Governance

Governance, Risk & Legal

Navigating the "Regulatory Jungle". From the Constitution to Financial Standards (JR/T).

China Regulatory Landscape

The "Three Pillars" of China's cybersecurity law interact to form a complex compliance matrix.

Select a law to view specific compliance requirements and technical controls.

Focus: Critical Information Infrastructure (CII)

Network Real-name Identity

Log Retention (> 6 months)

CII Protection Levels

Incident Reporting

Regulatory Authority: CAC (Cyberspace Administration of China)

Strategy

Policy

Standard

Procedure

Guideline

Policies are "Laws" (Mandatory). Guidelines are "Advice" (Optional).
Don't mix them up.

Focuses on the Individual's Rights.
Key questions: "Do we have consent?", "Can they delete it?"
Tool: PIPL, GDPR

Focuses on the Asset's Confidentiality.
Key questions: "Is it encrypted?", "Who has access?"
Tool: AES-256, IAM

"You can have security without privacy, but you cannot have privacy without security."

Beyond national laws (CSL), financial institutions face stricter constraints defined by the PBOC (People's Bank of China) via JR/T standards.

Financial Industry Information System Security Protection Guidelines.

Financial Data Security Guidelines (Data Lifecycle focus).

PCI-DSS equivalent standards for payment processing systems.