MPS Order No. 176: What It Means for Foreign Companies and Government Organizations in China
As of 1 October 2026, Ministry of Public Security (MPS) Order No. 176, the Measures for the Supervision and Inspection of Cyberspace Security by Public Security Organs, is in force. It repeals Order No. 151, issued in 2018. The change is not that technical testing has suddenly become possible for the first time: Order No. 151 already allowed remote vulnerability checks. Order No. 176 broadens and clarifies the scope, inspection methods, procedural safeguards and follow-up of identified risks.
For foreign-invested businesses and government organizations, the practical question is not simply whether the compliance binder is complete. It is whether the organization can identify the systems and data in scope, show that safeguards operate in practice, and demonstrate how risks are assigned, corrected and verified.
A broader view of the organization’s responsibilities
Article 2 applies the Measures to supervision of network operators, data processors, personal information processors and other relevant entities in performing their statutory cybersecurity, data-security and information-security duties. It defines “cyberspace security” to include network, data and information security.
Article 6 lists covered parties such as internet service providers, network operators and their builders or maintainers, critical information infrastructure (CII) operators, providers of network products and services, data processors and personal information processors. This is relevant to foreign companies whose China operations may depend on a local entity, headquarters-managed systems, cloud services, outsourced maintenance and cross-border business processes. Government organizations should similarly map systems they operate alongside government-cloud and contractor-operated components.
This does not mean every foreign company or government unit will receive the same inspection. Nor does purchasing a cloud or managed service automatically transfer every duty to the provider. The applicable entity, system boundary and responsibilities depend on the actual operating and data-processing arrangements.
Who may inspect, how often and by what means?
For an on-site inspection, Article 5 identifies the public security organ at or above county level with jurisdiction based on the inspected operator’s location. An on-site inspection must involve at least two people’s-police officers, who must present their police identification and an inspection notice (Article 11).
Article 4 allows online patrols using methods such as network-information patrols, information-review capability tests and vulnerability scanning, provided the activity does not affect the inspected party’s normal business operations or cyberspace security. For certain remote vulnerability probing or penetration testing of network facilities and information systems outside CII, the authority must be at prefecture-level city or above. It must notify the inspected party of the time and scope three working days in advance, avoid disrupting normal operations, and notify the same-level cyberspace administration and industry authority. Basic telecommunications networks are subject to the separate requirements referenced by the Measures.
The annual on-site inspection rule is limited. Under Article 9, one routine on-site inspection per year applies to network operators of MLPS Level 3 or above and CII operators. If another competent authority has already conducted an on-site inspection in the same year, the public security organ reuses that result rather than repeating it. Other routine inspections are coordinated, with their frequency, scope and method reasonably determined under the applicable classification and coordination principles. Case investigations and major security tasks may also result in special inspections.
What may be examined—and what the law does not prescribe
Article 7 includes MLPS classification and filing, assessment, remediation and self-checks; technical measures against attacks and intrusions; vulnerability remediation; algorithm-security responsibilities; and data-security and personal-information obligations. On site, Article 12 permits measures such as entering relevant premises or server rooms, reviewing records, observing security measures in operation, and conducting technical checks.
The Measures do not publish a universal list of ports or protocols that every organization must expose to a scan. The diagram’s HTTP(S), DNS, mail, VPN, SSH/RDP and cloud examples are an organization’s own asset-inventory prompts—not a mandatory police test plan. Any self-testing should be limited to systems and methods the organization is authorized to test.
A proportionate preparation plan
Foreign companies and government organizations can start with six practical steps:
- Map the scope: identify China operating entities, public-facing services, internet assets, cloud resources, important interfaces and third-party operations.
- Assign accountable owners: clarify interfaces among network, data, personal-information, business, procurement and legal teams.
- Check actual operation: sample vulnerability fixes, patch status, shared or stale accounts, administrator access, logs and security-device alert handling.
- Make evidence consistent: connect policies and assessment reports to the same systems, dates, risk tickets, change records and retest results.
- Review suppliers and cross-border support: agree on maintenance access, data handling, incident notification, log and backup responsibilities, and who can act locally.
- Rehearse inspection and response: define who verifies an official notice and scope, coordinates with system owners, manages remediation and preserves records.
FAQs: avoid both under-protection and unnecessary overbuilding
Does Order No. 176 mean MLPS is no longer required?
No. Article 7(4) expressly includes MLPS classification and filing, assessment, remediation and self-check duties. The 2025-revised Cybersecurity Law also retains the MLPS framework in Article 23. Order No. 176 clarifies supervision and verification; it does not abolish or replace MLPS. Also distinguish MLPS applicability and grading from the annual on-site inspection rule: the latter applies only to the specified Level 3+ and CII operators.
Does a simple official website need a large stack of security products?
Not automatically. First establish who operates the site and its administrative backend, where it is hosted, and whether it has logins, forms, accounts, APIs or personal-information processing. Then choose proportionate safeguards based on business impact, actual exposure, hosting protections and applicable requirements.
For a simple, managed informational site, sensible starting points may include MFA for domain, hosting and administrator accounts; supported and patched site components; only necessary public services; protection of management access; HTTPS; tested backups; usable access and administration logs; and a review of data collected by forms or analytics. A WAF, anti-DDoS service or dedicated SOC may be appropriate for some risk profiles, but product count is not a measure of compliance. Article 14 also says authorities must not require an inspected party to buy or use a specified product or service.
I only have one VPN portal. Does that mean the risk is small?
A single portal may still be the organization’s main internet-facing remote-access gateway. Assess the appliance/software and firmware, public exposure of the management plane, who can authenticate, which network segments each user can reach, and whether accounts and logs are reviewed. As practical measures, keep the product supported and patched, use strong authentication, remove stale accounts, limit users to necessary systems, avoid public exposure of management interfaces where possible, monitor unusual logins, and test configuration recovery. These are practical risk controls, not an item-by-item product mandate in Order No. 176.
Will every website be inspected once a year or scanned on every port?
No. The annual routine on-site inspection rule is restricted to MLPS Level 3+ network operators and CII operators. Other inspection frequency, scope and method are reasonably determined under the coordination and classification rules; special checks can occur for cases or major security tasks. Order No. 176 does not provide a universal port/protocol checklist.
If the site is hosted in the cloud or maintained by a vendor, does the vendor take over all responsibility?
Outsourcing can allocate tasks, but it does not automatically remove duties that the organization itself has under applicable law. Define access, patching, vulnerability handling, logging, backups, incident notification, data-processing boundaries and exit arrangements—and verify that the agreed split is followed in day-to-day operations.
Must an organization keep renewing support for an old SonicWall firewall with SSL VPN?
Order No. 176 does not require a renewal contract for a particular vendor. But distinguish a security-service subscription from technical support and firmware security updates. SonicWall’s lifecycle policy treats limited retirement and end of support differently: during limited retirement, firmware support may be restricted to critical issues; at end of support, SonicWall says it no longer provides technical support, firmware updates/upgrades or hardware replacement, even though some subscriptions may continue. A continuing subscription is not proof that the device can still receive security patches.
SonicWall’s 2024 advisory for CVE-2024-40766 covered specified Gen 5, Gen 6 and early Gen 7 versions and recommended restricting SSL VPN to trusted sources or disabling internet access to it for affected products. That example is not universal: the exact model and SonicOS build determine applicability. If an old device has no applicable fix, restrict or disable the exposed service where feasible, review access logs, reduce reachable network segments and plan a supported replacement. A scan finding alone does not automatically mean a fine; Article 16 requires identified risks to be addressed and recorded. If a flaw can be exploited before login, MFA does not replace patching or removing the public exposure.
Can SD-WAN simply replace the VPN for employees who travel?
Not by default. SD-WAN commonly addresses connectivity and path management among branches, data centers and cloud environments. Mobile users still need an explicit remote-access capability. Some vendors offer an integrated SD-WAN remote-access feature, but that capability is product-specific and must be checked for client support, identity and device controls, licensing, segmentation and user scale.
If the customer has only one or two offices and the main requirement is access for traveling staff, a full SD-WAN deployment solely for that purpose may be overbuilt. Compare a supported firewall refresh that retains remote access, a dedicated supported remote-access gateway, or an appropriate ZTNA/SASE service. If the organization also has multi-branch connectivity or WAN performance needs, SD-WAN may solve several problems together. Separate the branch-network requirement from the mobile-user requirement in both the design and the cost estimate. A secure remote-access service has a cost, but it need not imply a complete SD-WAN rebuild.
From compliance documents to verifiable day-to-day security
Order No. 151 already allowed remote vulnerability testing. Order No. 176 should not be reduced to “the authorities can now pentest everything.” A more accurate reading is that the supervisory framework covers a broader set of responsibilities, clarifies technical methods and procedural boundaries, and links findings to verification, remediation and records.
For foreign companies and government organizations, a robust response is not to buy every available control. It is to know which assets and data activities matter, select safeguards proportionate to their role and impact, keep unsupported public-facing systems from remaining unmitigated, and preserve evidence that identified risks were handled and verified.
DELine supports enterprise and government clients with cybersecurity assessment, infrastructure and security-control design, ongoing operations and remediation planning. Learn more at the DELine website or contact us.
This article provides a general interpretation of public legal and vendor materials, not legal advice for a specific organization or system. Applicability, product lifecycle and patch status must be checked against the organization’s actual operating model, device model and firmware version.
References
- MPS Order No. 176, full text (Ministry of Public Security; Chinese)
- Cybersecurity Law of the People’s Republic of China, 2025 revision (CAC; Chinese)
- Order No. 151 English translation, Stanford DigiChina
- SonicWall product lifecycle table
- SonicWall PSIRT advisory: CVE-2024-40766
- SonicWall product security notice and mitigation guidance
- Cisco Catalyst SD-WAN Remote Access overview (vendor-specific feature example)
