People's Republic of China Computer Information System Security Protection Regulations

Chapter 1 General Provisions

Article 1 These Regulations are formulated in order to protect the security of computer information systems, promote the application and development of computers, and ensure the smooth progress of socialist modernization.

Article 2 The computer information system referred to in these Regulations refers to the computer, its related and supporting equipment and facilities (including the network). It collects, processes, stores and transmits information in accordance with certain application objectives and rules. , search and other processing of human-computer systems.

Article 3 The security protection of computer information systems shall ensure the security of computers and their related and supporting equipment and facilities (including networks), the safety of the operating environment, the security of information, the normal functioning of computer functions, and the maintenance of computers. The safe operation of the information system.

Article 4 The work of computer information system security protection focuses on the security of computer information systems in important fields such as national affairs, economic construction, national defense construction, and cutting-edge science and technology.

Article 5 This Regulation shall apply to the security protection of computer information systems within the territory of the People's Republic of China.

The security protection measures for non-networked microcomputers will be formulated separately.

Article 6 The Ministry of Public Security shall be responsible for the protection of computer information system security throughout the country. The Ministry of National Security, the State Secrecy Bureau and other relevant departments of the State Council shall do a good job in the protection of computer information systems within the scope of their duties as prescribed by the State Council.

Article 7 Any organization or individual may not use the computer information system to engage in activities that endanger the interests of the state, the collective, or citizens, and may not endanger the security of computer information systems.

Chapter II Security Protection System

Article 8 The construction and application of computer information systems shall comply with laws, administrative regulations and other relevant national regulations.

Article 9 The computer information system implements security level protection. The specific criteria for the classification of safety grades and the protection of safety grades shall be formulated by the Ministry of Public Security in conjunction with relevant departments.

Article 10 The computer room shall comply with the national standards and relevant state regulations. The construction near the computer room shall not endanger the security of the computer information system.

Article 11 The computerized information system for international networking shall be reported to the public security organ of the people's government at or above the provincial level for the record by the user of the computer information system.

Article 12 When transporting, carrying, or mailing computer information media into or out of the country, it shall report to the customs truthfully.

Article 13 The user of a computer information system shall establish a sound safety management system and be responsible for the safety protection of his computer information system.

Article 14 In case of a case occurring in a computer information system, the relevant use unit shall report to the local public security organ at or above the county level within 24 hours.

Article 15 The research work on the prevention and control of computer viruses and other harmful data that jeopardize public social security shall be under the centralized management of the Ministry of Public Security.

Article 16 The State shall implement a licensing system for the sale of special products for the security of computer information systems. The specific measures shall be formulated by the Ministry of Public Security in conjunction with relevant departments.

Chapter III Safety Supervision

Article 17 Public security agencies exercise the following supervisory functions in the protection of computer information systems:

(1) Supervising, inspecting and supervising the work of computer information system security protection;

(2) Investigating criminal cases that violate the security of computer information systems;

(3) Performing other supervisory responsibilities for the work of protecting computer information systems.

Article 18 When a public security agency discovers a hidden danger affecting the security of a computer information system, it shall promptly notify the user to take safety protection measures.

Article 19 The Ministry of Public Security may, in an emergency, issue a special order for specific matters involving the security of computer information systems.

Chapter IV Legal Liability

Article 20 Where any of the following acts is violated in violation of the provisions of these Regulations, the public security agency shall issue a warning or stop the rectification:

(1) Violating the protection system of computer information system security level and endangering the security of computer information system;

(2) Violating the international network filing system of computer information systems;

(3) failing to report the cases occurring in the computer information system in accordance with the prescribed time;

(4) After receiving a notice from the public security agency requesting improvement of the security situation, it refuses to improve within the time limit;

(5) Other acts that endanger the safety of computer information systems.

Article 21 Where the computer room does not comply with the national standards and other relevant national regulations, or if the construction of computer information systems in the vicinity of the computer room is hazardous to the safety of the computer information system, the public security organs shall deal with the relevant units.

Article 22 If the transport, porting, or mailing of computer information media to or from the country fails to report to the customs according to the facts, the customs shall handle it in accordance with the provisions of the "Customs Law of the People's Republic of China", this Regulation, and other relevant laws and regulations.

Article 23 If a computer virus or other harmful data is intentionally entered into the computer information system, or if the computer information system security product is sold without permission, the public security organ shall issue a fine of 5,000 yuan or less to the individual or impose a fine on the individual. A fine of no more than 15,000 yuan shall be imposed; if there is any illegal income, except for the forfeiture, a fine of 1 to 3 times the illegal income may be imposed.

Article 24 Whoever violates the provisions of these Regulations and constitutes a violation of public security management shall be punished in accordance with the relevant provisions of the Regulations of the People's Republic of China on Public Security Administration Punishment. If a crime is constituted, criminal responsibility shall be investigated according to law.

Article 25 Any organization or individual who violates the provisions of these Regulations and causes losses to the state, collectives, or other people's property shall bear civil liability according to law.

Article 26 Where the parties are dissatisfied with the specific administrative actions taken by the public security organ in accordance with these Regulations, they may apply for administrative review or file an administrative lawsuit according to law.

Article 27 If a state public servant who implements these Regulations uses his powers to demand, accept or accept bribery or have other illegal or negligent conduct, which constitutes a crime, he shall be investigated for criminal responsibility according to law; if he or she does not commit a crime, he shall be given administrative sanctions.

Chapter 5 Supplementary Provisions

Article 28 The meaning of the following terms in these regulations:

Computer virus refers to a set of computer instructions or program code that is programmed or inserted into a computer program to destroy the function of the computer or destroy the data, affect the use of the computer, and enable self-replication.

Computer information system security special products refer to special hardware and software products used to protect the security of computer information systems.

Article 29 The work of protecting the computer information system security of the military shall be carried out in accordance with the relevant laws and regulations of the military.

Article 30 The Ministry of Public Security may formulate enforcement measures in accordance with these Regulations.

Article 31 This Regulation shall come into force as of the date of promulgation.