Security compliance
As Internet services rapidly expand, cybersecurity incidents are becoming more frequent across various sectors. Regulations now demand higher and clearer standards for establishing and improving cybersecurity. When expanding their online applications, government services must prioritize security and compliance. Alibaba Cloud Gov Cloud meets the national MLPS level 4 certification requirements. It provides a secure and compliant cloud platform and services for government users.
Regulatory background
On November 7, 2016, the Standing Committee of the 12th National People's Congress passed the Cybersecurity Law of the People's Republic of China. The law came into effect on June 1, 2017.
Under the Cybersecurity Law, government agencies and enterprises must fulfill specific obligations and responsibilities for network security. For an analysis of the law's key points, see the relevant chapter in *Basic Requirements for Classified Protection of Cybersecurity*.
Article 21 of the Cybersecurity Law states: The state shall implement a classified protection system for cybersecurity. This system, known as the Multi-Level Protection Scheme (MLPS), applies to all information systems in China. Government agencies and enterprises must fulfill security obligations in accordance with the MLPS. This includes applying for and completing a classification assessment, and then building or modifying information systems to meet the requirements of their assigned protection level. Fulfilling these obligations helps enterprises identify and fix security weaknesses, which in turn improves their overall competitiveness. For more information about the MLPS, see Appendix 2: Introduction to classified protection.
Shared responsibility for cloud systems
When assessing security compliance, both the cloud platform used by government agencies and enterprises and the applications deployed on it must meet the classified protection certification requirements. Alibaba Cloud and the customer share responsibility for the compliance of systems on the cloud.
Figure 1. Shared responsibility for cloud systems