On 8 December 2023 the Cyberspace Administration of China published the Measures for the Reporting of Cybersecurity Incidents (Draft for Comment) for public consultation. The draft contains fourteen articles, turning incident reporting from a principle into a procedure with a responsible party, a deadline and required content.
The most discussed element is the one-hour deadline. For most companies, the hour does not run from the first anomaly but from confirmation of the incident level. The real difficulty is completing assessment, decision-making and external reporting within that hour.
Who reports
The draft applies to network operators. On the occurrence of a cybersecurity incident, the operator should promptly activate its emergency plan. Where the incident is major, serious or especially serious under the Incident Classification Guidelines, it should be reported within one hour.
The recipient depends on the entity: central and state organs and their affiliated units report to their own cyberspace work office; other operators generally report to the local cyberspace administration. Where critical information infrastructure is involved, reports must also go to the protection department and public security authorities.
What to report
A report is not a sentence saying “we were attacked”. It normally states when the incident occurred and was discovered, the scope of impact, affected systems and data, measures taken, current status, estimated recovery time and whether external support is needed.
Such information is often incomplete at the outset. The requirement is not to wait until everything is clear, but to report what is known and supplement later. Companies need a first report, follow-up reports and a final report, rather than a single submission.
The practical challenge of one hour
First, assessment. What counts as “major”? The guidelines provide indicators, but real judgment requires technology, business and legal teams. Without pre-defined criteria, debates consume the hour.
Second, decision. Who may confirm the level, who may report externally and who communicates with regulators must be written into the plan. Looking for people after an incident wastes half the time.
Third, evidence. Report content must be consistent with logs, monitoring and tickets. Without retention habits, hastily assembled reports contradict themselves.
How to revise the emergency plan
First, write classification criteria into the plan. Map the company’s systems, data and business to specific levels under the guidelines to reduce on-the-spot judgment.
Second, appoint reporting officers: a primary reporter, a backup and an external communications lead, reachable 24/7.
Third, prepare templates for first, follow-up and final reports, with mandatory fields and common questions, so the team does not draft from scratch during an incident.
Fourth, run a drill. The point is to test whether assessment, approval and reporting can be completed within an hour, whether the report matches the logs and whether external communication works.
Fifth, keep records of reporting time, recipient, content and updates. These are both compliance evidence and the basis for review.
Relationship with graded protection and data security
Incident reporting is not isolated. It connects with cybersecurity graded protection, data-security risk assessment and personal-information breach notification. One incident may trigger several reporting duties, so companies should build a unified incident-response matrix to avoid duplication or omission.
For cybersecurity systems and incident response, see our cybersecurity compliance service; for data breaches and personal information, see data compliance; for implementation and ongoing support, see annual legal counsel.
This article is based on the Measures for the Reporting of Cybersecurity Incidents (Draft for Comment) published for public consultation by the Cyberspace Administration of China on 8 December 2023. It is for reference only and does not constitute legal advice.