← Frameworks / MLPS 2.0 / Control Mappings

Machine-readable: JSON API guide

GB/T 22239-2019 Multi-Level Protection Scheme 2.0 (Level 3)

China's mandatory cybersecurity classification and protection standard for information systems. Level 3 applies to government, finance, healthcare, energy, and critical infrastructure. Covers 10 security domains: physical environment, communication network, area boundary, computing environment, security management center, management system, management organization, personnel security, construction management, and operations management. Includes extension requirements for cloud computing, mobile internet, IoT, and industrial control systems. Enforced by the Ministry of Public Security through mandatory classification filing (备案) and periodic assessment by licensed testing organisations (等级测评).

Controls: 130
Total Mappings: 251
Publisher: Standardization Administration of China (SAC) / Ministry of Public Security Version: 2019
MLPS 2.0 → SP 800-53 SP 800-53 → MLPS 2.0 Coverage Analysis
AC (13) AT (4) AU (10) CA (3) CM (7) CP (9) IA (7) IR (5) MA (4) MP (5) PE (15) PL (5) PM (8) PS (5) PT (2) RA (3) SA (9) SC (7) SI (6) SR (3)

AC Access Control

Control Name MLPS 2.0 References
AC-01 Policy and Procedures
8.1.5.38.1.7.2
AC-02 Account Management
8.1.4.28.1.7.2
AC-03 Access Enforcement
8.1.3.28.1.4.28.28.48.5
AC-04 Information Flow Enforcement
8.1.2.18.1.3.28.28.5
AC-05 Separation of Duties
8.1.4.28.1.10.4
AC-06 Least Privilege
8.1.4.28.1.5.18.1.10.4
AC-07 Unsuccessful Logon Attempts
8.1.4.1
AC-12 Session Termination
8.1.3.28.1.4.10
AC-17 Remote Access
8.1.3.1
AC-18 Wireless Access
8.1.3.18.38.5
AC-19 Access Control for Mobile Devices
8.3
AC-20 Use of External Systems
8.1.3.1
AC-24 Access Control Decisions
8.1.4.2

AT Awareness and Training

Control Name MLPS 2.0 References
AT-01 Policy and Procedures
8.1.8.2
AT-02 Literacy Training and Awareness
8.1.8.2
AT-03 Role-based Training
8.1.8.2
AT-04 Training Records
8.1.8.2

AU Audit and Accountability

Control Name MLPS 2.0 References
AU-01 Policy and Procedures
8.1.5.2
AU-02 Event Logging
8.1.3.58.1.4.38.1.5.18.2
AU-03 Content of Audit Records
8.1.3.58.1.4.3
AU-06 Audit Record Review, Analysis, and Reporting
8.1.3.58.1.4.38.1.5.28.1.5.4
AU-07 Audit Record Reduction and Report Generation
8.1.5.2
AU-08 Time Stamps
8.1.4.3
AU-09 Protection of Audit Information
8.1.3.58.1.4.38.1.5.2
AU-11 Audit Record Retention
8.1.4.3
AU-12 Audit Record Generation
8.1.3.58.1.4.3
AU-13 Monitoring for Information Disclosure
8.1.5.2

CA Security Assessment and Authorization

Control Name MLPS 2.0 References
CA-02 Control Assessments
8.1.7.28.1.9.58.1.9.6
CA-05 Plan of Action and Milestones
8.1.7.28.1.9.6
CA-07 Continuous Monitoring
8.1.5.38.1.7.28.1.9.6

CM Configuration Management

Control Name MLPS 2.0 References
CM-02 Baseline Configuration
8.1.9.58.1.10.48.1.10.6
CM-03 Configuration Change Control
8.1.5.18.1.10.48.1.10.68.1.10.8
CM-04 Impact Analyses
8.1.9.48.1.10.8
CM-05 Access Restrictions for Change
8.1.5.18.1.10.8
CM-06 Configuration Settings
8.1.5.38.1.10.48.1.10.6
CM-07 Least Functionality
8.1.4.48.1.10.4
CM-08 System Component Inventory
8.1.10.18.1.10.68.28.3

CP Contingency Planning

Control Name MLPS 2.0 References
CP-01 Policy and Procedures
8.1.10.11
CP-02 Contingency Plan
8.1.10.11
CP-03 Contingency Training
8.1.10.11
CP-04 Contingency Plan Testing
8.1.10.98.1.10.11
CP-06 Alternate Storage Site
8.1.4.9
CP-07 Alternate Processing Site
8.1.4.9
CP-08 Telecommunications Services
8.1.2.1
CP-09 System Backup
8.1.4.98.1.10.98.2
CP-10 System Recovery and Reconstitution
8.1.4.98.1.10.9

IA Identification and Authentication

Control Name MLPS 2.0 References
IA-02 Identification and Authentication (Organizational Users)
8.1.4.18.2
IA-03 Device Identification and Authentication
8.4
IA-04 Identifier Management
8.1.4.1
IA-05 Authenticator Management
8.1.4.18.1.10.7
IA-06 Authentication Feedback
8.1.4.1
IA-08 Identification and Authentication (Non-organizational Users)
8.1.4.1
IA-11 Re-authentication
8.1.4.1

IR Incident Response

Control Name MLPS 2.0 References
IR-01 Policy and Procedures
8.1.10.108.1.10.11
IR-04 Incident Handling
8.1.5.48.1.10.10
IR-05 Incident Monitoring
8.1.5.48.1.10.10
IR-06 Incident Reporting
8.1.5.48.1.10.10
IR-08 Incident Response Plan
8.1.10.108.1.10.11

MA Maintenance

Control Name MLPS 2.0 References
MA-02 Controlled Maintenance
8.1.10.2
MA-03 Maintenance Tools
8.1.10.2
MA-04 Nonlocal Maintenance
8.1.10.2
MA-05 Maintenance Personnel
8.1.10.2

MP Media Protection

Control Name MLPS 2.0 References
MP-02 Media Access
8.1.10.1
MP-03 Media Marking
8.1.10.1
MP-04 Media Storage
8.1.10.1
MP-05 Media Transport
8.1.4.88.1.10.1
MP-06 Media Sanitization
8.1.4.108.1.10.1

PE Physical and Environmental Protection

Control Name MLPS 2.0 References
PE-01 Policy and Procedures
8.1.1.18.1.1.4
PE-02 Physical Access Authorizations
8.1.1.28.1.8.38.1.10.1
PE-03 Physical Access Control
8.1.1.28.1.1.38.1.10.18.48.5
PE-05 Access Control for Output Devices
8.1.1.3
PE-06 Monitoring Physical Access
8.1.1.28.1.1.38.1.10.1
PE-08 Visitor Access Records
8.1.1.28.1.8.3
PE-09 Power Equipment and Cabling
8.1.1.48.1.1.8
PE-11 Emergency Power
8.1.1.8
PE-13 Fire Protection
8.1.1.5
PE-14 Environmental Controls
8.1.1.7
PE-15 Water Damage Protection
8.1.1.6
PE-18 Location of System Components
8.1.1.1
PE-19 Information Leakage
8.1.1.9
PE-20 Asset Monitoring and Tracking
8.48.5
PE-21 Electromagnetic Pulse Protection
8.1.1.9

PL Planning

Control Name MLPS 2.0 References
PL-01 Policy and Procedures
8.1.5.38.1.6
PL-02 System Security and Privacy Plans
8.1.68.1.9.2
PL-04 Rules of Behavior
8.1.6
PL-07 Concept of Operations
8.1.9.2
PL-08 Security and Privacy Architectures
8.1.9.2

PM Program Management

Control Name MLPS 2.0 References
PM-01 Information Security Program Plan
8.1.6
PM-02 Information Security Program Leadership Role
8.1.7.1
PM-04 Plan of Action and Milestones Process
8.1.10.3
PM-05 System Inventory
8.1.10.1
PM-10 Authorization Process
8.1.7.2
PM-13 Security and Privacy Workforce
8.1.7.1
PM-15 Security and Privacy Groups and Associations
8.1.7.2
PM-16 Threat Awareness Program
8.1.7.2

PS Personnel Security

Control Name MLPS 2.0 References
PS-03 Personnel Screening
8.1.8.1
PS-04 Personnel Termination
8.1.8.1
PS-05 Personnel Transfer
8.1.8.1
PS-06 Access Agreements
8.1.8.1
PS-07 External Personnel Security
8.1.8.3

PT Personally Identifiable Information Processing and Transparency

Control Name MLPS 2.0 References
PT-02 Authority to Process Personally Identifiable Information
8.1.4.11
PT-03 Personally Identifiable Information Processing Purposes
8.1.4.11

RA Risk Assessment

Control Name MLPS 2.0 References
RA-02 Security Categorization
8.1.9.1
RA-03 Risk Assessment
8.1.9.28.1.10.3
RA-05 Vulnerability Monitoring and Scanning
8.1.4.48.1.10.3

SA System and Services Acquisition

Control Name MLPS 2.0 References
SA-03 System Development Life Cycle
8.1.9.48.1.9.5
SA-04 Acquisition Process
8.1.9.38.1.9.48.38.5
SA-05 System Documentation
8.1.9.5
SA-08 Security and Privacy Engineering Principles
8.1.9.4
SA-09 External System Services
8.1.9.38.1.9.48.1.9.78.1.10.128.2
SA-10 Developer Configuration Management
8.1.9.5
SA-11 Developer Testing and Evaluation
8.1.9.48.1.9.5
SA-15 Development Process, Standards, and Tools
8.1.9.4
SA-17 Developer Security and Privacy Architecture and Design
8.1.2.38.1.3.68.1.4.6

SC System and Communications Protection

Control Name MLPS 2.0 References
SC-04 Information in Shared System Resources
8.1.4.108.2
SC-07 Boundary Protection
8.1.2.18.1.3.18.1.3.28.1.3.38.28.38.5
SC-08 Transmission Confidentiality and Integrity
8.1.2.28.1.4.78.1.4.88.4
SC-12 Cryptographic Key Establishment and Management
8.1.2.28.1.10.7
SC-13 Cryptographic Protection
8.1.2.28.1.4.88.1.10.7
SC-28 Protection of Information at Rest
8.1.4.78.1.4.88.2
SC-32 System Partitioning
8.1.2.18.2

SI System and Information Integrity

Control Name MLPS 2.0 References
SI-02 Flaw Remediation
8.1.4.48.1.10.38.1.10.4
SI-03 Malicious Code Protection
8.1.3.38.1.3.48.1.4.58.1.10.5
SI-04 System Monitoring
8.1.3.38.1.4.48.1.4.58.1.5.48.1.10.58.28.38.48.5
SI-07 Software, Firmware, and Information Integrity
8.1.2.38.1.3.68.1.4.48.1.4.68.1.4.7
SI-08 Spam Protection
8.1.3.4
SI-12 Information Management and Retention
8.1.4.11

SR Supply Chain Risk Management

Control Name MLPS 2.0 References
SR-01 Policy and Procedures
8.1.9.38.1.9.78.1.10.128.2
SR-03 Supply Chain Controls and Processes
8.1.9.48.1.10.12
SR-06 Supplier Assessments and Reviews
8.1.9.78.1.10.12