On February 26th, the Ministry of Industry and Information Technology of China unveiled the Implementation Plan for Improving Data Security Capabilities in the Industrial Sector (2024-2026) (hereinafter referred to as the Implementation Plan). This strategic initiative is crafted in response to evolving legislative and regulatory mandates concerning data security within the industrial domain. Structured into three core components—general mandates, pivotal tasks, and auxiliary measures—the Implementation Plan endeavors to fortify data security within the industrial sector by delineating specific responsibilities for various stakeholders, including industrial entities, regulatory bodies, and data security service providers. Here’s a condensed overview tailored for international stakeholders:
- End-of-2026 Objectives:
- Heightened Enterprise Awareness: The plan advocates for the dissemination of data securityrequirements among sizable enterprises across diverse industrial realms.
- Securing Key Enterprises: A focal point is to safeguard data integrity for key enterprises and those whose scales surpass predefined thresholds. This entails implementing classified and graded data protection measures for over 45,000 enterprises, particularly targeting the top 10% of industrial enterprises above designated size in the provinces (autonomous regions and municipalities), calculated by their annual turnover.
- Standards Formulation: A commitment is made to formulatecomprehensive standards and conclude best practices, encompassing over 100 national, sector, or association standards, along with cataloging 200 exemplary cases across ten pivotal industries.
- Capacity Building: Prioritizing education and training initiatives, the aim is to empower more than 30,000 individuals and 5,000 professionals in data security practices.
- Key Tasks:
- For Industrial Enterprises: Emphasizing responsibility, the plan mandates that enterprises, especially those handling critical data, assume primary accountability for data management. Regulators will collaborate in defining data categories and providing guidance on protective measures.
- For Regulators: Regulatory bodies are tasked with bolstering surveillance capabilities through standardization efforts, dedicated actions, emergency preparedness, platform development, toolkit creation, and workforce augmentation.
- For Data Security Providers: Ensuring the availability ofeffective products and services to meet industrial data security demands is highlighted.
- Auxiliary measures: Government initiatives encompass coordination among diverse administrative tiers, resource allocation, ongoing evaluations, as well as public outreach and guidance efforts.
As per the Implementation Plan, data security requisites may vary for different industrial entities, data types, and operational scenarios. Key enterprises are slated for heightened scrutiny and more stringent risk mitigation protocols. Consequently, international stakeholders are advised to closely monitor forthcoming standards and official directives from the Chinese government to align with evolving data security mandates.
