Information date: 16 October 2026 — China's MLPS 2.0 requires network operators to grade, file and test information systems, and the Data Export Security Assessment applies when a company transfers important data or covered personal information abroad. For a foreign manufacturer, plant IT and OT systems such as MES, ERP, SCADA and quality databases may fall under MLPS grading if they operate in China and disruption affects production or public interests. Separately, sending employee, customer or process data overseas can trigger export assessment, standard contract filing or certification. Knowing that statement is not enough for an operating, research or compliance decision. The team must first establish who and what it applies to, how the effect reaches the real process, and which evidence would justify action.
Verified facts and scope
China's MLPS 2.0 requires network operators to grade, file and test information systems, and the Data Export Security Assessment applies when a company transfers important data or covered personal information abroad. For a foreign manufacturer, plant IT and OT systems such as MES, ERP, SCADA and quality databases may fall under MLPS grading if they operate in China and disruption affects production or public interests. Separately, sending employee, customer or process data overseas can trigger export assessment, standard contract filing or certification.
First map every plant system located in China and every cross-border data flow. Confirm whether each system is an MLPS grading object, its proposed level, industry-specific rules, the volume and sensitivity of personal information, whether important data is involved, the overseas recipient and access path. Also check whether the group parent, cloud provider or service vendor can remotely access the system.
How the effect reaches operations
MLPS is a domestic security baseline: higher grades demand filing, periodic testing and remediation. The export assessment is a cross-border transfer gate: it looks at data type, volume, sensitivity and recipient country. They can apply at the same time, but one does not replace the other. A low MLPS grade does not exempt a company from export rules, and an export filing does not satisfy MLPS duties.
Manufacturers often assume OT systems are outside MLPS because they are not public-facing, or treat employee attendance and facial-recognition data as ordinary HR data. Sending production parameters, yield data or maintenance logs to a foreign parent may also be treated as important data or as revealing state secrets in sensitive sectors. Operating without grading or exporting without assessment can lead to warnings, fines, correction orders and suspension.
For “Comparison: China's MLPS 2.0 Cyber Grading vs the Data Export Security Assessment — Which Applies to a Foreign Manufacturer's Plant Systems”, official rules or published findings, direct evidence from the relevant product or process, and assumptions that remain untested should be recorded separately. A broad source defines the external boundary; it does not replace batch records, protocols, contracts, labels or direct observations.
Decision
If a plant system operates in China and its disruption affects production continuity, safety or public interests, carry out MLPS grading and filing. If any personal or important data goes to an overseas recipient, run a data-export risk self-assessment; if thresholds are met, apply for the security assessment. Where both apply, sequence MLPS filing first and run the export assessment in parallel.
Implementation checklist
- Draw a system and data-flow map covering OT, IT and remote access.
- Complete MLPS grading, filing and testing for in-scope systems.
- Assess export data and choose assessment, standard contract or certification.
- Assign one decision owner, one implementation owner and a dated review point for “Comparison: China's MLPS 2.0 Cyber Grading vs the Data Export Security Assessment — Which Applies to a Foreign Manufacturer's Plant Systems”.
- For “Comparison: China's MLPS 2.0 Cyber Grading vs the Data Export Security Assessment — Which Applies to a Foreign Manufacturer's Plant Systems”, archive the source page, access date, applicable population or entity, and internal evidence both supporting and opposing the current decision.
- When a rule, formulation, supplier, protocol or observed result changes, reopen only the affected question in “Comparison: China's MLPS 2.0 Cyber Grading vs the Data Export Security Assessment — Which Applies to a Foreign Manufacturer's Plant Systems”.
Evidence and review
For “Comparison: China's MLPS 2.0 Cyber Grading vs the Data Export Security Assessment — Which Applies to a Foreign Manufacturer's Plant Systems”, start with one real case rather than an abstract checklist. Record the input version, responsible owner, start time, observed result and stop condition. If the team cannot complete “Draw a system and data-flow map covering OT, IT and remote access.” with current evidence, it should not expand the process to more products, patients, suppliers or markets. The first review should focus only on facts capable of changing the decision.
The second control follows “Complete MLPS grading, filing and testing for in-scope systems.”. Keep the source date, applicable population or entity, deadline, cost effect and owner in the same evidence file. A wording preference does not justify a new version. A repeated discrepancy, an unsupported health claim or a regulatory mismatch does: correct that point and hold release until the evidence is available.
After “Assess export data and choose assessment, standard contract or certification.”, compare the intended outcome with what actually happened. Apply the same success criteria to each later expansion. If only one number, date or responsibility changes, update that field and the affected conclusion instead of recreating evidence that remains valid. This keeps the decision traceable without turning review into an open-ended rewrite cycle.
Limits of the conclusion
This comparison is not a legal opinion; grading levels, assessment thresholds and sector rules must be confirmed with CAC, MPS and the relevant industry regulator.
