Recently, the China Securities Regulatory Commission officially issued the "Measures for the Management of Network and Information Security in the Securities and Futures Industry" (hereinafter referred to as the "Measures"). The "Measures" will be officially implemented on May 1, 2023.
In order to effectively implement the relevant requirements of the "Cybersecurity Law", "Data Security Law", "Personal Information Protection Law" and "Critical Information Infrastructure Security Protection Regulations", standardize the network and information security management of the securities and futures industry, and prevent and resolve industry network and information security risks, To maintain the safe, stable and efficient operation of the capital market, the China Securities Regulatory Commission has formulated and issued this "Measures".
From April 29, 2022 to May 29, 2022, the China Securities Regulatory Commission will publicly solicit opinions from the public on the draft "Measures". Overall, all parties have a high degree of recognition of the drafting ideas and main contents of the draft Measures. After careful study, the China Securities Regulatory Commission has adopted some of these opinions.
The "Measures" focus on the field of network and information security, and on the basis of summarizing practical experience, clarify the path for the implementation of higher-level laws in the securities and futures industry. The "Measures" comprehensively cover all types of entities, including securities and futures critical information infrastructure operators, core institutions, operating institutions, information technology system service institutions, etc., with security assurance as the basic principle, and put forward normative requirements for network and information security management, mainly Content includes: network and information security operation, investor personal information protection, network and information security emergency response, critical information infrastructure security protection, network and information security promotion and development, supervision and management and legal liability, etc.
The China Securities Regulatory Commission stated that it will organize relevant special trainings and continue to supervise and implement them. Reference entities stipulated in the "Measures" do not need to submit the annual network and information security management report stipulated in Article 59 of the "Measures". Regarding the implementation of data backup obligations stipulated in Article 20 of the Measures with reference to applicable entities, the China Securities Regulatory Commission will guide relevant industry associations to further refine the relevant requirements.
