How Does the MLPS 2.0 Grading Process Work for Foreign-Owned Operations in Mainland China?

Most foreign companies first meet MLPS 2.0 as a legal question: the compliance team confirms an obligation exists under China’s Cybersecurity Law, and the project stalls because nobody can say what happens on Monday morning. In practice, MLPS 2.0 grading is an operational project with a fixed sequence, a defined pass mark, and a calendar. The system is scoped, graded through self-assessment, reviewed by experts, filed with the local Public Security Bureau, remediated against a published standard, evaluated by a licensed assessment body, and re-assessed on a recurring cycle. The two variables that decide how hard the project is are the distance between your current controls and the GB/T 22239-2019 baseline, and the practice of your local Public Security Bureau. This article walks through each step, the realistic timeline, and the division of labor between internal IT and a licensed local partner. What the law itself requires and where the OT boundary sits belong to our guide to MLPS 2.0 compliance for IT and OT in Mainland China plants; this article covers the procedure.

Step 1: Establish Which Systems Need Their Own Grade

MLPS 2.0 grades individual systems rather than the company. The first step is an inventory that divides the Mainland China estate into objects of classification: each system with a clear security owner, an independent business function, and a set of interconnected resources. A typical foreign-owned operation files between two and five systems, each graded on its own.

Under the grading guideline GB/T 22240-2020 (AppInChina, 2026), an object of classification can be an information system, a communication network facility, or a data resource. For a foreign-owned operation, the usual candidates are the China-hosted ERP or CRM instance, the local network with its VPN gateway and file services, a China-facing website or WeChat backend, and workloads on Alibaba Cloud, Tencent Cloud, or AWS China.

Scoping is the first real decision, and it carries a trade-off. Bundling systems into one large object means fewer filings and fewer evaluations, but the highest-risk component inside the bundle drags the whole object up to its level, and every bundled system then inherits that level’s control burden and audit cadence. Splitting the estate into smaller objects isolates the expensive grades to the systems that genuinely warrant them, at the cost of more filings and more assessment fees. Manufacturing operations face an extra scoping question at the plant floor; the architecture behind that boundary is covered in our article on IT and OT for manufacturing companies operating across APAC.

Step 2: Propose a Grade Through Self-Assessment and Expert Review

The operator proposes each system’s grade in a self-assessment built on two factors: which interests a compromise would harm, and how severe the harm would be. Grades run from Level 1 to Level 5. Proposed grades of Level 2 and above then pass through an expert review before they can be filed.

Harm limited to the rights of citizens and organizations points to Level 1 or 2, harm to public order or public interest points to Level 2 or 3, and any touch on national security pushes higher; Level 4 and Level 5 are reserved for critical information infrastructure and state systems. Most foreign-owned commercial systems land at Level 2 or Level 3, and Level 3 is the most common outcome for foreign companies whose systems process personal data or run consumer-facing functions (AppInChina, 2026).

The proposed grade deserves management attention because both directions of error cost money. A grade proposed too low invites rejection at expert review or at the bureau counter, which restarts the clock. A grade proposed too high is worse, because it is durable: the operation signs up for a heavier control set and a tighter re-assessment cadence for the life of the system. The expert review exists to catch exactly these mismatches before the filing is made.

Step 3: File the Grade with the Local Public Security Bureau

The filing goes to the cybersecurity division of the Public Security Bureau in the city or district where the operating entity is registered. Under Article 15 of the Administrative Measures for the Hierarchical Protection of Information Security, the deadline is 30 days after the grade is determined (AppInChina, 2026). The bureau reviews the package and issues a filing record or returns it for rectification.

The package for a Level 2 or Level 3 system typically contains the classification report, the stamped filing registration form, the expert review opinion, a system overview describing boundaries and data flows, a network topology diagram, and a security responsibility statement naming the accountable individuals. Every document is prepared and submitted in Chinese, and the named responsible persons carry personal accountability under the Cybersecurity Law, so the legal representative needs to understand what is being signed, and the topology diagram needs to match what an assessor will later find on the ground.

Local practice varies more than the written rules suggest. Document templates, review appetite, and processing pace differ by city, which is why PTS Consulting (2026) flags local bureau practice as a main driver of timeline variance. A partner who has filed with the specific bureau before removes most of the guesswork here.

Step 4: Remediate Against the GB/T 22239-2019 Baseline

GB/T 22239-2019 is the standard the evaluation will test against. Published in May 2019 and in force since December 1, 2019 (Protiviti, 2022), it sets general requirements for physical environment, network, data protection, and security management at each level, plus extended requirements for cloud, mobile, IoT, and industrial control. Gap remediation consumes most of the project’s time and budget.

For an operation with a mature global security program, the gap analysis usually surfaces a familiar cluster: log retention and centralized audit trails that meet the baseline’s specifics, incident response documentation in Chinese, security products with the certifications the assessor expects to see, and monitoring coverage for the China environment itself. Teams already certified to ISO 27001 hold an advantage, since much of the management-system layer maps across, but the mapping is partial and the technical controls are graded against the Chinese standard, not the ISO one.

Resist the instinct to chase a perfect score. Protiviti (2022) notes that full implementation of every requirement is unnecessary for compliance and can conflict with an existing global standard, in some cases weakening protection. The sharper trade-off is tooling: remediating with the global toolset keeps the estate consistent for headquarters, while China-market security products tend to clear the evaluation with less friction. Most operations end up with a deliberate mix, chosen control by control.

Step 5: Pass the Licensed Evaluation and Complete the Filing

For Level 2 and above, a licensed assessment body tests the system against the baseline for its grade. The Ministry of Public Security’s cybersecurity departments maintain an official register of qualified agencies (AppInChina, 2026), and only a listed agency’s report counts. The pass mark is a minimum score of 75 out of 100 (Protiviti, 2022).

The evaluation itself resembles a structured audit. Assessors interview IT management and technical staff, review the security policies and design documents, and run technical verification against the control set for the graded level. The output is a scored assessment report. A score below 75 sends the system back into remediation followed by a re-test, so experienced operators run an internal pre-assessment against the same checklist first.

The signed assessment report goes back to the Public Security Bureau as the closing document of the cycle. The filing record plus a passing assessment is what “MLPS compliant” means in practice. It is a point-in-time result tied to the system as scoped, so material changes to architecture, hosting, or data types reopen the grading question.

The Timeline, the Re-Assessment Cadence, and Who Does What

Plan for three to six months end to end for a Level 2 or Level 3 system (PTS Consulting, 2026). The grade then sets a recurring cadence: Level 2 systems are re-assessed roughly every two years and Level 3 systems annually (Protiviti, 2022). Level 3 is an operating budget line, never a one-off project.

Within that envelope, scoping and grading move quickly and remediation absorbs the bulk of the calendar. The schedule slips at two points: procurement lead time on remediation items, and the bureau’s local pace, neither of which the IT team controls.

Ownership splits cleanly. Headquarters security sets policy, decides the scoping trade-offs, and approves the remediation budget. In-country IT, internal or outsourced, executes remediation and hosts the assessors. A licensed local partner prepares the Chinese-language documentation, manages the bureau relationship, and coordinates the assessment body, which is independent by design: it scores the system and cannot remediate it for you. What a foreign IT director cannot delegate is the grade proposal and the responsibility statement, because both bind the company. The rest of the process runs in Chinese, on local relationships, which is why the partner choice matters as much as the control work.

Frequently Asked Questions

What MLPS level applies to most foreign-owned operations in Mainland China?

Most foreign-owned commercial systems are graded Level 2 or Level 3. Level 3 applies once a system processes personal data of Chinese users, serves consumers, or runs core business functions, per AppInChina (2026). Level 1 covers only minimal-impact systems such as static informational sites, and it requires no Public Security Bureau filing.

How long does the MLPS 2.0 grading process take?

Between three and six months end to end for a Level 2 or Level 3 system, per PTS Consulting (2026). The spread depends on how far existing controls sit from the GB/T 22239-2019 baseline and on the local Public Security Bureau’s processing pace, which varies by city.

Who is allowed to perform the MLPS 2.0 evaluation?

Only assessment agencies licensed under the scheme. The Public Security Bureau’s cybersecurity departments maintain an official register of qualified agencies, per AppInChina (2026). An internal audit or a report from a global consultancy without the license does not satisfy the requirement, whatever its technical quality.

What happens if a system fails the licensed evaluation?

The system returns to remediation and is re-tested. The pass mark is 75 out of 100, per Protiviti (2022), and the scored report identifies exactly where points were lost. Experienced operators run an internal pre-assessment against the same checklist first, so the licensed evaluation confirms a result rather than discovering gaps.

Does an MLPS filing need to be renewed?

The filing itself does not expire, but the grade carries a re-assessment cadence: Level 3 systems are evaluated annually and Level 2 systems roughly every two years, per Protiviti (2022). Material changes to a system’s architecture, hosting, or data types reopen the grading question ahead of schedule.

Can systemsGo run the MLPS 2.0 grading process for a foreign company?

Yes. Through its Shanghai operation, systemsGo supports foreign-owned companies across the full cycle: scoping the estate into objects of classification, preparing the grade proposal, managing remediation against GB/T 22239-2019, and coordinating the Public Security Bureau filing and the licensed assessment body, with bilingual engineers handling the Chinese-language process throughout.

If a Mainland China system in your estate is approaching its first grading self-assessment or an annual Level 3 re-assessment, systemsGo’s bilingual engineers in Shanghai can scope the systems, manage remediation, and coordinate the licensed evaluation end to end.