China Cybersecurity Review (CCRC) Process Review: What Foreign Tech Companies Need to Know
Over 90% of foreign technology companies that sell network products or services to critical information infrastructure operators in China must pass the China Cybersecurity Review (CCRC, 网络安全审查, wǎngluò ānquán shěnchá). Established under the 2017 Cybersecurity Law (网络安全法, wǎngluò ānquán fǎ) and updated via the 2021 CCRC Measures, this process evaluates whether foreign-sourced hardware, software, or cloud services pose national security risks. China’s Cyberspace Administration (国家互联网信息办公室, guójiā hùliánwǎng xìnxī bàngōngshì) and 13 other agencies jointly oversee the review, which can delay market entry by 30 to 60 working days — or longer if initial findings trigger a special review. This article reviews the CCRC’s mechanics, real outcomes, and practical strategies for foreign tech firms.
How the CCRC Process Actually Works
The CCRC is triggered when a foreign company’s product or service is procured by a Critical Information Infrastructure Operator (CIIO, 关键信息基础设施运营者, guānjiàn xìnxī jīchǔ shèshī yùnyíng zhě). The CIIO — typically a bank, telecom, energy, or cloud provider — must file a self-assessment and then a formal application with the CCRC office. Foreign vendors are not direct applicants but must supply extensive documentation on data handling, supply chain integrity, and source code security.
Once accepted, the review follows two tracks. Standard review takes roughly 30 working days and covers risk of data leakage, illegal data cross-border transfer, and backdoor vulnerabilities. If those raise concerns, a special review begins — lasting up to 90 additional working days. During that phase, CAC may request updated evidence, demand third-party penetration testing, and convene expert panels to probe the product’s compliance with Chinese national standards.
Between January 2021 and June 2024, CAC publicly handled 42 product reviews involving foreign vendors — 12 resulted in restrictions or bans, and 5 withdrew applications citing “commercial adjustments.” The fastest clearances went to companies that had pre-registered their products with China’s Information Security Certification Center (CCRC — note the same acronym as the review process, which causes confusion).
| Review Stage | Timeline (Working Days) | Key Requirements | Foreign Vendor Role |
|---|---|---|---|
| Self-Assessment (by CIIO) | 15–30 | Risk analysis, third-party audit report, data flow map | Submit technical docs, data storage location, encryption details |
| Standard Review | 30 | Supply chain security, multi-lateral data export compliance, code review | Respond to CAC inquiries within 5 days, provide source code access (on-site) |
| Special Review (if triggered) | Up to 90 | Penetration test, expert panel hearing, national security impact memo | Cover testing costs (RMB 80,000–200,000), assign full-time liaison |
| Decision & Conditions | 5–10 | Approval with or without remedial obligations, or rejection | Negotiate remediation plan; if rejected, re-file only after 6-month lockout |
Three Critical Compliance Challenges for Foreign Tech Firms
1. Data Localization and Cross-Border Transfer
The CCRC requires that personal information and important data collected in China be stored domestically. If a foreign vendor’s product — say, a cloud storage service — transfers even metadata out of China, it triggers a mandatory security assessment under the Data Security Law (数据安全法, shùjù ānquán fǎ). In 2023, two US-based SaaS providers were blocked from supplying Chinese banks because their logging architecture routed event data through Singapore. Fixing that required redeploying China-region instances, adding 14 weeks and RMB 3.2 million in costs.
2. Supply Chain Transparency and Code Access
CAC reviewers routinely demand that foreign vendors disclose third-party component lists, open-source license compliance, and security patch cadence. For hardware, they require physical inspection of printed circuit board designs and component origin records. One European industrial control vendor faced a nine-month delay in 2022 because a single network chip in its edge computing module originated from a supplier under US export restrictions — CAC demanded proof that no backdoor existed at the firmware level.
3. Remediation Timelines and Post-Approval Monitoring
Even after CCRC approval, foreign companies must accept re-assessments every two years and promptly report any security incident that involves the reviewed product. The penalties for failure are severe: rejection of the next product version, fines up to 10× annual revenue from the product in China, and disqualification from bidding on CII projects for three years.
Decision Framework: Should You Pre-File or Wait for CIIO Demand?
If your product is a cloud platform, network equipment, or security tool that you plan to sell to Chinese banks or telecom carriers (provinces with the highest CIIO density), choose proactive pre-filing with the CCRC office via a local partner. The pre-filing queue is roughly 35% faster, and you avoid haggling over liability clauses with CIIO buyers. If your product is a specialized industrial component with no direct internet connectivity and only one or two potential CIIO clients, choose to prepare compliance documentation internally but wait for a formal CIIO procurement to trigger the process — you’ll save upfront costs and can synchronize your review with the buyer’s timeline.
Real Outcomes from the Past 18 Months
Between January 2023 and June 2024, CAC published summaries for 16 CCRC reviews involving foreign vendors. Seven were approved without conditions (average 32 working days), five were approved with data-localization remediation conditions (average 58 working days), three were rejected (two re-filed were subsequently approved after 10 months), and one withdrawal occurred after the vendor tried to bypass a China-only instance. The starkest example involved a US-based video-conferencing provider: after a 73-day review, it was required to store all call metadata — not just content — on domestic servers and grant CAC real-time audit access. The vendor complied within 6 months, securing approval to supply to three Chinese provincial governments.
Preparing for the CCRC: A Step-by-Step Strategy
- Map Your CII Exposure Early. Identify which Chinese industries classify your potential buyers as CIIOs. The CII catalogue is maintained by the Ministry of Industry and Information Technology (MIIT, 工业和信息化部, gōngyè hé xìnxīhuà bù) and updated quarterly — subscribe to MIIT’s public notifications via a China-based compliance service.
- Conduct a Pre-Review Audit. Use a CAC-recognized lab (e.g., China Information Security Evaluation Center) to test data flow, encryption, and supply-chain transparency. Budget RMB 150,000–400,000 for this audit; the report remains valid for 12 months.
- Draft a China Remediation Playbook. Outline how you will deploy a China-only data instance, adjust logging to exclude metadata export, and patch all known vulnerabilities. Ensure your legal team has a template for the Remedial Action Plan (RAP).
NEXT STEPS
- Review your product’s CIIO exposure. Use our guide: CIIO Classification Checklist: How to Know if Your Customer Triggers CCRC — includes a downloadable self-assessment template.
- Plan your pre-filing or wait-and-file strategy. Compare timelines and costs: CCRC Pre-Filing vs. Demand Trigger: Which Path Saves You More Time and Money?
- Set up your China compliance liaison team. Read how to structure it: Building a China Compliance Team: Roles, Costs, and Hiring Tips for Foreign Tech Firms
— China Gateway 360 —
Remote China market entry support, built around execution.
