China MLPS 2.0 (GB/T 22239-2019)
How ISMS Copilot helps you work with China's Multi-Level Protection Scheme: the Cybersecurity Law duties, the five levels, filing and assessment basics.
China's Multi-Level Protection Scheme (网络安全等级保护制度, MLPS), called "MLPS 2.0" since the 2019 standard generation, is the legally mandated graded-protection regime for network operators in China. ISMS Copilot helps you understand the scheme, prepare the grading and filing work, and draft the evidence, in Chinese or English.
The scheme's statutory basis is the Cybersecurity Law Article 23 (Article 21 before the 2025 revision that took effect 1 January 2026). The baseline standard is GB/T 22239-2019 (issued 10 May 2019, in force 1 December 2019), with GB/T 25070-2019 (security design) and GB/T 28448-2019 (assessment requirements) alongside. This page is documentation support, not legal advice, and the standards' requirement text is copyrighted, so we summarize structure and duties only.
How the scheme works
- Who is in scope: network operators in China, including Chinese subsidiaries of foreign groups. Critical information infrastructure operators carry heavier duties on top (Cybersecurity Law Articles 33-41).
- Five levels: systems are graded from level 1 to 5. The grade drives the baseline that applies, the filing obligation with the public security organs, and the assessment expectations. Which grade a specific system needs is a grading exercise against the scheme's rules, not something to guess.
- Filing (备案): operators at level 2 and above file with the public-security organ at prefecture-level city or above (the MPS implementing rules; a few sector cases file elsewhere). The practical steps are set by public-security implementing rules.
- Assessment (测评): graded systems are assessed against GB/T 28448-2019; the assessment result is the evidence a regulator or a Chinese customer will ask for.
- Penalties: failing the graded-protection duties is sanctionable under Cybersecurity Law Article 61 (Article 59 before the renumbering): fines from CNY 10,000 up to CNY 500,000 for ordinary operators and up to CNY 10,000,000 for the most serious critical-infrastructure failures after the 2026 revision (checked October 2026).
How ISMS Copilot helps
- Explain the scheme in plain words: levels, filing, assessment, and where the 2025 Cybersecurity Law revision changed numbering or penalties.
- Draft the grading-report supporting material, management documents, and the internal policies the scheme expects (access control, logging, incident response).
- Map your existing ISO 27001 controls onto the MLPS expectation areas to find gaps before an assessment, at control-intent level.
- Answer in Chinese when your team and the filing authority work in Chinese.
ISO 27001 certification does not replace MLPS grading and filing: they are different instruments. The Chinese national adoption of ISO/IEC 27001 (the ISMS requirements standard) is GB/T 22080-2025, in force 1 January 2026, replacing the 2016 edition.
Where MLPS sits with the rest of the China stack
The Cybersecurity Law makes MLPS compliance a legal duty; the Data Security Law adds the important-data regime; PIPL covers personal data. See the China PIPL page, Using ISMS Copilot from China, and the China region page.