Background: Siemens’ Industrial Cybersecurity Challenge in China
Siemens is China’s largest foreign-invested industrial automation provider, with over 30,000 employees across the country, multiple R&D centers in Beijing, Shanghai, Suzhou, Wuxi, and Nanjing, and an installed base that spans power generation, chemical processing, pharmaceutical manufacturing, automotive production, and oil and gas infrastructure. When the Chinese government began intensifying cybersecurity enforcement under MLPS 2.0 (Multi-Level Protection Scheme 2.0, GB/T 22239-2019) in late 2021, Siemens faced a uniquely complex challenge: not only did it need to secure its own corporate network and data, but its industrial control products — the Siemens SIMATIC S7 controllers, SCALANCE network appliances, TIA Portal engineering software, and WinCC SCADA systems — were themselves the infrastructure that customers needed to secure against China’s cybersecurity requirements.
In February 2022, a major customer in Zhejiang Province — a large chemical manufacturer operating in the Ningbo Petrochemical Zone — received notification from the local Public Security Bureau (PSB) that its industrial control systems would undergo an MLPS 2.0 Level 3 inspection within 30 days. The customer’s production lines were powered by Siemens automation systems. The PSB’s inspection would determine whether the factory could continue operating or face suspension. Siemens China was called in on February 21, 2022 — with exactly 30 days to retrofit an entire chemical plant’s ICS (Industrial Control System) security posture to pass a Level 3 inspection.
China’s MLPS 2.0 Inspection Regime for Industrial Control Systems
MLPS 2.0 represented a fundamental shift from its 2007 predecessor. For industrial control systems, Level 3 (the standard for systems whose compromise would cause “serious harm to social order or public interests”) required comprehensive controls across seven domains. Siemens had been preparing for this moment since 2019, when it opened its IoT & Cybersecurity Lab in Suzhou specifically to develop China-specific industrial security solutions aligned with MLPS 2.0 requirements.
| MLPS 2.0 Control Category | Level 3 Requirements (ICS-specific) | Relevant Siemens Technology |
|---|---|---|
| Physical Security | Access control, environmental monitoring, CCTV | Standard physical security (customer-managed) |
| Network Security | Network zoning, boundary protection, traffic monitoring | SCALANCE S615 firewall; SCALANCE SC series switches |
| Host/Device Security | Hardened OS, security baseline, malware protection, logging | SIMATIC S7-1500 hardened controllers; TIA Portal security settings |
| Application Security | Secure development lifecycle, software integrity verification | Industrial Security for TIA Portal (certified CCRC Jan 2023) |
| Data Security | Data classification, encryption, backup and recovery | WinCC data archiving; Integrated backup in TIA Portal V17+ |
| Audit and Compliance | Comprehensive logging, audit trail, incident reporting | SIMATIC Logging; Central Audit Server (CAS) |
| Security Management | Policies, procedures, staff training, third-party management | Siemens Industrial Security Services (consulting + training) |
The 30-day constraint was extraordinarily tight. Typical MLPS 2.0 Level 3 implementations for greenfield industrial sites take 6-12 months. For a brownfield retrofit — an existing operational chemical plant where downtime means millions in lost production revenue — the challenge was amplified by the need to maintain continuous operations throughout the security retrofit.
Navigating the Process: Siemens’ 30-Day Sprint
Siemens China deployed a specialized Industrial Security Response Team from its recently established Industrial Security Competence Center (Beijing, opened March 2021) and its IoT and Cybersecurity Lab in Suzhou (opened June 2019). The team followed a structured “Defense-in-Depth” methodology adapted specifically for the MLPS 2.0 framework, organized into four workstreams running in parallel:
Week 1 — Assessment and Design (Feb 21-27): The Siemens team conducted a rapid scoping assessment of the plant’s existing OT (Operational Technology) network architecture. The plant had a flat network topology — all industrial controllers, engineering workstations, and the enterprise IT network shared a single Layer 2 domain. This violated MLPS 2.0’s network zoning requirement (Security Level 3 requires at least 3-3-3 zoning: zone separation, boundary protection, and controlled access). Siemens designed a three-zone architecture separating the enterprise IT zone, the manufacturing execution zone (MES), and the process control zone (Level 0-2), with SCALANCE S615 firewalls at each boundary. The team produced a comprehensive “Security Implementation Specification” mapping each MLPS 2.0 control to specific Siemens product configurations.
Week 2 — Active Security Implementation (Feb 28 – Mar 6): The retrofit focused on “active security” measures deployable without production shutdown. Siemens installed SCALANCE S615 industrial firewalls at three network boundaries, configured virtual LAN (VLAN) segmentation on the SCALANCE XC-200 series managed switches, and deployed the SIMATIC WinCC Security Extension for centralized audit logging. The team also implemented the Siemens Industrial Security Cell Protection Concept — defining six “security cells” corresponding to process units (reactor unit, distillation unit, storage tank farm, utilities, loading bay, and administrative building). Each cell was protected by its own SCALANCE S615, with traffic between cells subject to whitelist-only rules.
Week 3 — Host and Device Hardening (Mar 7-13): This week addressed host and device security. Siemens engineers hardened the six engineering workstations (applying the Siemens Industrial Security Baseline for Windows 10 IoT Enterprise), implemented USB port control and application whitelisting via Windows AppLocker, configured SIMATIC S7-1500 controllers with security-settings enabled (tamper protection, communication encryption, and access-level password protection), and deployed the Central Audit Server (CAS) for aggregated log collection across all security cells. Four older SIMATIC S7-300 controllers (installed 2015) that lacked native security features were isolated in a protected network cell behind a SCALANCE S615, with all external communication routed through a security gateway.
Week 4 — Testing, Documentation, and Remediation (Mar 14-22): The final phase focused on the audit trail documentation required for MLPS 2.0 certification — a critical but often underestimated component. Siemens produced a comprehensive security implementation specification document mapping each MLPS 2.0 control requirement to the specific Siemens product configuration applied, conducted vulnerability scanning using the Siemens Industrial Vulnerability Scanning Tool (compatible with China’s CNVD vulnerability database), and performed a dry-run inspection with a third-party evaluator accredited by the China Cybersecurity Review Technology and Certification Center (CCRC). Three minor findings were remediated: one SCALANCE firewall had outdated firmware (updated via SINEC PNI); one engineering workstation was missing a critical Windows security patch (applied during scheduled downtime); and the log retention period on the CAS was configured at 90 days instead of the required 180 (adjusted to 180 days).
Key Challenges and Mitigation
- Zero-downtime requirement: The chemical plant could not pause production — each hour of downtime cost approximately RMB 1.2 million in lost output. Mitigation: Siemens deployed a “brownfield deployment methodology” that installed SCALANCE firewalls in bridged mode initially, cut over to active filtering one zone at a time during 2-hour maintenance windows, and maintained fallback capability for each zone.
- Flat network architecture: The original topology had no network segmentation — a direct MLPS 2.0 violation. Mitigation: Siemens implemented “soft segmentation” via VLANs and firewall rules before physical re-cabling, allowing logical separation within 7 days while physical rewiring was scheduled for a future plant shutdown.
- Audit documentation gap: The plant had no formal security documentation — no network topology diagrams, no asset inventory, no incident response plan. Mitigation: Siemens’ consulting team produced 47 standardized documents in 10 working days, using templates from the Siemens Industrial Security documentation package pre-configured for MLPS 2.0 compliance.
- Legacy controller compatibility: Four older SIMATIC S7-300 controllers (installed 2015) lacked native security features — no encryption, no authentication. Mitigation: These were isolated in a protected network cell behind a SCALANCE S615, with all external communication routed through a security gateway that enforced encryption and authentication at the cell boundary.
- Operator training: Plant operators had no cybersecurity training and were unfamiliar with new security procedures. Mitigation: Siemens delivered two-day on-site training covering incident reporting, security awareness, and basic log review for 36 operators across 4 shifts.
Lessons for Foreign Investors
- Pre-built compliance toolkits are invaluable. Siemens’ MLPS 2.0 Industrial Security Solution, developed in 2020 in partnership with China Electronics Corporation (CEC), provided pre-configured security baselines, template documentation, and compliance checklists that compressed what would have been 3 months of planning into 7 days.
- Local competence centers matter. Siemens’ Suzhou IoT and Cybersecurity Lab (2019) and Beijing Industrial Security Competence Center (2021) were specifically designed for China’s regulatory environment. Having local technical resources with Mandarin-speaking, CCRC-certified engineers was decisive — a team flown from Germany would have added weeks.
- Partnerships with local cybersecurity vendors reduce friction. Siemens’ existing partnership with Venustech (signed June 2020) provided Chinese threat intelligence feeds integrated into the SCALANCE security appliances, while its partnership with Qianxin (October 2021) provided the situational awareness platform for the chemical plant’s centralized monitoring.
- Documentation is as important as technology. The MLPS 2.0 inspection passes on evidence, not architecture. The 47 documents Siemens produced were reviewed line-by-line by the PSB inspector. Investing in documentation templates and compliance management tools is essential.
- The 30-day race is not recommended — but preparatory investment makes it possible. Siemens’ ability to respond in 30 days was the result of years of investment in China-specific security products (SCALANCE S615 with CCRC certification, July 2022), partnerships with Chinese cybersecurity vendors, and regulatory localization. Foreign enterprises should build this capability before they need it.
Where to Go From Here
Siemens’ 30-day MLPS 2.0 inspection sprint demonstrates that rapid cybersecurity compliance in China is achievable when the right foundation is already in place:
- Read our step-by-step guide: Preparing for an MLPS 2.0 inspection in under 60 days [guide: SLUG-TO-BE-FILLED]
- Compare the three MLPS certification levels — Level 2, Level 3, and Level 4 — and their implications for foreign enterprises [comparison: SLUG-TO-BE-FILLED]
- Use our Industrial Security Readiness Assessment Tool to evaluate your MLPS compliance posture [tool: SLUG-TO-BE-FILLED]
The Siemens case offers a powerful lesson: cybersecurity compliance under MLPS 2.0 is a systematic engineering challenge, not a legal abstraction. By investing in localized security products, regulatory partnerships, and pre-configured compliance toolkits, foreign enterprises can not only pass inspections but turn compliance into a competitive advantage in China’s industrial market. The question is not whether you can meet a 30-day deadline — it is whether you have invested enough in advance to make it possible.
— China Gateway 360 —
Remote China market entry support, built around execution.
