The One-Hour Rule: Navigating China’s Strict New Cybersecurity Incident Reporting Regime

BEIJING – A seismic shift is underway in China’s cybersecurity landscape. As of November 1, 2025, a stringent new set of regulations will take effect, mandating that operators of critical information infrastructure (CII) report major cybersecurity incidents to authorities within a mere one-hour timeframe. This aggressive deadline, a stark departure from the more lenient reporting windows in other global jurisdictions, presents a formidable compliance challenge for multinational corporations (MNCs) operating within the world’s second-largest economy. The new rules, officially titled the “Measures for the Administration of Cybersecurity Incident Reporting,” not only impose a significant operational burden but also introduce a fresh wave of legal risks and liabilities for companies that fail to comply. For MNCs and their legal counsel, the clock is ticking to understand and adapt to this new reality, where the first hour of a crisis is no longer just a technical challenge, but a high-stakes legal race against time.

A New Era of Mandatory Transparency

The new reporting regime, a significant tightening of China’s cybersecurity laws, establishes a tiered system for incident reporting, with the most stringent requirements reserved for CIIOs. According to the Measures, a “major” cybersecurity incident, which can include the interruption of a core business system for more than 10 minutes, triggers the one-hour reporting deadline for CIIOs. Other network operators are granted slightly more leeway, with a four-hour window for reporting. For particularly severe incidents, the reporting timeline is even shorter. This framework is a departure from the more common 72-hour notification window seen in regulations like the European Union’s General Data Protection Regulation (GDPR), placing immense pressure on companies to have a rapid and efficient incident response and reporting mechanism in place.

The Measures also specify the information that must be included in the initial report. This includes not only the basic details of the incident, such as the time of discovery and the affected systems, but also a preliminary assessment of the incident’s cause, the potential for future harm, and the type of government support required for recovery. This level of detail, required within such a short timeframe, presents a significant challenge for companies that may still be in the early stages of incident investigation and response.

The Practical Gauntlet: Challenges for Multinational Corporations

For multinational corporations (MNCs), the “one-hour rule” is not merely a regulatory hurdle; it represents a fundamental shift in incident response strategy. The hypothetical scenario of “AB Express” vividly illustrates the immediate and intense pressure faced by CIIOs [1]. In this scenario, a ransomware attack paralyzing a core production system at 2:00 AM triggers a legal crisis, not just a technical one. The General Counsel is forced to prioritize legal compliance—submitting a preliminary report within the one-hour window—over the global Chief Information Security Officer’s (CISO) inclination to first isolate the system and fully assess the damage. This highlights a critical divergence between standard global incident response protocols, which often emphasize thorough technical investigation before external communication, and China’s new mandate for immediate disclosure.

The practical difficulties extend beyond the initial reporting. MNCs typically operate with centralized incident response teams and established global communication protocols. China’s new rules necessitate a localized, agile, and legally informed response capability. The need to classify an incident’s severity, determine the reporting entity (CIIO, government agency, or other network operator), and identify the correct regulatory bodies (sector regulator, local public security bureau, provincial-level cyberspace administration department) all within minutes, demands significant investment in local expertise and robust internal processes [1].

Furthermore, the requirement to include details such as the preliminary cause, vulnerabilities exploited, and even ransom amounts in the initial report, along with an assessment of possible future harm and required government support, places an extraordinary burden on companies. This information is often not readily available in the immediate aftermath of a complex cyberattack. The pressure to provide such detailed information quickly could lead to premature conclusions or incomplete data, potentially complicating subsequent investigations or legal proceedings.

Navigating the Legal Minefield: Risks and Liabilities

The legal ramifications of non-compliance with China’s new cybersecurity incident reporting regime are substantial and far-reaching. The Cyberspace Administration of China (CAC) has made it clear that late, omitted, falsely reported, or concealed network security incidents leading to “major harmful consequences” will result in severe penalties for both network operators and responsible individuals [2]. These penalties can range from significant fines to suspension or cessation of business activities, and even criminal liability in severe cases.

One of the primary legal risks stems from the potential conflict between China’s rapid reporting requirements and other jurisdictions’ data privacy laws. For instance, while China demands immediate disclosure, other regulations might advise a more cautious approach to avoid disclosing sensitive information prematurely or without full understanding of the breach’s scope. MNCs must carefully balance these conflicting demands, potentially requiring separate, China-specific incident response plans.

Moreover, the broad definition of “network operator” and the expanding scope of “Critical Information Infrastructure” mean that many foreign companies previously unaffected by such stringent rules may now find themselves subject to the one-hour deadline. The lack of clarity around CII designation for some sectors adds another layer of uncertainty and risk. Companies must proactively assess their status and ensure they have the necessary legal and technical infrastructure in place to meet these new obligations.

The new rules also encourage social organizations and individuals to report incidents, and mandate that network operators stipulate reporting assistance obligations for outsourced service providers in contracts [1]. This broadens the net of potential reporting sources and increases the likelihood of incidents coming to the attention of authorities, even if the affected company attempts to manage it internally. This external pressure further underscores the need for proactive compliance and transparent communication.

In essence, China’s “one-hour rule” transforms cybersecurity incident response from a primarily technical and operational challenge into a critical legal and compliance function. MNCs must re-engineer their global incident response frameworks to accommodate these unique and demanding requirements, ensuring that legal and compliance teams are at the forefront of initial incident management. Failure to do so risks not only operational disruption but also severe legal and reputational damage in a market that remains vital for global businesses.

Conclusion: A Call to Action for Global Businesses

China’s

China’s new cybersecurity incident reporting regime, particularly the ‘one-hour rule’ for Critical Information Infrastructure Operators, marks a significant escalation in the country’s efforts to secure its digital landscape. For multinational corporations, this is not merely a bureaucratic adjustment but a fundamental redefinition of incident response. The practical difficulties of meeting such tight deadlines, coupled with the severe legal and financial penalties for non-compliance, necessitate a proactive and comprehensive overhaul of existing cybersecurity strategies. Companies must invest in localized expertise, streamline internal communication channels, and develop China-specific incident response plans that prioritize immediate legal and compliance reporting. The era of the ‘one-hour lifeline’ demands vigilance, agility, and a deep understanding of China’s unique regulatory environment. Failure to adapt will undoubtedly expose MNCs to significant operational disruption, legal liabilities, and reputational damage in a market that remains crucial for global economic growth.

References

[1] Lexology. (2025, September 22). The One-Hour Lifeline: A Guide for MNCs on China’s New Cybersecurity Incident Regulations. https://www.lexology.com/library/detail.aspx?g=923d17fd-6ae2-4a76-9fbe-9cb5e5d24485

[2] The Register. (2025, September 16). China: 1-hour deadline on serious cyber incident reporting. https://www.theregister.com/2025/09/16/china_1hour_cyber_reporting/