KYB CHINA(2021年4月27日国务院第133次常务会议通过 2021年7月30日中华人民共和国国务院令第745号公布 自2021年9月1日起施行)
(Adopted at the 133th Executive Meeting of the State Council on April 27, 2021, promulgated by Order No. 745 of the State Council of the People's Republic of China on July 30, 2021, and effective as of September 1, 2021)
总 则
General Provisions
为了保障关键信息基础设施安全，维护网络安全，根据《中华人民共和国网络安全法》，制定本条例。
These Regulations are formulated in accordance with the Cybersecurity Law of the People's Republic of China to ensure the security of critical information infrastructure and safeguard cybersecurity.
本条例所称关键信息基础设施，是指公共通信和信息服务、能源、交通、水利、金融、公共服务、电子政务、国防科技工业等重要行业和领域的，以及其他一旦遭到破坏、丧失功能或者数据泄露，可能严重危害国家安全、国计民生、公共利益的重要网络设施、信息系统等。
For the purposes of these Regulations, critical information infrastructure refers to important network facilities and information systems in important industries and fields such as public communication and information services, energy, transportation, water conservancy, finance, public services, e-government, and defense science, technology and industry, as well as other important network facilities and information systems that, once damaged, lose functionality, or suffer data leakage, may seriously endanger national security, the national economy and people's livelihoods, or public interests.
在国家网信部门统筹协调下，国务院公安部门负责指导监督关键信息基础设施安全保护工作。国务院电信主管部门和其他有关部门依照本条例和有关法律、行政法规的规定，在各自职责范围内负责关键信息基础设施安全保护和监督管理工作。
Under the overall coordination of the national cyberspace administration, the public security department of the State Council shall be responsible for guiding and supervising the security protection of critical information infrastructure. The telecommunications authority of the State Council and other relevant departments shall, in accordance with these Regulations and relevant laws and administrative regulations, be responsible for the security protection and supervision of critical information infrastructure within their respective duties.
省级人民政府有关部门依据各自职责对关键信息基础设施实施安全保护和监督管理。
Relevant departments of provincial people's governments shall implement security protection and supervision of critical information infrastructure in accordance with their respective duties.
关键信息基础设施安全保护坚持综合协调、分工负责、依法保护，强化和落实关键信息基础设施运营者（以下简称运营者）主体责任，充分发挥政府及社会各方面的作用，共同保护关键信息基础设施安全。
The security protection of critical information infrastructure shall adhere to comprehensive coordination, division of responsibilities, and protection according to law, strengthen and implement the main responsibility of operators of critical information infrastructure (hereinafter referred to as operators), and give full play to the role of the government and all sectors of society to jointly protect the security of critical information infrastructure.
国家对关键信息基础设施实行重点保护，采取措施，监测、防御、处置来源于中华人民共和国境内外的网络安全风险和威胁，保护关键信息基础设施免受攻击、侵入、干扰和破坏，依法惩治危害关键信息基础设施安全的违法犯罪活动。
The state provides key protection for critical information infrastructure, takes measures to monitor, defend against, and handle cybersecurity risks and threats originating from within and outside the territory of the People's Republic of China, protects critical information infrastructure from attacks, intrusions, interference, and destruction, and punishes illegal and criminal activities that endanger the security of critical information infrastructure according to law.
任何个人和组织不得实施非法侵入、干扰、破坏关键信息基础设施的活动，不得危害关键信息基础设施安全。
No individual or organization may engage in activities that illegally intrude into, interfere with, or destroy critical information infrastructure, or endanger the security of critical information infrastructure.
运营者依照本条例和有关法律、行政法规的规定以及国家标准的强制性要求，在网络安全等级保护的基础上，采取技术保护措施和其他必要措施，应对网络安全事件，防范网络攻击和违法犯罪活动，保障关键信息基础设施安全稳定运行，维护数据的完整性、保密性和可用性。
Operators shall, in accordance with these Regulations, relevant laws and administrative regulations, and mandatory requirements of national standards, on the basis of cybersecurity level protection, adopt technical protection measures and other necessary measures to respond to cybersecurity incidents, prevent cyber attacks and illegal and criminal activities, ensure the safe and stable operation of critical information infrastructure, and maintain the integrity, confidentiality, and availability of data.
对在关键信息基础设施安全保护工作中取得显著成绩或者作出突出贡献的单位和个人，按照国家有关规定给予表彰。
Units and individuals that have achieved remarkable results or made outstanding contributions in the security protection of critical information infrastructure shall be commended in accordance with relevant state regulations.
关键信息基础设施认定
Identification of Critical Information Infrastructure
本条例第二条涉及的重要行业和领域的主管部门、监督管理部门是负责关键信息基础设施安全保护工作的部门（以下简称保护工作部门）。
The competent departments and supervisory departments of the important industries and fields referred to in Article 2 of these Regulations are the departments responsible for the security protection of critical information infrastructure (hereinafter referred to as protection work departments).
保护工作部门结合本行业、本领域实际，制定关键信息基础设施认定规则，并报国务院公安部门备案。
Protection work departments shall, based on the actual conditions of their respective industries and fields, formulate identification rules for critical information infrastructure and report them to the public security department of the State Council for recordation.
制定认定规则应当主要考虑下列因素：
The formulation of identification rules shall mainly consider the following factors:
（一）网络设施、信息系统等对于本行业、本领域关键核心业务的重要程度；
(1) The importance of network facilities and information systems to the key core businesses of the industry or field;
（二）网络设施、信息系统等一旦遭到破坏、丧失功能或者数据泄露可能带来的危害程度；
(2) The degree of harm that may be caused if network facilities and information systems are damaged, lose functionality, or suffer data leakage;
（三）对其他行业和领域的关联性影响。
(3) The impact on other industries and fields.
保护工作部门根据认定规则负责组织认定本行业、本领域的关键信息基础设施，及时将认定结果通知运营者，并通报国务院公安部门。
Protection work departments shall, in accordance with the identification rules, be responsible for organizing the identification of critical information infrastructure in their respective industries and fields, promptly notify operators of the identification results, and report them to the public security department of the State Council.
关键信息基础设施发生较大变化，可能影响其认定结果的，运营者应当及时将相关情况报告保护工作部门。保护工作部门自收到报告之日起3个月内完成重新认定，将认定结果通知运营者，并通报国务院公安部门。
If critical information infrastructure undergoes significant changes that may affect its identification results, the operator shall promptly report the relevant situation to the protection work department. The protection work department shall complete re-identification within three months from the date of receiving the report, notify the operator of the identification result, and report it to the public security department of the State Council.
运营者责任义务
Responsibilities and Obligations of Operators
安全保护措施应当与关键信息基础设施同步规划、同步建设、同步使用。
Security protection measures shall be planned, constructed, and used simultaneously with critical information infrastructure.
运营者应当建立健全网络安全保护制度和责任制，保障人力、财力、物力投入。运营者的主要负责人对关键信息基础设施安全保护负总责，领导关键信息基础设施安全保护和重大网络安全事件处置工作，组织研究解决重大网络安全问题。
Operators shall establish and improve cybersecurity protection systems and responsibility systems, and ensure investment in human, financial, and material resources. The principal person in charge of the operator shall assume overall responsibility for the security protection of critical information infrastructure, lead the security protection of critical information infrastructure and the handling of major cybersecurity incidents, and organize research to solve major cybersecurity problems.
运营者应当设置专门安全管理机构，并对专门安全管理机构负责人和关键岗位人员进行安全背景审查。审查时，公安机关、国家安全机关应当予以协助。
Operators shall set up a specialized security management agency, and conduct security background checks on the person in charge of the specialized security management agency and key personnel. When conducting checks, the public security organs and state security organs shall provide assistance.
专门安全管理机构具体负责本单位的关键信息基础设施安全保护工作，履行下列职责：
The specialized security management agency shall be specifically responsible for the security protection of the unit's critical information infrastructure and perform the following duties:
（一）建立健全网络安全管理、评价考核制度，拟订关键信息基础设施安全保护计划；
(1) Establish and improve network security management, evaluation and assessment systems, and formulate critical information infrastructure security protection plans;
（二）组织推动网络安全防护能力建设，开展网络安全监测、检测和风险评估；
(2) Organize and promote the construction of network security protection capabilities, carry out network security monitoring, testing and risk assessment;
（三）按照国家及行业网络安全事件应急预案，制定本单位应急预案，定期开展应急演练，处置网络安全事件；
(3) Formulate the unit's emergency plan in accordance with the national and industry network security incident emergency plan, conduct regular emergency drills, and handle network security incidents;
（四）认定网络安全关键岗位，组织开展网络安全工作考核，提出奖励和惩处建议；
(4) Identify key network security positions, organize network security work assessments, and propose reward and punishment recommendations;
（五）组织网络安全教育、培训；
(5) Organize network security education and training;
（六）履行个人信息和数据安全保护责任，建立健全个人信息和数据安全保护制度；
(6) Fulfill the responsibility of personal information and data security protection, establish and improve the personal information and data security protection system;
（七）对关键信息基础设施设计、建设、运行、维护等服务实施安全管理；
(7) Implement security management for services such as design, construction, operation, and maintenance of critical information infrastructure;
（八）按照规定报告网络安全事件和重要事项。
(8) Report network security incidents and important matters in accordance with regulations.
运营者应当保障专门安全管理机构的运行经费、配备相应的人员，开展与网络安全和信息化有关的决策应当有专门安全管理机构人员参与。
Operators shall guarantee the operating funds for the specialized security management organization, equip corresponding personnel, and decisions related to network security and informatization shall involve the participation of personnel from the specialized security management organization.
运营者应当自行或者委托网络安全服务机构对关键信息基础设施每年至少进行一次网络安全检测和风险评估，对发现的安全问题及时整改，并按照保护工作部门要求报送情况。
Operators shall conduct network security testing and risk assessment on critical information infrastructure at least once a year by themselves or by entrusting a network security service organization, promptly rectify the discovered security problems, and report the situation to the protection work department as required.
关键信息基础设施发生重大网络安全事件或者发现重大网络安全威胁时，运营者应当按照有关规定向保护工作部门、公安机关报告。
When a major network security incident occurs or a major network security threat is discovered in critical information infrastructure, the operator shall report to the protection work department and the public security organ in accordance with relevant regulations.
发生关键信息基础设施整体中断运行或者主要功能故障、国家基础信息以及其他重要数据泄露、较大规模个人信息泄露、造成较大经济损失、违法信息较大范围传播等特别重大网络安全事件或者发现特别重大网络安全威胁时，保护工作部门应当在收到报告后，及时向国家网信部门、国务院公安部门报告。
When particularly major network security incidents occur or particularly major network security threats are discovered, such as overall interruption of critical information infrastructure operation or major function failure, leakage of national basic information and other important data, leakage of personal information on a relatively large scale, causing relatively large economic losses, or relatively large-scale dissemination of illegal information, the protection work department shall, after receiving the report, promptly report to the national cyberspace administration and the public security department of the State Council.
运营者应当优先采购安全可信的网络产品和服务；采购网络产品和服务可能影响国家安全的，应当按照国家网络安全规定通过安全审查。
Operators shall give priority to purchasing secure and trustworthy network products and services; if the purchase of network products and services may affect national security, a security review shall be conducted in accordance with national network security regulations.
运营者采购网络产品和服务，应当按照国家有关规定与网络产品和服务提供者签订安全保密协议，明确提供者的技术支持和安全保密义务与责任，并对义务与责任履行情况进行监督。
When purchasing network products and services, operators shall sign a security and confidentiality agreement with the network product and service provider in accordance with relevant national regulations, specifying the provider's technical support and security confidentiality obligations and responsibilities, and supervise the performance of obligations and responsibilities.
运营者发生合并、分立、解散等情况，应当及时报告保护工作部门，并按照保护工作部门的要求对关键信息基础设施进行处置，确保安全。
In the event of merger, division, dissolution, etc., the operator shall promptly report to the protection work department and handle the critical information infrastructure in accordance with the requirements of the protection work department to ensure security.
保障和促进
Guarantee and Promotion
保护工作部门应当制定本行业、本领域关键信息基础设施安全规划，明确保护目标、基本要求、工作任务、具体措施。
The protection work department shall formulate security plans for critical information infrastructure in its industry and field, specifying protection objectives, basic requirements, work tasks, and specific measures.
国家网信部门统筹协调有关部门建立网络安全信息共享机制，及时汇总、研判、共享、发布网络安全威胁、漏洞、事件等信息，促进有关部门、保护工作部门、运营者以及网络安全服务机构等之间的网络安全信息共享。
The national cyberspace administration shall coordinate with relevant departments to establish a network security information sharing mechanism, timely collect, analyze, share, and release information on network security threats, vulnerabilities, incidents, etc., and promote network security information sharing among relevant departments, protection work departments, operators, and network security service organizations.
保护工作部门应当建立健全本行业、本领域的关键信息基础设施网络安全监测预警制度，及时掌握本行业、本领域关键信息基础设施运行状况、安全态势，预警通报网络安全威胁和隐患，指导做好安全防范工作。
The protection work department shall establish and improve the network security monitoring and early warning system for critical information infrastructure in its industry and field, timely grasp the operation status and security situation of critical information infrastructure in its industry and field, issue early warnings on network security threats and hidden dangers, and guide the implementation of security prevention work.
保护工作部门应当按照国家网络安全事件应急预案的要求，建立健全本行业、本领域的网络安全事件应急预案，定期组织应急演练；指导运营者做好网络安全事件应对处置，并根据需要组织提供技术支持与协助。
The protection work department shall, in accordance with the requirements of the national network security incident emergency plan, establish and improve the network security incident emergency plan for its industry and field, and organize regular emergency drills; guide operators to handle network security incidents, and provide technical support and assistance as needed.
保护工作部门应当定期组织开展本行业、本领域关键信息基础设施网络安全检查检测，指导监督运营者及时整改安全隐患、完善安全措施。
The protection work department shall regularly organize network security inspection and testing of critical information infrastructure in its industry and field, guide and supervise operators to timely rectify security risks and improve security measures.
国家网信部门统筹协调国务院公安部门、保护工作部门对关键信息基础设施进行网络安全检查检测，提出改进措施。
The national cyberspace administration shall coordinate with the public security department of the State Council and the protection work department to conduct network security inspection and testing of critical information infrastructure and propose improvement measures.
有关部门在开展关键信息基础设施网络安全检查时，应当加强协同配合、信息沟通，避免不必要的检查和交叉重复检查。检查工作不得收取费用，不得要求被检查单位购买指定品牌或者指定生产、销售单位的产品和服务。
When conducting network security inspections of critical information infrastructure, relevant departments shall strengthen coordination and information communication to avoid unnecessary inspections and duplicate cross-inspections. Inspection work shall not charge fees, and shall not require the inspected unit to purchase products or services of a designated brand or from designated production or sales units.
运营者对保护工作部门开展的关键信息基础设施网络安全检查检测工作，以及公安、国家安全、保密行政管理、密码管理等有关部门依法开展的关键信息基础设施网络安全检查工作应当予以配合。
Operators shall cooperate with the network security inspection and testing work of critical information infrastructure carried out by the protection work department, as well as the network security inspection work of critical information infrastructure carried out by relevant departments such as public security, national security, confidentiality administration, and password management in accordance with the law.
在关键信息基础设施安全保护工作中，国家网信部门和国务院电信主管部门、国务院公安部门等应当根据保护工作部门的需要，及时提供技术支持和协助。
In the work of critical information infrastructure security protection, the national cyberspace administration, the telecommunicationscompetent authority of the State Council, and the public security department of the State Council shall provide timely technical support and assistance according to the needs of the protection work department.
网信部门、公安机关、保护工作部门等有关部门，网络安全服务机构及其工作人员对于在关键信息基础设施安全保护工作中获取的信息，只能用于维护网络安全，并严格按照有关法律、行政法规的要求确保信息安全，不得泄露、出售或者非法向他人提供。
The cyberspace administration, public security organs, protection work departments, and other relevant departments, as well as network security service institutions and their staff, may only use information obtained in the course of critical information infrastructure security protection work for the purpose of maintaining network security, and must ensure information security in strict accordance with relevant laws and administrative regulations, and shall not disclose, sell, or illegally provide it to others.
未经国家网信部门、国务院公安部门批准或者保护工作部门、运营者授权，任何个人和组织不得对关键信息基础设施实施漏洞探测、渗透性测试等可能影响或者危害关键信息基础设施安全的活动。对基础电信网络实施漏洞探测、渗透性测试等活动，应当事先向国务院电信主管部门报告。
Without the approval of the National Cyberspace Administration or the public security department of the State Council, or the authorization of the protection work department or the operator, no individual or organization may conduct vulnerability detection, penetration testing, or other activities that may affect or endanger the security of critical information infrastructure. Activities such as vulnerability detection and penetration testing on basic telecommunications networks shall be reported in advance to the telecommunicationscompetent authority of the State Council.
国家采取措施，优先保障能源、电信等关键信息基础设施安全运行。
The state takes measures to give priority to ensuring the secure operation of critical information infrastructure in energy, telecommunications, and other sectors.
能源、电信行业应当采取措施，为其他行业和领域的关键信息基础设施安全运行提供重点保障。
The energy and telecommunications industries shall take measures to provide key guarantees for the secure operation of critical information infrastructure in other industries and sectors.
公安机关、国家安全机关依据各自职责依法加强关键信息基础设施安全保卫，防范打击针对和利用关键信息基础设施实施的违法犯罪活动。
Public security organs and state security organs shall, in accordance with their respective duties, strengthen the security protection of critical information infrastructure according to law, and prevent and combat illegal and criminal activities targeting or using critical information infrastructure.
国家制定和完善关键信息基础设施安全标准，指导、规范关键信息基础设施安全保护工作。
The state formulates and improves security standards for critical information infrastructure to guide and regulate the security protection work of critical information infrastructure.
国家采取措施，鼓励网络安全专门人才从事关键信息基础设施安全保护工作；将运营者安全管理人员、安全技术人员培训纳入国家继续教育体系。
The state takes measures to encourage network security professionals to engage in the security protection of critical information infrastructure; and incorporates the training of security management personnel and security technical personnel of operators into the national continuing education system.
国家支持关键信息基础设施安全防护技术创新和产业发展，组织力量实施关键信息基础设施安全技术攻关。
The state supports technological innovation and industrial development in critical information infrastructure security protection, and organizes efforts to carry out key technological research on critical information infrastructure security.
国家加强网络安全服务机构建设和管理，制定管理要求并加强监督指导，不断提升服务机构能力水平，充分发挥其在关键信息基础设施安全保护中的作用。
The state strengthens the construction and management of network security service institutions, formulates management requirements and strengthens supervision and guidance, continuously improves the capability level of service institutions, and gives full play to their role in the security protection of critical information infrastructure.
国家加强网络安全军民融合，军地协同保护关键信息基础设施安全。
The state strengthens the civil-military integration of network security, and the military and local authorities collaborate to protect the security of critical information infrastructure.
法律责任
Legal Liability
运营者有下列情形之一的，由有关主管部门依据职责责令改正，给予警告；拒不改正或者导致危害网络安全等后果的，处10万元以上100万元以下罚款，对直接负责的主管人员处1万元以上10万元以下罚款：
If an operator has any of the following circumstances, the relevant competent department shall, according to its duties, order correction and give a warning; if correction is refused or consequences such as endangering network security result, a fine of not less than 100,000 yuan but not more than 1 million yuan shall be imposed, and the directly responsible person in charge shall be fined not less than 10,000 yuan but not more than 100,000 yuan:
（一）在关键信息基础设施发生较大变化，可能影响其认定结果时未及时将相关情况报告保护工作部门的；
(1) Failing to promptly report to the protection work department when significant changes occur in the critical information infrastructure that may affect its identification result;
（二）安全保护措施未与关键信息基础设施同步规划、同步建设、同步使用的；
(2) Security protection measures are not planned, constructed, and used simultaneously with the critical information infrastructure;
（三）未建立健全网络安全保护制度和责任制的；
(3) Failing to establish and improve the network security protection system and responsibility system;
（四）未设置专门安全管理机构的；
(4) Failing to set up a dedicated security management organization;
（五）未对专门安全管理机构负责人和关键岗位人员进行安全背景审查的；
(5) Failing to conduct security background checks on the person in charge of the dedicated security management organization and key personnel;
（六）开展与网络安全和信息化有关的决策没有专门安全管理机构人员参与的；
(6) Making decisions related to network security and informatization without the participation of personnel from the dedicated security management organization;
（七）专门安全管理机构未履行本条例第十五条规定的职责的；
(7) The dedicated security management organization fails to perform the duties specified in Article 15 of these Regulations;
（八）未对关键信息基础设施每年至少进行一次网络安全检测和风险评估，未对发现的安全问题及时整改，或者未按照保护工作部门要求报送情况的；
(8) Failing to conduct at least one network security detection and risk assessment on critical information infrastructure each year, failing to promptly rectify discovered security issues, or failing to report to the protection work department as required;
（九）采购网络产品和服务，未按照国家有关规定与网络产品和服务提供者签订安全保密协议的；
(9) When purchasing network products and services, failing to sign a security and confidentiality agreement with the network product and service provider in accordance with relevant state regulations;
（十）发生合并、分立、解散等情况，未及时报告保护工作部门，或者未按照保护工作部门的要求对关键信息基础设施进行处置的。
(10) In the event of merger, division, dissolution, etc., failing to promptly report to the protection work department, or failing to handle the critical information infrastructure in accordance with the requirements of the protection work department.
运营者在关键信息基础设施发生重大网络安全事件或者发现重大网络安全威胁时，未按照有关规定向保护工作部门、公安机关报告的，由保护工作部门、公安机关依据职责责令改正，给予警告；拒不改正或者导致危害网络安全等后果的，处10万元以上100万元以下罚款，对直接负责的主管人员处1万元以上10万元以下罚款。
If an operator fails to report to the protection work department or public security organ in accordance with relevant regulations when a major network security incident occurs or a major network security threat is discovered, the protection work department or public security organ shall, according to its duties, order correction and give a warning; if correction is refused or consequences such as endangering network security result, a fine of not less than 100,000 yuan but not more than 1 million yuan shall be imposed, and the directly responsible person in charge shall be fined not less than 10,000 yuan but not more than 100,000 yuan.
运营者采购可能影响国家安全的网络产品和服务，未按照国家网络安全规定进行安全审查的，由国家网信部门等有关主管部门依据职责责令改正，处采购金额1倍以上10倍以下罚款，对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款。
If an operator purchases network products and services that may affect national security without conducting a security review in accordance with national network security regulations, the National Cyberspace Administration and other relevant competent departments shall, according to their duties, order correction and impose a fine of not less than 1 time but not more than 10 times the purchase amount, and the directly responsible person in charge and other directly responsible personnel shall be fined not less than 10,000 yuan but not more than 100,000 yuan.
运营者对保护工作部门开展的关键信息基础设施网络安全检查检测工作，以及公安、国家安全、保密行政管理、密码管理等有关部门依法开展的关键信息基础设施网络安全检查工作不予配合的，由有关主管部门责令改正；拒不改正的，处5万元以上50万元以下罚款，对直接负责的主管人员和其他直接责任人员处1万元以上10万元以下罚款；情节严重的，依法追究相应法律责任。
If an operator fails to cooperate with the critical information infrastructure network security inspection and testing work carried out by the protection work department, as well as the critical information infrastructure network security inspection work carried out by the public security, state security, confidentiality administration, cryptography administration, and other relevant departments according to law, the relevant competent department shall order correction; if correction is refused, a fine of not less than 50,000 yuan but not more than 500,000 yuan shall be imposed, and the directly responsible person in charge and other directly responsible personnel shall be fined not less than 10,000 yuan but not more than 100,000 yuan; if the circumstances are serious, corresponding legal liability shall be pursued according to law.
实施非法侵入、干扰、破坏关键信息基础设施，危害其安全的活动尚不构成犯罪的，依照《中华人民共和国网络安全法》有关规定，由公安机关没收违法所得，处5日以下拘留，可以并处5万元以上50万元以下罚款；情节较重的，处5日以上15日以下拘留，可以并处10万元以上100万元以下罚款。
If an act of illegally intruding into, interfering with, or damaging critical information infrastructure, endangering its security, does not constitute a crime, the public security authority shall, in accordance with the relevant provisions of the Cybersecurity Law of the People's Republic of China, confiscate the illegal gains, impose detention of not more than 5 days, and may concurrently impose a fine of not less than 50,000 yuan but not more than 500,000 yuan; if the circumstances are relatively serious, impose detention of not less than 5 days but not more than 15 days, and may concurrently impose a fine of not less than 100,000 yuan but not more than 1,000,000 yuan.
单位有前款行为的，由公安机关没收违法所得，处10万元以上100万元以下罚款，并对直接负责的主管人员和其他直接责任人员依照前款规定处罚。
If a unit commits the act mentioned in the preceding paragraph, the public security authority shall confiscate the illegal gains, impose a fine of not less than 100,000 yuan but not more than 1,000,000 yuan, and shall also impose penalties on the directly responsiblesupervisory personnel and other directly responsible personnel in accordance with the provisions of the preceding paragraph.
违反本条例第五条第二款和第三十一条规定，受到治安管理处罚的人员，5年内不得从事网络安全管理和网络运营关键岗位的工作；受到刑事处罚的人员，终身不得从事网络安全管理和网络运营关键岗位的工作。
Persons who violate the provisions of Article 5, paragraph 2, and Article 31 of these Regulations and receive public security penalties shall not engage in network security management or key positions in network operation for 5 years; persons who receive criminal penalties shall be permanently prohibited from engaging in network security management or key positions in network operation.
网信部门、公安机关、保护工作部门和其他有关部门及其工作人员未履行关键信息基础设施安全保护和监督管理职责或者玩忽职守、滥用职权、徇私舞弊的，依法对直接负责的主管人员和其他直接责任人员给予处分。
If the cyberspace administration department, public security authority, protection work department, or other relevant departments and their staff fail to perform the duties of security protection and supervision of critical information infrastructure, or are derelict of duty, abuse their power, or engage in malpractice for personal gain, the directly responsiblesupervisory personnel and other directly responsible personnel shall be given sanctions in accordance with the law.
公安机关、保护工作部门和其他有关部门在开展关键信息基础设施网络安全检查工作中收取费用，或者要求被检查单位购买指定品牌或者指定生产、销售单位的产品和服务的，由其上级机关责令改正，退还收取的费用；情节严重的，依法对直接负责的主管人员和其他直接责任人员给予处分。
If the public security authority, protection work department, or other relevant departments charge fees during the network security inspection of critical information infrastructure, or require the inspected unit to purchase products or services of a designated brand or from designated production or sales units, their superior authority shall order them to correct and refund the fees collected; if the circumstances are serious, the directly responsiblesupervisory personnel and other directly responsible personnel shall be given sanctions in accordance with the law.
网信部门、公安机关、保护工作部门等有关部门、网络安全服务机构及其工作人员将在关键信息基础设施安全保护工作中获取的信息用于其他用途，或者泄露、出售、非法向他人提供的，依法对直接负责的主管人员和其他直接责任人员给予处分。
If the cyberspace administration department, public security authority, protection work department, or other relevant departments, network security service agencies, and their staff use information obtained during the security protection of critical information infrastructure for other purposes, or disclose, sell, or illegally provide it to others, the directly responsiblesupervisory personnel and other directly responsible personnel shall be given sanctions in accordance with the law.
关键信息基础设施发生重大和特别重大网络安全事件，经调查确定为责任事故的，除应当查明运营者责任并依法予以追究外，还应查明相关网络安全服务机构及有关部门的责任，对有失职、渎职及其他违法行为的，依法追究责任。
If a major or particularly major network security incident occurs in critical information infrastructure and is determined to be a liability accident after investigation, in addition to ascertaining the liability of the operator and pursuing it according to law, the liability of the relevant network security service agencies and relevant departments shall also be ascertained, and if there are acts of dereliction of duty, malfeasance, or other illegal acts, liability shall be pursued according to law.
电子政务关键信息基础设施的运营者不履行本条例规定的网络安全保护义务的，依照《中华人民共和国网络安全法》有关规定予以处理。
If an operator of e-government critical information infrastructure fails to perform the network security protection obligations stipulated in these Regulations, it shall be dealt with in accordance with the relevant provisions of the Cybersecurity Law of the People's Republic of China.
违反本条例规定，给他人造成损害的，依法承担民事责任。
Whoever violates the provisions of these Regulations and causes damage to others shall bear civil liability according to law.
违反本条例规定，构成违反治安管理行为的，依法给予治安管理处罚；构成犯罪的，依法追究刑事责任。
Whoever violates the provisions of these Regulations and constitutes a violation of public security administration shall be given public security penalties according to law; if a crime is constituted, criminal liability shall be pursued according to law.
附 则
Supplementary Provisions
存储、处理涉及国家秘密信息的关键信息基础设施的安全保护，还应当遵守保密法律、行政法规的规定。
The security protection of critical information infrastructure that stores or processes information involving state secrets shall also comply with the provisions of laws and administrative regulations on confidentiality.
关键信息基础设施中的密码使用和管理，还应当遵守相关法律、行政法规的规定。
The use and management of cryptography in critical information infrastructure shall also comply with the provisions of relevant laws and administrative regulations.
本条例自2021年9月1日起施行。
These Regulations shall come into force as of September 1, 2021.