National Cybersecurity Incident Reporting Measures effective 1 Nov 2025 (CAC)

CAC published the full text of the 国家网络安全事件报告管理办法 on 15 September 2025 (document dated 11 September 2025). Article 14 states the measures take effect on 1 November 2025. The page we opened on 20 September 2026 includes the operative articles and the annexed 网络安全事件分级指南.

Reporting clocks (Article 4)

When an operator discovers or learns of a cybersecurity incident affecting its systems and grades it 较大以上 (larger or above) under the guide:

• Critical information infrastructure: report to the protection department and public security immediately, no later than 1 hour. For 重大 / 特别重大 incidents, the protection department must escalate to national CAC and the Ministry of Public Security within 30 minutes.
• Central/state organs and direct units: report to the department’s cyberspace office within 2 hours; major/particularly major escalate to national CAC within 1 hour.
• Other network operators: report to the provincial cyberspace department within 4 hours; major/particularly major escalate from provincial to national CAC within 1 hour.

Article 7 lists required report fields (entity, time/place/type/level, impact, measures, cause hypothesis, forensics clues, requested support, site protection). Article 8 requires a disposition summary within 30 days after handling ends. Article 9 establishes the 12387 reporting channels.

What this is not

This is a statutory reporting procedure, not a breach notification template for every PIPL individual notice, and not evidence that any named game or MMP already filed under the new clocks. The commission shorthand “tiered 1–4 hour timelines” matches the 1-hour (CII), 2-hour (central organs) and 4-hour (other operators) outer bounds for larger-or-above incidents—not a single uniform four-hour rule for every entity.

Operator action

Download the measures card. Preserve November 2025 as the effective date when citing this rule later.

Research checked 20 September 2026. Local draft; human editorial review pending.