Current Location: Home >>> Regulations >> CSRC
CSRC

Measures for the Management of Information Security and Assurance in the Securities and Futures Industries


24-09-2012



Chapter I General Provisions

 

Article 1 These Measures are formulated in accordance with Securities Law, Law on Securities Investment Fund, Regulation on the Administration of Futures Trading and the laws and administrative regulations concerning information security and assurance for the purpose of safeguarding the safe operation of securities and futures information system, strengthening the administration of information security in the securities and futures industries, promoting the stable and healthy development of the securities and futures markets and protecting the legitimate rights and interests of investors.

 

Article 2 These Measures shall apply to the information security, assurance, management and supervision work in the securities and futures industries.

 

Article 3 The information security and assurance work in the securities and futures industries shall follow the principle of “whoever operates takes responsibility and whoever uses takes responsibility” with security prioritized and development safeguarded. 

 

Article 4 The entities responsible for the information security and assurance in the securities and futures industries shall implement the national laws and administrative regulations concerning information security and the industry-related technical administration rules, technical rules, technical guidelines and technical standards, conduct information security work, protect the security of the transactions of investors and the security of their data, and bear responsibilities for the safe operation of information system of their own.

The term “entities responsible” as mentioned in the preceding Article includes the institutions undertaking the public functions of the securities and futures markets, the institutions undertaking the operations of the IT public infrastructure in the securities and futures industries and other core institutions and their affiliates (hereinafter referred to as the “core institutions”) in the securities and futures markets, as well as securities companies, futures companies, fund management companies, securities and futures services institutions and other securities and futures operating institutions (hereinafter referred to as the “operating institutions”).

 

Article 5 The institutions which carry out third-party depository business for securities companies clients’ settlement funds, the transfer and settlement business between banks and securities companies, between banks and futures companies and between banks and fund companies, and fund custody and sales business, shall safeguard the safe operation of relevant business systems in accordance with relevant regulations.

 

Article 6 The suppliers who supply hardware and software products or technical services for the securities and futures industries (hereinafter referred to as the “suppliers”) shall ensure that the hardware and software products or technical services they provide are in line with national technical administration rules, technical rules, technical guidelines and technical standards concerning the information security in the securities and futures industries.

 

Article 7 The China Securities Regulatory Commission (CSRC) shall support and assist national information security management departments to organize the implementation of information security-related laws and administrative regulations and implement the supervision and administration of the information security and assurance in the securities and futures industries in accordance with law.

The local CSRC offices shall perform their regulatory functions in accordance with authorization.

 

Article 8 The CSRC and local CSRC offices shall establish an information security coordination mechanism with national information security management departments and relevant industry management departments, and establish an information security cooperation mechanism with relevant national professional security institutions and the organizations for standardization.

 

Article 9 The industry associations of securities, futures, securities investment funds (hereinafter referred to as the “securities and futures industry associations”) shall, in accordance with the provisions of these Measures, conduct the self-regulation management on the information security work of their members.

 

Article 10 The core institutions shall, in accordance with the provisions of these Measures, supervise and guide the work of relevant market entities on their security and assurance of associated information systems.

Chapter II Basic Requirements

 

Article 11 The core institutions and the operating institutions shall have qualified infrastructure. The construction of infrastructure including equipment room, electricity, air conditioning, fire fighting and telecommunications shall be in line with the relevant provisions of the information security management in the industries.

 

Article 12 The core institutions and the operating institutions shall establish reasonable network structure and divide security zones. Effective insulation shall be made among the security zones with the ability to prevent, monitor and block any damage from internal and external network attacks.

 

Article 13 The core institutions and the operating institutions shall establish information systems which meet business requirements. The information systems shall have a reasonable framework, adequate performance, capacity, reliability, expansibility and security to support the operation and development of businesses.

 

Article 14 The core institutions shall have the ability to develop independently such important information systems as transactions, prices, account opening, settlement, risk control, communications, have executive programs and source codes and store them safely and reliably, and conduct a rigorous review and testing on executive programs and source codes before any important information system is to be put into operation.

 

Article 15 The core institutions and the operating institutions shall have the ability to protect against Trojan horses, viruses and other malicious codes so as to prevent malicious codes from causing damage to information systems and to prevent information from being exposed or tampered with.

 

Article 16 The core institutions and the operating institutions shall establish a sound IT governance structure to specify the mechanism of power and responsibility of IT decision-making, management, implementation and internal supervision.

 

Article 17 The core institutions and the operating institutions shall establish a sound IT management system and operating rules and strictly implement them.

 

Article 18 The core institutions shall develop technical rules on the safe interconnection of information systems between the core institutions and relevant market entities and report to the CSRC for filing.

The core institutions shall urge relevant market entities to implement technical rules in accordance with law.

 

Article 19 The core institutions shall provide a variety of mutual backup remote access methods to ensure that relevant market entities can access safely, and conduct monitoring and management on the remote access of relevant market entities.

Chapter III Requirements for Sustained Assurance

 

Article 20 The core institutions and the operating institutions shall guarantee adequate and stable funding for IT investment and equip with sufficient IT staff.

 

Article 21 The core institutions and the operating institutions shall, in accordance with industry planning and the development strategy of their own, develop informatization and information security development planning to meet the needs of business development and information security management.

 

Article 22 When the core institutions and the operating institutions newly build, upgrade, change, or regenerate information systems or conduct other construction projects, they shall conduct sufficient verification and testing.

 

Article 23 When such important information systems are put into operation or undergone major change of upgrading as transactions, prices, account opening, settlement, communications of the core institutions, relevant market entities shall be organized to conduct networking tests and a report shall be made as stipulated.

 

Article 24 The core institutions and the operating institutions shall regulate the operation and maintenance of the IT infrastructure and important information systems so as to guarantee the safe and stable operation of the systems.

 

Article 25 The core institutions shall guide relevant market entities to operate and maintain properly the systems and communication facilities which are interconnected with these institutions.

 

Article 26 The core institutions and the operating institutions shall establish data backup facilities and save backup data in the same city and offsite as stipulated.

 

Article 27 The core institutions and the operating institutions shall establish failure backup facilities and disaster backup facilities of important information systems to guarantee the continuation of business activities.

 

Article 28 The core institutions and the operating institutions shall, as stipulated, submit data to the securities and futures industry data center designated by the CSRC. The submitted data must be truthful, complete, accurate and timely.

The securities and futures industry data center shall, in accordance with the relevant provisions of the CSRC, conduct the collective saving of industry data to make sure that the data is safe, complete and reliable.

 

Article 29 The core institutions shall be responsible for constructing and operating the industry IT public infrastructure.

 

Article 30 The core institutions and the operating institutions shall strengthen the management of information security and confidentiality to protect the security of investors’ information.

 

Article 31 The core institutions and the operating institutions shall establish network and information security risk detection, monitoring, assessment and early warning mechanisms, timely dispose of any potential risk which is found and make a report thereof as stipulated.

 

Article 32 The core institutions and the operating institutions shall establish information security emergency response mechanisms, timely dispose of information security emergencies and restore the normal operation of information systems as soon as possible, and make a report thereof as stipulated without any delay, omission or concealment.

The core institutions and the operating institutions shall conduct an internal investigation on information security incidents, investigate accountability and take corrective measures, and cooperate with the CSRC and the its local offices in investigating and disposing of the incidents.

The suppliers who supply hardware and software products or technical services which are related to the information security incidents occurred to the core institutions and the operating institutions shall cooperate with the investigation.

 

Article 33 The core institutions shall organize relevant market entities to do the information security emergency drill once a year, and make a report thereof to the CSRC prior to the implementation.

 

Article 34 The core institutions and the operating institutions shall train IT staff to ensure that they have the ability to fulfill their duties.

 

Article 35 The core institutions and the operating institutions shall establish an information security internal audit system, regularly carry out internal audit and rectify any problem found.

Chapter IV Requirements for Procurement of Products and Services

 

Article 36 The core institutions and the operating institutions shall establish a supplier management system to find out and assess the qualification, professional experience, and product and service quality of the suppliers on a regular basis.

 

Article 37 When the core institutions and the operating institutions procure hardware and software products or technical services, they shall enter into contracts and confidentiality agreements with the suppliers and shall expressly specify the rights and obligations on information security and confidentiality in the contracts and confidentiality agreements.

When the procurement contracts involve such software products or technical services as securities and futures transactions, prices, account opening and settlement, it shall be specified that the suppliers must accept the extended investigation on information security conducted by the CSRC and the its local offices.

 

Article 38 The hardware and software products or technical services which the core institutions and the operating institutions have procured shall meet the requirements of the prudent operation and risk management. If the hardware and software products or technical services fail to meet the requirements and affect the sustained operation of the core institutions and the operating institutions, the CSRC is entitled to request the core institutions and the operating institutions to improve or replace the same.

Chapter V Industry Self-regulation

 

Article 39 The securities and futures industry association shall formulate IT guidelines to urge and guide its members to implement national and industry regulations and technical standards on information security.

 

Article 40 The securities and futures industry association shall guide the industries to strengthen the construction of IT talent team, regularly organize IT training and exchange and improve the executive quality of IT staff.

 

Article 41 The securities and futures industry association shall guide and encourage the IT research and innovation of the industries, enhance self-control ability, organize science and technology awards and promote scientific and technological progress of the industries.

 

Article 42 The securities and futures industry association shall guide the suppliers to participate in the work of informatization and information security in the industries in compliance with regulations, promote fair competition in the market, and promote the common development of the suppliers and relevant market entities.

Chapter VI Supervision and Management

 

Article 43 The CSRC shall establish an information security supervision and management system with unified organization and graded responsibility bearing.

The information security management department of the CSRC shall be responsible for the organization, coordination and guidance of information security work in the securities and futures industries; relevant business regulatory departments shall conduct supervision and inspection on the information security of the core institutions and the operating institutions in accordance with the scope of duties; and the local CSRC offices shall conduct supervision and inspection on the information security of the operating institutions within their jurisdictions in accordance with their authorization.

 

Article 44 The CSRC shall organize the formulation of administrative regulations and technical standards on information security in the securities and futures industries in accordance with law.

 

Article 45 The CSRC and its local offices shall, in accordance with the scope of duties, conduct investigation on the information security of the core institutions and the operating institutions or entrust relevant professional security institutions of the state or the industries to conduct security inspections. The core institutions and the operating institutions shall cooperate in the inspection.

If the information security management of the core institutions and the operating institution fail to meet the specified requirements, the CSRC and its local offices shall order them to make rectifications within a time limit, and part or whole of their securities and futures business operation activities may be suspended or restricted prior to rectification.

 

Article 46 The CSRC and its local offices may request the core institutions and the operating institutions to provide materials on information security.

The core institutions and the operating institutions shall provide relevant materials timely, accurately and completely.

 

Article 47 The CSRC shall organize the formulation of an information security emergency preplan in the securities and futures industries, and urge and guide the industries to conduct information security emergency work.

 

Article 48 The CSRC is entitled to investigate and dispose of the information security incidents of the core institutions and the operating institutions.

For the information security incidents which damage the legitimate rights and interests of investors or affect the safe and stable operation of the securities and futures markets, the CSRC shall take supervision and management measures against or impose administrative penalties on relevant entities.

 

Article 49 The CSRC shall circulate a notice on system vulnerabilities, potential safety risks and product defects in the whole industries.

 

Article 50 If the core institutions and the operating institutions are in violation of the provisions of these Measures, the CSRC may, depending on the circumstances, take measures against them such as ordering correction, holding regulatory interviews, issuing letters of admonishment, public reprimand, ordering regular reporting, ordering a disciplinary action against the relevant persons, cancelling office qualifications and suspending or restricting the activities of the securities and futures business operation; if circumstances are serious, they shall be subject to warning or fining.

Chapter VII Supplementary Provisions

 

Article 51 These Measures shall come into force as of November 1, 2012. The Temporary Measures for the Management of Information Security and Assurance in the Securities and Futures Industries (No. 5 [2005] of the China Securities Regulatory Commission) shall be repealed simultaneously.