to critical information infrastructure, which is determined as a liability accident upon investigation, the liability of the operator shall be investigated and pursued in accordance with the law, and the liability of the relevant cyber security service agency and relevant department shall also be investigated. In the case of dereliction of duty, malpractice or other illegal acts, liability shall be pursued in accordance with the law.
第四十八条电子政务关键信息基础设施的运营者不履行本条例规定的网络安全保护义务的，依照《中华人民共和国网络安全法》有关规定予以处理。		Article 48 The operator of a critical information infrastructure for e-government failing to perform the cybersecurity protection obligation as stipulated in these regulations shall be punished in accordance with the relevant provisions of the Cybersecurity Law of the People’s Republic of China.
第四十九条违反本条例规定，给他人造成损害的，依法承担民事责任。违反本条例规定，构成违反治安管理行为的，依法给予治安管理处罚；构成犯罪的，依法追究刑事责任。		Article 49 Whoever violates the provisions of these Regulations, causing damage to others, shall bear civil liability in accordance with the law. Whoever violates the provisions of these Regulations, constituting a violation of public security administration, shall be imposed a penalty for public security administration in accordance with the law and, if a crime is constituted, be investigated for criminal liability in accordance with the law.
第六章附则		Chapter VI Supplementary Provisions
第五十条存储、处理涉及国家秘密信息的关键信息基础设施的安全保护，还应当遵守保密法律、行政法规的规定。关键信息基础设施中的密码使用和管理，还应当遵守相关法律、行政法规的规定。		Article 50 The protection of the security of storage and processing of any critical information infrastructure involving State secrets shall also be subject to the laws and administrative regulations on confidentiality. The password use and management for a critical information infrastructure shall also be governed by the provisions of the relevant laws and administrative regulations.
第五十一条本条例自2021年9月1日起施行。		Article 51 These regulations shall come into force as of September 1, 2021.