MLPS 2.0 Checklist (等保 2.0)

China's Cybersecurity Law requires network operators to protect their systems under the Multi-Level Protection Scheme. In practice that means grading each system, filing with the public security bureau for level two and above, passing an assessment by a licensed body (测评机构), and fixing what it finds. Teams lose months by grading wrongly or arriving at the assessment with gaps they could have closed. This skill prepares the grading argument, the filing, and the gap list before the assessor arrives.

Write in Simplified Chinese unless asked otherwise. This is preparation, not certification: grading is confirmed through expert review and the public security bureau, and only a licensed assessor can assess. Check current requirements with the local 网安部门 and the assessor.

Required Inputs

Ask for these if not provided:

• The system: what it does, users, data it holds (including personal and important data), and whether it serves the public
• Impact if compromised: on individuals, organisations, social order or national security, and how severe
• Architecture: hosting (own data centre or cloud, and the cloud's own MLPS level), network zones, key components
• Existing controls and policies, and any previous assessment reports
• Deadline driving the work (a tender, a regulator, a customer)

Output Structure

1. Grading (定级)

The recommended level (1 to 5; most business systems land at 2 or 3) with the reasoning on the two factors the standard uses: the object harmed and the degree of harm, separately for business information security and system service security. Written as the 定级报告 argument for expert review.