KYB CHINA(1999年10月7日中华人民共和国国务院令第273号发布 2023年4月27日中华人民共和国国务院令第760号修订)
(Issued by Decree No. 273 of the State Council of the People's Republic of China on October 7, 1999, and revised by Decree No. 760 of the State Council of the People's Republic of China on April 27, 2023)
总 则
General Provisions
为了规范商用密码应用和管理，鼓励和促进商用密码产业发展，保障网络与信息安全，维护国家安全和社会公共利益，保护公民、法人和其他组织的合法权益，根据《中华人民共和国密码法》等法律，制定本条例。
This Regulation is formulated in accordance with the Cryptography Law of the People's Republic of China and other laws, with a view to regulating the application and administration of commercial cryptography, encouraging and promoting the development of the commercial cryptography industry, ensuring network and information security, safeguarding national security and public interests, and protecting the legitimate rights and interests of citizens, legal persons, and other organizations.
在中华人民共和国境内的商用密码科研、生产、销售、服务、检测、认证、进出口、应用等活动及监督管理，适用本条例。
This Regulation applies to activities such as scientific research, production, sale, service, testing, certification, import and export, and application of commercial cryptography within the territory of the People's Republic of China, as well as the supervision and administration thereof.
本条例所称商用密码，是指采用特定变换的方法对不属于国家秘密的信息等进行加密保护、安全认证的技术、产品和服务。
For the purposes of this Regulation, "commercial cryptography" refers to technologies, products, and services that use specific transformation methods to provide encryption protection and security authentication for information that is not classified as state secrets.
坚持中国共产党对商用密码工作的领导，贯彻落实总体国家安全观。国家密码管理部门负责管理全国的商用密码工作。县级以上地方各级密码管理部门负责管理本行政区域的商用密码工作。
The leadership of the Communist Party of China over commercial cryptography work shall be upheld, and the holistic approach to national security shall be implemented. The national cryptography administration department shall be responsible for administering commercial cryptography nationwide. The cryptography administration departments at or above the county level shall be responsible for administering commercial cryptography within their respective administrative regions.
网信、商务、海关、市场监督管理等有关部门在各自职责范围内负责商用密码有关管理工作。
The cyberspace administration, commerce, customs, market regulation, and other relevant departments shall be responsible for the relevant administration of commercial cryptography within their respective duties.
国家加强商用密码人才培养，建立健全商用密码人才发展体制机制和人才评价制度，鼓励和支持密码相关学科和专业建设，规范商用密码社会化培训，促进商用密码人才交流。
The State shall strengthen the cultivation of commercial cryptography professionals, establish and improve the development system and talent evaluation mechanism for commercial cryptography personnel, encourage and support the construction of cryptography-related disciplines and specialties, regulate social training in commercial cryptography, and promote the exchange of commercial cryptography professionals.
各级人民政府及其有关部门应当采取多种形式加强商用密码宣传教育，增强公民、法人和其他组织的密码安全意识。
People's governments at all levels and their relevant departments shall adopt various forms to strengthen the publicity and education of commercial cryptography, and enhance the cryptography security awareness of citizens, legal persons, and other organizations.
商用密码领域的学会、行业协会等社会组织依照法律、行政法规及其章程的规定，开展学术交流、政策研究、公共服务等活动，加强学术和行业自律，推动诚信建设，促进行业健康发展。
Social organizations such as societies and industry associations in the field of commercial cryptography shall, in accordance with laws, administrative regulations, and their articles of association, carry out activities such as academic exchanges, policy research, and public services, strengthen academic and industry self-discipline, promote integrity building, and facilitate the healthy development of the industry.
密码管理部门应当加强对商用密码领域社会组织的指导和支持。
The cryptography administration department shall strengthen guidance and support for social organizations in the field of commercial cryptography.
科技创新与标准化
Scientific and Technological Innovation and Standardization
国家建立健全商用密码科学技术创新促进机制，支持商用密码科学技术自主创新，对作出突出贡献的组织和个人按照国家有关规定予以表彰和奖励。
The State shall establish and improve a mechanism to promote scientific and technological innovation in commercial cryptography, support independent innovation in commercial cryptography science and technology, and commend and reward organizations and individuals that have made outstanding contributions in accordance with relevant State regulations.
国家依法保护商用密码领域的知识产权。从事商用密码活动，应当增强知识产权意识，提高运用、保护和管理知识产权的能力。
The State shall protect intellectual property rights in the field of commercial cryptography in accordance with the law. Entities engaged in commercial cryptography activities shall enhance their awareness of intellectual property rights and improve their ability to use, protect, and manage intellectual property.
国家鼓励在外商投资过程中基于自愿原则和商业规则开展商用密码技术合作。行政机关及其工作人员不得利用行政手段强制转让商用密码技术。
The State encourages technical cooperation in commercial cryptography in foreign investment based on the principle of voluntariness and commercial rules. Administrative organs and their staff shall not use administrative means to force the transfer of commercial cryptography technology.
国家鼓励和支持商用密码科学技术成果转化和产业化应用，建立和完善商用密码科学技术成果信息汇交、发布和应用情况反馈机制。
The State encourages and supports the transformation and industrial application of scientific and technological achievements in commercial cryptography, and establishes and improves mechanisms for the collection, publication, and application feedback of information on scientific and technological achievements in commercial cryptography.
国家密码管理部门组织对法律、行政法规和国家有关规定要求使用商用密码进行保护的网络与信息系统所使用的密码算法、密码协议、密钥管理机制等商用密码技术进行审查鉴定。
The national cryptography administration department shall organize the review and appraisal of commercial cryptography technologies, including cryptographic algorithms, cryptographic protocols, and key management mechanisms, used in networks and information systems that are required by laws, administrative regulations, and relevant State provisions to be protected by commercial cryptography.
国务院标准化行政主管部门和国家密码管理部门依据各自职责，组织制定商用密码国家标准、行业标准，对商用密码团体标准的制定进行规范、引导和监督。国家密码管理部门依据职责，建立商用密码标准实施信息反馈和评估机制，对商用密码标准实施进行监督检查。
The standardization administrative department of the State Council and the national cryptography administration department shall, in accordance with their respective duties, organize the formulation of national standards and industry standards for commercial cryptography, and regulate, guide, and supervise the formulation of group standards for commercial cryptography. The national cryptography administration department shall, in accordance with its duties, establish a mechanism for feedback and evaluation of the implementation of commercial cryptography standards, and supervise and inspect the implementation of commercial cryptography standards.
国家推动参与商用密码国际标准化活动，参与制定商用密码国际标准，推进商用密码中国标准与国外标准之间的转化运用，鼓励企业、社会团体和教育、科研机构等参与商用密码国际标准化活动。
The State shall promote participation in international standardization activities for commercial cryptography, participate in the formulation of international standards for commercial cryptography, promote the transformation and application of Chinese standards for commercial cryptography with foreign standards, and encourage enterprises, social groups, and educational and research institutions to participate in international standardization activities for commercial cryptography.
其他领域的标准涉及商用密码的，应当与商用密码国家标准、行业标准保持协调。
Where standards in other fields involve commercial cryptography, they shall be coordinated with national standards and industry standards for commercial cryptography.
从事商用密码活动，应当符合有关法律、行政法规、商用密码强制性国家标准，以及自我声明公开标准的技术要求。
Entities engaged in commercial cryptography activities shall comply with relevant laws, administrative regulations, mandatory national standards for commercial cryptography, and the technical requirements of self-declared public standards.
国家鼓励在商用密码活动中采用商用密码推荐性国家标准、行业标准，提升商用密码的防护能力，维护用户的合法权益。
The State encourages the adoption of recommended national standards and industry standards for commercial cryptography in commercial cryptography activities to enhance the protection capability of commercial cryptography and safeguard the legitimate rights and interests of users.
检 测 认 证
Testing and Certification
国家推进商用密码检测认证体系建设，鼓励在商用密码活动中自愿接受商用密码检测认证。
The State shall promote the establishment of a commercial cryptography testing and certification system, and encourage voluntary acceptance of commercial cryptography testing and certification in commercial cryptography activities.
从事商用密码产品检测、网络与信息系统商用密码应用安全性评估等商用密码检测活动，向社会出具具有证明作用的数据、结果的机构，应当经国家密码管理部门认定，依法取得商用密码检测机构资质。
Institutions that engage in commercial cryptography testing activities, such as testing commercial cryptography products and evaluating the security of commercial cryptography applications in networks and information systems, and issue data or results with evidentiary effect to the public, shall be recognized by the national cryptography administration department and obtain commercial cryptography testing institution qualifications in accordance with the law.
取得商用密码检测机构资质，应当符合下列条件：
To obtain commercial cryptography testing institution qualifications, the following conditions shall be met:
(一)具有法人资格；
(1) Having legal person status;
(二)具有与从事商用密码检测活动相适应的资金、场所、设备设施、专业人员和专业能力；
(2) Having the funds, premises, equipment, facilities, professional personnel, and professional capabilities commensurate with the commercial cryptography testing activities;
(三)具有保证商用密码检测活动有效运行的管理体系。
(3) Having a management system that ensures the effective operation of commercial cryptography testing activities.
申请商用密码检测机构资质，应当向国家密码管理部门提出书面申请，并提交符合本条例第十四条规定条件的材料。
To apply for commercial cryptography testing institution qualifications, a written application shall be submitted to the national cryptography administration department, along with materials proving compliance with the conditions set forth in Article 14 of this Regulation.
国家密码管理部门应当自受理申请之日起20个工作日内，对申请进行审查，并依法作出是否准予认定的决定。
The national cryptography administration department shall, within 20 working days from the date of accepting the application, review the application and make a decision on whether to grant recognition in accordance with the law.
需要对申请人进行技术评审的，技术评审所需时间不计算在本条规定的期限内。国家密码管理部门应当将所需时间书面告知申请人。
If a technical review of the applicant is required, the time needed for the technical review shall not be counted within the time limit specified in this Article. The national cryptography administration department shall inform the applicant in writing of the required time.
商用密码检测机构应当按照法律、行政法规和商用密码检测技术规范、规则，在批准范围内独立、公正、科学、诚信地开展商用密码检测，对出具的检测数据、结果负责，并定期向国家密码管理部门报送检测实施情况。
Commercial cryptography testing institutions shall, in accordance with laws, administrative regulations, and commercial cryptography testing technical specifications and rules, conduct commercial cryptography testing independently, impartially, scientifically, and with integrity within the approved scope, be responsible for the testing data and results issued, and regularly report the testing implementation to the national cryptography administration department.
商用密码检测技术规范、规则由国家密码管理部门制定并公布。
The technical specifications and rules for commercial cryptography testing shall be formulated and published by the national cryptography administration department.
国务院市场监督管理部门会同国家密码管理部门建立国家统一推行的商用密码认证制度，实行商用密码产品、服务、管理体系认证，制定并公布认证目录和技术规范、规则。
The market regulation department of the State Council, together with the national cryptography administration department, shall establish a nationally unified commercial cryptography certification system, implement certification for commercial cryptography products, services, and management systems, and formulate and publish the certification catalog and technical specifications and rules.
从事商用密码认证活动的机构，应当依法取得商用密码认证机构资质。
Institutions engaged in commercial cryptography certification activities shall obtain commercial cryptography certification institution qualifications in accordance with the law.
申请商用密码认证机构资质，应当向国务院市场监督管理部门提出书面申请。申请人除应当符合法律、行政法规和国家有关规定要求的认证机构基本条件外，还应当具有与从事商用密码认证活动相适应的检测、检查等技术能力。
To apply for commercial cryptography certification institution qualifications, a written application shall be submitted to the market regulation department of the State Council. In addition to meeting the basic conditions for certification institutions required by laws, administrative regulations, and relevant State provisions, the applicant shall also have the testing, inspection, and other technical capabilities commensurate with the commercial cryptography certification activities.
国务院市场监督管理部门在审查商用密码认证机构资质申请时，应当征求国家密码管理部门的意见。
When reviewing an application for commercial cryptography certification institution qualifications, the market regulation department of the State Council shall seek the opinion of the national cryptography administration department.
商用密码认证机构应当按照法律、行政法规和商用密码认证技术规范、规则，在批准范围内独立、公正、科学、诚信地开展商用密码认证，对出具的认证结论负责。
Commercial cryptography certification institutions shall, in accordance with laws, administrative regulations, and commercial cryptography certification technical specifications and rules, conduct commercial cryptography certification independently, impartially, scientifically, and with integrity within the approved scope, and be responsible for the certification conclusions issued.
商用密码认证机构应当对其认证的商用密码产品、服务、管理体系实施有效的跟踪调查，以保证通过认证的商用密码产品、服务、管理体系持续符合认证要求。
Commercial cryptography certification institutions shall conduct effective follow-up investigations on the commercial cryptography products, services, and management systems they have certified to ensure that the certified commercial cryptography products, services, and management systems continue to meet the certification requirements.
涉及国家安全、国计民生、社会公共利益的商用密码产品，应当依法列入网络关键设备和网络安全专用产品目录，由具备资格的商用密码检测、认证机构检测认证合格后，方可销售或者提供。
Commercial cryptography products that involve national security, the national economy and people's livelihood, or public interests shall be included in the catalog of key network equipment and specialized network security products, and may only be sold or provided after being tested and certified by qualified commercial cryptography testing and certification institutions.
商用密码服务使用网络关键设备和网络安全专用产品的，应当经商用密码认证机构对该商用密码服务认证合格。
Where commercial cryptography services use key network equipment and specialized network security products, the commercial cryptography services shall be certified by a commercial cryptography certification institution.
电 子 认 证
Electronic Authentication
采用商用密码技术提供电子认证服务，应当具有与使用密码相适应的场所、设备设施、专业人员、专业能力和管理体系，依法取得国家密码管理部门同意使用密码的证明文件。
To provide electronic authentication services using commercial cryptography technology, an entity shall have the premises, equipment, facilities, professional personnel, professional capabilities, and management system commensurate with the use of cryptography, and obtain a certificate document from the national cryptography administration department approving the use of cryptography in accordance with the law.
电子认证服务机构应当按照法律、行政法规和电子认证服务密码使用技术规范、规则，使用密码提供电子认证服务，保证其电子认证服务密码使用持续符合要求。
Electronic authentication service institutions shall, in accordance with laws, administrative regulations, and technical specifications and rules for the use of cryptography in electronic authentication services, use cryptography to provide electronic authentication services, and ensure that their use of cryptography in electronic authentication services continuously meets the requirements.
电子认证服务密码使用技术规范、规则由国家密码管理部门制定并公布。
The technical specifications and rules for the use of cryptography in electronic authentication services shall be formulated and published by the national cryptography administration department.
采用商用密码技术从事电子政务电子认证服务的机构，应当经国家密码管理部门认定，依法取得电子政务电子认证服务机构资质。
Institutions that use commercial cryptography technology to provide electronic authentication services for e-government shall be recognized by the national cryptography administration department and obtain e-government electronic authentication service institution qualifications in accordance with the law.
取得电子政务电子认证服务机构资质，应当符合下列条件：
To obtain e-government electronic authentication service institution qualifications, the following conditions shall be met:
(一)具有企业法人或者事业单位法人资格；
(1) Having the legal person status of an enterprise or a public institution;
(二)具有与从事电子政务电子认证服务活动及其使用密码相适应的资金、场所、设备设施和专业人员；
(2) Having the funds, premises, equipment, facilities, and professional personnel commensurate with the e-government electronic authentication service activities and the use of cryptography;
(三)具有为政务活动提供长期电子政务电子认证服务的能力；
(3) Having the capability to provide long-term e-government electronic authentication services for government activities;
(四)具有保证电子政务电子认证服务活动及其使用密码安全运行的管理体系。
(4) Having a management system that ensures the safe operation of e-government electronic authentication service activities and the use of cryptography.
申请电子政务电子认证服务机构资质，应当向国家密码管理部门提出书面申请，并提交符合本条例第二十五条规定条件的材料。
To apply for e-government electronic authentication service institution qualifications, a written application shall be submitted to the national cryptography administration department, along with materials proving compliance with the conditions set forth in Article 25 of this Regulation.
国家密码管理部门应当自受理申请之日起20个工作日内，对申请进行审查，并依法作出是否准予认定的决定。
The national cryptography administration department shall, within 20 working days from the date of accepting the application, review the application and make a decision on whether to grant recognition in accordance with the law.
需要对申请人进行技术评审的，技术评审所需时间不计算在本条规定的期限内。国家密码管理部门应当将所需时间书面告知申请人。
If a technical review of the applicant is required, the time needed for the technical review shall not be counted within the time limit specified in this Article. The national cryptography administration department shall inform the applicant in writing of the required time.
外商投资电子政务电子认证服务，影响或者可能影响国家安全的，应当依法进行外商投资安全审查。
Where foreign investment in e-government electronic authentication services affects or may affect national security, a national security review of foreign investment shall be conducted in accordance with the law.
电子政务电子认证服务机构应当按照法律、行政法规和电子政务电子认证服务技术规范、规则，在批准范围内提供电子政务电子认证服务，并定期向主要办事机构所在地省、自治区、直辖市密码管理部门报送服务实施情况。
E-government electronic authentication service institutions shall, in accordance with laws, administrative regulations, and technical specifications and rules for e-government electronic authentication services, provide e-government electronic authentication services within the approved scope, and regularly report the service implementation to the cryptography administration department of the province, autonomous region, or municipality directly under the Central Government where their main office is located.
电子政务电子认证服务技术规范、规则由国家密码管理部门制定并公布。
The technical specifications and rules for e-government electronic authentication services shall be formulated and published by the national cryptography administration department.
国家建立统一的电子认证信任机制。国家密码管理部门负责电子认证信任源的规划和管理，会同有关部门推动电子认证服务互信互认。
The State shall establish a unified electronic authentication trust mechanism. The national cryptography administration department shall be responsible for the planning and management of electronic authentication trust sources, and shall, together with relevant departments, promote mutual trust and mutual recognition of electronic authentication services.
密码管理部门会同有关部门负责政务活动中使用电子签名、数据电文的管理。
The cryptography administration department, together with relevant departments, shall be responsible for the administration of the use of electronic signatures and data messages in government activities.
政务活动中电子签名、电子印章、电子证照等涉及的电子认证服务，应当由依法设立的电子政务电子认证服务机构提供。
Electronic authentication services involved in electronic signatures, electronic seals, electronic certificates, etc., in government activities shall be provided by e-government electronic authentication service institutions established in accordance with the law.
进 出 口
Import and Export
涉及国家安全、社会公共利益且具有加密保护功能的商用密码，列入商用密码进口许可清单，实施进口许可。涉及国家安全、社会公共利益或者中国承担国际义务的商用密码，列入商用密码出口管制清单，实施出口管制。
Commercial cryptography that involves national security or public interests and has encryption protection functions shall be included in the commercial cryptography import license list and subject to import licensing. Commercial cryptography that involves national security, public interests, or China's international obligations shall be included in the commercial cryptography export control list and subject to export control.
商用密码进口许可清单和商用密码出口管制清单由国务院商务主管部门会同国家密码管理部门和海关总署制定并公布。
The commercial cryptography import license list and the commercial cryptography export control list shall be formulated and published by the commerce department of the State Council, together with the national cryptography administration department and the General Administration of Customs.
大众消费类产品所采用的商用密码不实行进口许可和出口管制制度。
Commercial cryptography used in mass consumer products shall not be subject to the import license and export control systems.
进口商用密码进口许可清单中的商用密码或者出口商用密码出口管制清单中的商用密码，应当向国务院商务主管部门申请领取进出口许可证。
To import commercial cryptography included in the commercial cryptography import license list or export commercial cryptography included in the commercial cryptography export control list, an import or export license shall be applied for from the commerce department of the State Council.
商用密码的过境、转运、通运、再出口，在境外与综合保税区等海关特殊监管区域之间进出，或者在境外与出口监管仓库、保税物流中心等保税监管场所之间进出的，适用前款规定。
The provisions of the preceding paragraph shall apply to the transit, transshipment, through-shipment, and re-export of commercial cryptography, as well as the movement of commercial cryptography between overseas areas and special customs supervision areas such as comprehensive bonded zones, or between overseas areas and bonded supervision sites such as export supervision warehouses and bonded logistics centers.
进口商用密码进口许可清单中的商用密码或者出口商用密码出口管制清单中的商用密码时，应当向海关交验进出口许可证，并按照国家有关规定办理报关手续。
When importing commercial cryptography included in the commercial cryptography import license list or exporting commercial cryptography included in the commercial cryptography export control list, the import or export license shall be presented to the customs, and customs declaration procedures shall be handled in accordance with relevant State provisions.
进出口经营者未向海关交验进出口许可证，海关有证据表明进出口产品可能属于商用密码进口许可清单或者出口管制清单范围的，应当向进出口经营者提出质疑；海关可以向国务院商务主管部门提出组织鉴别，并根据国务院商务主管部门会同国家密码管理部门作出的鉴别结论依法处置。在鉴别或者质疑期间，海关对进出口产品不予放行。
If an import or export operator fails to present an import or export license to the customs, and the customs has evidence that the imported or exported product may fall within the scope of the commercial cryptography import license list or export control list, the customs may raise a query to the import or export operator; the customs may request the commerce department of the State Council to organize an identification, and shall dispose of the matter in accordance with the identification conclusion made by the commerce department of the State Council together with the national cryptography administration department. During the identification or query period, the customs shall not release the imported or exported product.
申请商用密码进出口许可，应当向国务院商务主管部门提出书面申请，并提交下列材料：
To apply for a commercial cryptography import or export license, a written application shall be submitted to the commerce department of the State Council, along with the following materials:
(一)申请人的法定代表人、主要经营管理人以及经办人的身份证明；
(1) Identity documents of the applicant's legal representative, principal management personnel, and handling personnel;
(二)合同或者协议的副本；
(2) A copy of the contract or agreement;
(三)商用密码的技术说明；
(3) A technical description of the commercial cryptography;
(四)最终用户和最终用途证明；
(4) A certificate of end-user and end-use;
(五)国务院商务主管部门规定提交的其他文件。
(5) Other documents required to be submitted by the commerce department of the State Council.
国务院商务主管部门应当自受理申请之日起45个工作日内，会同国家密码管理部门对申请进行审查，并依法作出是否准予许可的决定。
The commerce department of the State Council shall, within 45 working days from the date of accepting the application, review the application together with the national cryptography administration department, and make a decision on whether to grant the license in accordance with the law.
对国家安全、社会公共利益或者外交政策有重大影响的商用密码出口，由国务院商务主管部门会同国家密码管理部门等有关部门报国务院批准。报国务院批准的，不受前款规定时限的限制。
For the export of commercial cryptography that has a significant impact on national security, public interests, or foreign policy, the commerce department of the State Council shall, together with the national cryptography administration department and other relevant departments, report to the State Council for approval. The time limit specified in the preceding paragraph shall not apply to cases reported to the State Council for approval.
应 用 促 进
Application Promotion
国家鼓励公民、法人和其他组织依法使用商用密码保护网络与信息安全，鼓励使用经检测认证合格的商用密码。
The State encourages citizens, legal persons, and other organizations to use commercial cryptography to protect network and information security in accordance with the law, and encourages the use of commercial cryptography that has passed testing and certification.
任何组织或者个人不得窃取他人加密保护的信息或者非法侵入他人的商用密码保障系统，不得利用商用密码从事危害国家安全、社会公共利益、他人合法权益等违法犯罪活动。
No organization or individual may steal others' encrypted information or illegally intrude into others' commercial cryptography security systems, or use commercial cryptography to engage in illegal or criminal activities that endanger national security, public interests, or the legitimate rights and interests of others.
国家支持网络产品和服务使用商用密码提升安全性，支持并规范商用密码在信息领域新技术、新业态、新模式中的应用。
The State supports the use of commercial cryptography in network products and services to enhance security, and supports and regulates the application of commercial cryptography in new technologies, new business forms, and new models in the information field.
国家建立商用密码应用促进协调机制，加强对商用密码应用的统筹指导。国家机关和涉及商用密码工作的单位在其职责范围内负责本机关、本单位或者本系统的商用密码应用和安全保障工作。
The State shall establish a coordination mechanism for promoting the application of commercial cryptography, and strengthen the overall guidance for the application of commercial cryptography. State organs and units involved in commercial cryptography work shall be responsible for the application and security assurance of commercial cryptography within their respective organs, units, or systems.
密码管理部门会同有关部门加强商用密码应用信息收集、风险评估、信息通报和重大事项会商，并加强与网络安全监测预警和信息通报的衔接。
The cryptography administration department, together with relevant departments, shall strengthen the collection of information on the application of commercial cryptography, risk assessment, information notification, and consultation on major matters, and strengthen the connection with network security monitoring, early warning, and information notification.
法律、行政法规和国家有关规定要求使用商用密码进行保护的关键信息基础设施，其运营者应当使用商用密码进行保护，制定商用密码应用方案，配备必要的资金和专业人员，同步规划、同步建设、同步运行商用密码保障系统，自行或者委托商用密码检测机构开展商用密码应用安全性评估。
Operators of critical information infrastructure that are required by laws, administrative regulations, and relevant State provisions to be protected by commercial cryptography shall use commercial cryptography for protection, formulate commercial cryptography application plans, allocate necessary funds and professional personnel, and plan, construct, and operate commercial cryptography security systems simultaneously, and conduct security assessments of commercial cryptography applications on their own or by entrusting commercial cryptography testing institutions.
前款所列关键信息基础设施通过商用密码应用安全性评估方可投入运行，运行后每年至少进行一次评估，评估情况按照国家有关规定报送国家密码管理部门或者关键信息基础设施所在地省、自治区、直辖市密码管理部门备案。
The critical information infrastructure referred to in the preceding paragraph may only be put into operation after passing the security assessment of commercial cryptography applications, and shall be assessed at least once a year after operation. The assessment results shall be reported to the national cryptography administration department or the cryptography administration department of the province, autonomous region, or municipality directly under the Central Government where the critical information infrastructure is located for filing in accordance with relevant State provisions.
法律、行政法规和国家有关规定要求使用商用密码进行保护的关键信息基础设施，使用的商用密码产品、服务应当经检测认证合格，使用的密码算法、密码协议、密钥管理机制等商用密码技术应当通过国家密码管理部门审查鉴定。
For critical information infrastructure that is required by laws, administrative regulations, and relevant State provisions to be protected by commercial cryptography, the commercial cryptography products and services used shall pass testing and certification, and the commercial cryptography technologies such as cryptographic algorithms, cryptographic protocols, and key management mechanisms used shall pass the review and appraisal of the national cryptography administration department.
关键信息基础设施的运营者采购涉及商用密码的网络产品和服务，可能影响国家安全的，应当依法通过国家网信部门会同国家密码管理部门等有关部门组织的国家安全审查。
Where an operator of critical information infrastructure procures network products and services involving commercial cryptography that may affect national security, it shall, in accordance with the law, pass the national security review organized by the national cyberspace administration department together with the national cryptography administration department and other relevant departments.
网络运营者应当按照国家网络安全等级保护制度要求，使用商用密码保护网络安全。国家密码管理部门根据网络的安全保护等级，确定商用密码的使用、管理和应用安全性评估要求，制定网络安全等级保护密码标准规范。
Network operators shall, in accordance with the requirements of the national network security classified protection system, use commercial cryptography to protect network security. The national cryptography administration department shall, based on the security protection level of the network, determine the requirements for the use, management, and security assessment of commercial cryptography, and formulate cryptographic standards and specifications for network security classified protection.
商用密码应用安全性评估、关键信息基础设施安全检测评估、网络安全等级测评应当加强衔接，避免重复评估、测评。
Security assessments of commercial cryptography applications, security testing and evaluation of critical information infrastructure, and network security classified protection evaluations shall be coordinated to avoid duplicate assessments and evaluations.
监 督 管 理
Supervision and Administration
密码管理部门依法组织对商用密码活动进行监督检查，对国家机关和涉及商用密码工作的单位的商用密码相关工作进行指导和监督。
The cryptography administration department shall, in accordance with the law, organize supervision and inspection of commercial cryptography activities, and provide guidance and supervision over the commercial cryptography-related work of State organs and units involved in commercial cryptography work.
密码管理部门和有关部门建立商用密码监督管理协作机制，加强商用密码监督、检查、指导等工作的协调配合。
The cryptography administration department and relevant departments shall establish a coordination mechanism for the supervision and administration of commercial cryptography, and strengthen coordination and cooperation in the supervision, inspection, and guidance of commercial cryptography.
密码管理部门和有关部门依法开展商用密码监督检查，可以行使下列职权：
When conducting supervision and inspection of commercial cryptography in accordance with the law, the cryptography administration department and relevant departments may exercise the following powers:
(一)进入商用密码活动场所实施现场检查；
(1) Entering the premises where commercial cryptography activities are conducted to carry out on-site inspections;
(二)向当事人的法定代表人、主要负责人和其他有关人员调查、了解有关情况；
(2) Inquiring about relevant circumstances from the legal representative, principal responsible persons, and other relevant personnel of the party concerned;
(三)查阅、复制有关合同、票据、账簿以及其他有关资料。
(3) Consulting and copying relevant contracts, bills, account books, and other relevant materials.
密码管理部门和有关部门推进商用密码监督管理与社会信用体系相衔接，依法建立推行商用密码经营主体信用记录、信用分级分类监管、失信惩戒以及信用修复等机制。
The cryptography administration department and relevant departments shall promote the connection between the supervision and administration of commercial cryptography and the social credit system, and establish and implement mechanisms such as credit records of commercial cryptography business entities, credit-based classified supervision, punishment for dishonesty, and credit restoration in accordance with the law.
商用密码检测、认证机构和电子政务电子认证服务机构及其工作人员，应当对其在商用密码活动中所知悉的国家秘密和商业秘密承担保密义务。
Commercial cryptography testing and certification institutions, e-government electronic authentication service institutions, and their staff shall undertake confidentiality obligations for State secrets and commercial secrets learned during commercial cryptography activities.
密码管理部门和有关部门及其工作人员不得要求商用密码科研、生产、销售、服务、进出口等单位和商用密码检测、认证机构向其披露源代码等密码相关专有信息，并对其在履行职责中知悉的商业秘密和个人隐私严格保密，不得泄露或者非法向他人提供。
The cryptography administration department and relevant departments and their staff shall not require commercial cryptography research, production, sale, service, import and export units, and commercial cryptography testing and certification institutions to disclose source code or other cryptography-related proprietary information, and shall strictly keep confidential the commercial secrets and personal privacy learned during the performance of their duties, and shall not disclose or illegally provide them to others.
密码管理部门和有关部门依法开展商用密码监督管理，相关单位和人员应当予以配合，任何单位和个人不得非法干预和阻挠。
When the cryptography administration department and relevant departments conduct supervision and administration of commercial cryptography in accordance with the law, relevant units and individuals shall cooperate, and no unit or individual may illegally intervene or obstruct.
任何单位或者个人有权向密码管理部门和有关部门举报违反本条例的行为。密码管理部门和有关部门接到举报，应当及时核实、处理，并为举报人保密。
Any unit or individual has the right to report to the cryptography administration department and relevant departments any violation of this Regulation. Upon receiving a report, the cryptography administration department and relevant departments shall promptly verify and handle it, and keep the reporter confidential.
法 律 责 任
Legal Liability
违反本条例规定，未经认定向社会开展商用密码检测活动，或者未经认定从事电子政务电子认证服务的，由密码管理部门责令改正或者停止违法行为，给予警告，没收违法产品和违法所得；违法所得30万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足30万元的，可以并处10万元以上30万元以下罚款。
Where, in violation of this Regulation, an entity conducts commercial cryptography testing activities for the public without recognition, or engages in e-government electronic authentication services without recognition, the cryptography administration department shall order correction or cessation of the illegal act, issue a warning, confiscate illegal products and illegal gains; if the illegal gains are 300,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan may be imposed.
违反本条例规定，未经批准从事商用密码认证活动的，由市场监督管理部门会同密码管理部门依照前款规定予以处罚。
Where, in violation of this Regulation, an entity engages in commercial cryptography certification activities without approval, the market regulation department, together with the cryptography administration department, shall impose a penalty in accordance with the provisions of the preceding paragraph.
商用密码检测机构开展商用密码检测，有下列情形之一的，由密码管理部门责令改正或者停止违法行为，给予警告，没收违法所得；违法所得30万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足30万元的，可以并处10万元以上30万元以下罚款；情节严重的，依法吊销商用密码检测机构资质：
Where a commercial cryptography testing institution conducts commercial cryptography testing under any of the following circumstances, the cryptography administration department shall order correction or cessation of the illegal act, issue a warning, and confiscate illegal gains; if the illegal gains are 300,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan may be imposed; if the circumstances are serious, the commercial cryptography testing institution qualification shall be revoked in accordance with the law:
(一)超出批准范围；
(1) Exceeding the approved scope;
(二)存在影响检测独立、公正、诚信的行为；
(2) Engaging in conduct that affects the independence, impartiality, or integrity of testing;
(三)出具的检测数据、结果虚假或者失实；
(3) Issuing false or inaccurate testing data or results;
(四)拒不报送或者不如实报送实施情况；
(4) Refusing to report or failing to truthfully report implementation status;
(五)未履行保密义务；
(5) Failing to fulfill confidentiality obligations;
(六)其他违反法律、行政法规和商用密码检测技术规范、规则开展商用密码检测的情形。
(6) Other circumstances where commercial cryptography testing is conducted in violation of laws, administrative regulations, and commercial cryptography testing technical specifications and rules.
商用密码认证机构开展商用密码认证，有下列情形之一的，由市场监督管理部门会同密码管理部门责令改正或者停止违法行为，给予警告，没收违法所得；违法所得30万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足30万元的，可以并处10万元以上30万元以下罚款；情节严重的，依法吊销商用密码认证机构资质：
Where a commercial cryptography certification institution conducts commercial cryptography certification under any of the following circumstances, the market regulation department, together with the cryptography administration department, shall order correction or cessation of the illegal act, issue a warning, and confiscate illegal gains; if the illegal gains are 300,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan may be imposed; if the circumstances are serious, the commercial cryptography certification institution qualification shall be revoked in accordance with the law:
(一)超出批准范围；
(1) Exceeding the approved scope;
(二)存在影响认证独立、公正、诚信的行为；
(2) Engaging in conduct that affects the independence, impartiality, or integrity of certification;
(三)出具的认证结论虚假或者失实；
(3) Issuing false or inaccurate certification conclusions;
(四)未对其认证的商用密码产品、服务、管理体系实施有效的跟踪调查；
(4) Failing to conduct effective follow-up investigations on the certified commercial cryptography products, services, or management systems;
(五)未履行保密义务；
(5) Failing to fulfill confidentiality obligations;
(六)其他违反法律、行政法规和商用密码认证技术规范、规则开展商用密码认证的情形。
(6) Other circumstances where commercial cryptography certification is conducted in violation of laws, administrative regulations, and commercial cryptography certification technical specifications and rules.
违反本条例第二十条、第二十一条规定，销售或者提供未经检测认证或者检测认证不合格的商用密码产品，或者提供未经认证或者认证不合格的商用密码服务的，由市场监督管理部门会同密码管理部门责令改正或者停止违法行为，给予警告，没收违法产品和违法所得；违法所得10万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足10万元的，可以并处3万元以上10万元以下罚款。
Where, in violation of Articles 20 and 21 of this Regulation, an entity sells or provides commercial cryptography products that have not passed testing and certification or have failed testing and certification, or provides commercial cryptography services that have not passed certification or have failed certification, the market regulation department, together with the cryptography administration department, shall order correction or cessation of the illegal act, issue a warning, and confiscate illegal products and illegal gains; if the illegal gains are 100,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 100,000 yuan, a fine of not less than 30,000 yuan but not more than 100,000 yuan may be imposed.
电子认证服务机构违反法律、行政法规和电子认证服务密码使用技术规范、规则使用密码的，由密码管理部门责令改正或者停止违法行为，给予警告，没收违法所得；违法所得30万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足30万元的，可以并处10万元以上30万元以下罚款；情节严重的，依法吊销电子认证服务使用密码的证明文件。
Where an electronic authentication service institution uses cryptography in violation of laws, administrative regulations, and technical specifications and rules for the use of cryptography in electronic authentication services, the cryptography administration department shall order correction or cessation of the illegal act, issue a warning, and confiscate illegal gains; if the illegal gains are 300,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan may be imposed; if the circumstances are serious, the certificate document approving the use of cryptography for electronic authentication services shall be revoked in accordance with the law.
电子政务电子认证服务机构开展电子政务电子认证服务，有下列情形之一的，由密码管理部门责令改正或者停止违法行为，给予警告，没收违法所得；违法所得30万元以上的，可以并处违法所得1倍以上3倍以下罚款；没有违法所得或者违法所得不足30万元的，可以并处10万元以上30万元以下罚款；情节严重的，责令停业整顿，直至吊销电子政务电子认证服务机构资质：
Where an e-government electronic authentication service institution provides e-government electronic authentication services under any of the following circumstances, the cryptography administration department shall order correction or cessation of the illegal act, issue a warning, and confiscate illegal gains; if the illegal gains are 300,000 yuan or more, a fine of not less than one time but not more than three times the illegal gains may be imposed; if there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan may be imposed; if the circumstances are serious, the institution shall be ordered to suspend operations for rectification, until the e-government electronic authentication service institution qualification is revoked:
(一)超出批准范围；
(1) Exceeding the approved scope;
(二)拒不报送或者不如实报送实施情况；
(2) Refusing to report or failing to truthfully report implementation status;
(三)未履行保密义务；
(3) Failing to fulfill confidentiality obligations;
(四)其他违反法律、行政法规和电子政务电子认证服务技术规范、规则提供电子政务电子认证服务的情形。
(4) Other circumstances where e-government electronic authentication services are provided in violation of laws, administrative regulations, and technical specifications and rules for e-government electronic authentication services.
电子签名人或者电子签名依赖方因依据电子政务电子认证服务机构提供的电子签名认证服务在政务活动中遭受损失，电子政务电子认证服务机构不能证明自己无过错的，承担赔偿责任。
Where an electronic signatory or a relying party suffers losses in government activities due to reliance on electronic signature certification services provided by an e-government electronic authentication service institution, and the e-government electronic authentication service institution cannot prove that it is not at fault, it shall bear compensation liability.
政务活动中电子签名、电子印章、电子证照等涉及的电子认证服务，违反本条例第三十条规定，未由依法设立的电子政务电子认证服务机构提供的，由密码管理部门责令改正，给予警告；拒不改正或者有其他严重情节的，由密码管理部门建议有关国家机关、单位对直接负责的主管人员和其他直接责任人员依法给予处分或者处理。有关国家机关、单位应当将处分或者处理情况书面告知密码管理部门。
Where electronic authentication services involved in electronic signatures, electronic seals, electronic certificates, etc., in government activities are not provided by an e-government electronic authentication service institution established in accordance with the law, in violation of Article 30 of this Regulation, the cryptography administration department shall order correction and issue a warning; if correction is refused or there are other serious circumstances, the cryptography administration department shall recommend that the relevant State organ or unit impose sanctions or handle the matter against the directly responsible supervisors and other directly responsible personnel in accordance with the law. The relevant State organ or unit shall inform the cryptography administration department in writing of the sanctions or handling.
违反本条例规定进出口商用密码的，由国务院商务主管部门或者海关依法予以处罚。
Where commercial cryptography is imported or exported in violation of this Regulation, the commerce department of the State Council or the customs shall impose a penalty in accordance with the law.
窃取他人加密保护的信息，非法侵入他人的商用密码保障系统，或者利用商用密码从事危害国家安全、社会公共利益、他人合法权益等违法活动的，由有关部门依照《中华人民共和国网络安全法》和其他有关法律、行政法规的规定追究法律责任。
Where an entity steals others' encrypted information, illegally intrudes into others' commercial cryptography security systems, or uses commercial cryptography to engage in illegal activities that endanger national security, public interests, or the legitimate rights and interests of others, legal liability shall be pursued by the relevant departments in accordance with the Cybersecurity Law of the People's Republic of China and other relevant laws and administrative regulations.
关键信息基础设施的运营者违反本条例第三十八条、第三十九条规定，未按照要求使用商用密码，或者未按照要求开展商用密码应用安全性评估的，由密码管理部门责令改正，给予警告；拒不改正或者有其他严重情节的，处10万元以上100万元以下罚款，对直接负责的主管人员处1万元以上10万元以下罚款。
Where an operator of critical information infrastructure, in violation of Articles 38 and 39 of this Regulation, fails to use commercial cryptography as required, or fails to conduct security assessments of commercial cryptography applications as required, the cryptography administration department shall order correction and issue a warning; if correction is refused or there are other serious circumstances, a fine of not less than 100,000 yuan but not more than 1,000,000 yuan shall be imposed, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the directly responsible supervisors.
关键信息基础设施的运营者违反本条例第四十条规定，使用未经安全审查或者安全审查未通过的涉及商用密码的网络产品或者服务的，由有关主管部门责令停止使用，处采购金额1倍以上10倍以下罚款；对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款。
Where an operator of critical information infrastructure, in violation of Article 40 of this Regulation, uses network products or services involving commercial cryptography that have not passed security review or have failed security review, the relevant competent department shall order cessation of use, and impose a fine of not less than one time but not more than ten times the procurement amount; a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the directly responsible supervisors and other directly responsible personnel.
网络运营者违反本条例第四十一条规定，未按照国家网络安全等级保护制度要求使用商用密码保护网络安全的，由密码管理部门责令改正，给予警告；拒不改正或者导致危害网络安全等后果的，处1万元以上10万元以下罚款，对直接负责的主管人员处5000元以上5万元以下罚款。
Where a network operator, in violation of Article 41 of this Regulation, fails to use commercial cryptography to protect network security in accordance with the requirements of the national network security classified protection system, the cryptography administration department shall order correction and issue a warning; if correction is refused or consequences such as endangering network security occur, a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed, and a fine of not less than 5,000 yuan but not more than 50,000 yuan shall be imposed on the directly responsible supervisors.
无正当理由拒不接受、不配合或者干预、阻挠密码管理部门、有关部门的商用密码监督管理的，由密码管理部门、有关部门责令改正，给予警告；拒不改正或者有其他严重情节的，处5万元以上50万元以下罚款，对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款；情节特别严重的，责令停业整顿，直至吊销商用密码许可证件。
Where an entity, without justifiable reasons, refuses to accept, fails to cooperate with, or intervenes in or obstructs the supervision and administration of commercial cryptography by the cryptography administration department or relevant departments, the cryptography administration department or relevant department shall order correction and issue a warning; if correction is refused or there are other serious circumstances, a fine of not less than 50,000 yuan but not more than 500,000 yuan shall be imposed, and a fine of not less than 10,000 yuan but not more than 100,000 yuan shall be imposed on the directly responsible supervisors and other directly responsible personnel; if the circumstances are especially serious, the entity shall be ordered to suspend operations for rectification, until the commercial cryptography license is revoked.
国家机关有本条例第六十条、第六十一条、第六十二条、第六十三条所列违法情形的，由密码管理部门、有关部门责令改正，给予警告；拒不改正或者有其他严重情节的，由密码管理部门、有关部门建议有关国家机关对直接负责的主管人员和其他直接责任人员依法给予处分或者处理。有关国家机关应当将处分或者处理情况书面告知密码管理部门、有关部门。
Where a State organ commits any of the illegal acts listed in Articles 60, 61, 62, and 63 of this Regulation, the cryptography administration department or relevant department shall order correction and issue a warning; if correction is refused or there are other serious circumstances, the cryptography administration department or relevant department shall recommend that the relevant State organ impose sanctions or handle the matter against the directly responsible supervisors and other directly responsible personnel in accordance with the law. The relevant State organ shall inform the cryptography administration department or relevant department in writing of the sanctions or handling.
密码管理部门和有关部门的工作人员在商用密码工作中滥用职权、玩忽职守、徇私舞弊，或者泄露、非法向他人提供在履行职责中知悉的商业秘密、个人隐私、举报人信息的，依法给予处分。
Where staff members of the cryptography administration department or relevant departments abuse their power, neglect their duties, engage in malpractice for personal gain, or disclose or illegally provide to others commercial secrets, personal privacy, or reporter information learned during the performance of their duties, they shall be given sanctions in accordance with the law.
违反本条例规定，构成犯罪的，依法追究刑事责任；给他人造成损害的，依法承担民事责任。
Where a violation of this Regulation constitutes a crime, criminal liability shall be pursued in accordance with the law; if damage is caused to others, civil liability shall be borne in accordance with the law.
附 则
Supplementary Provisions
本条例自2023年7月1日起施行。
This Regulation shall come into force on July 1, 2023.