The Cyberspace Administration of China (CAC) released a regulation on the management of the reporting of cybersecurity incidents, which will take effect on November 1, 2025. The regulation sets requirements on the scope of applicable incidents, supervisory responsibilities, reporting entities, procedures, timelines and contents, according to a release on the CAC's official website. The new rules were formulated to standardize cybersecurity incident reporting, control damage caused by such incidents, and implement the Cybersecurity Law and the regulation for safe protection of critical information infrastructure, said an official from the CAC.
The introduction of the regulation responds to the growing frequency and severity of cybersecurity incidents in recent years, said the official. Timely reporting to relevant authorities helps ensure effective handling, prevents escalation and avoids negative social impact, the official noted. Experts said the regulation provides a standardized framework for the reporting of cybersecurity incidents, ensuring the first line of defense in cybersecurity can function more effectively. “The earlier and more standardized a cybersecurity incident is reported, the sooner professional institutions can assess, take action and respond, addressing problems at an early stage to reduce risks,” Xiang Ligang, Director General of the Beijing-based Information Consumption Alliance, told the Global Times. With cybersecurity becoming increasingly critical, establishing mechanisms and rules for standardized management is essential. The regulation gives clearer reporting procedures and guidance, making the process more unified and efficient, Xiang noted.
“One of the most important aspects of reporting cybersecurity incidents is information sharing. Because the internet is interconnected, a security incident in one area can affect other networks or serve as a warning. Timely reporting enables the state to handle issues more effectively and prevent losses from expanding, minimizing damage as quickly as possible,” Xie Yongjiang, Professor at the Beijing University of Posts and Telecommunications, told the Global Times. In recent years, the U.S., the EU, Australia and India have all enacted legislation or issued directives imposing mandatory reporting on network operators, including specified reporting deadlines. The regulation applies to network operators engaged in building, operating or providing services within China, the Global Times reports.
