← Frameworks / MLPS 2.0 / Control Mappings

GB/T 22239-2019 Multi-Level Protection Scheme 2.0 (Level 3)

China's mandatory cybersecurity classification and protection standard for information systems. Level 3 applies to government, finance, healthcare, energy, and critical infrastructure. Covers 10 security domains: physical environment, communication network, area boundary, computing environment, security management center, management system, management organization, personnel security, construction management, and operations management. Includes extension requirements for cloud computing, mobile internet, IoT, and industrial control systems. Enforced by the Ministry of Public Security through mandatory classification filing (备案) and periodic assessment by licensed testing organisations (等级测评).

Controls: 130
Total Mappings: 251
Publisher: Standardization Administration of China (SAC) / Ministry of Public Security Version: 2019
MLPS 2.0 → SP 800-53 SP 800-53 → MLPS 2.0 Coverage Analysis
AC (13) AT (4) AU (10) CA (3) CM (7) CP (9) IA (7) IR (5) MA (4) MP (5) PE (15) PL (5) PM (8) PS (5) PT (2) RA (3) SA (9) SC (7) SI (6) SR (3)

AC Access Control

Control Name MLPS 2.0 References
AC-01 Access Control Policies and Procedures
8.1.5.38.1.7.2
AC-02 Account Management
8.1.4.28.1.7.2
AC-03 Access Enforcement
8.1.3.28.1.4.28.28.48.5
AC-04 Information Flow Enforcement
8.1.2.18.1.3.28.28.5
AC-05 Separation Of Duties
8.1.10.48.1.4.2
AC-06 Least Privilege
8.1.10.48.1.4.28.1.5.1
AC-07 Unsuccessful Login Attempts
8.1.4.1
AC-12 Session Termination
8.1.3.28.1.4.10
AC-17 Remote Access
8.1.3.1
AC-18 Wireless Access Restrictions
8.1.3.18.38.5
AC-19 Access Control For Portable And Mobile Devices
8.3
AC-20 Use Of External Information Systems
8.1.3.1
AC-24 Access Control Decisions
8.1.4.2

AT Awareness and Training

Control Name MLPS 2.0 References
AT-01 Security Awareness And Training Policy And Procedures
8.1.8.2
AT-02 Security Awareness
8.1.8.2
AT-03 Security Training
8.1.8.2
AT-04 Security Training Records
8.1.8.2

AU Audit and Accountability

Control Name MLPS 2.0 References
AU-01 Audit And Accountability Policy And Procedures
8.1.5.2
AU-02 Auditable Events
8.1.3.58.1.4.38.1.5.18.2
AU-03 Content Of Audit Records
8.1.3.58.1.4.3
AU-06 Audit Monitoring, Analysis, And Reporting
8.1.3.58.1.4.38.1.5.28.1.5.4
AU-07 Audit Reduction And Report Generation
8.1.5.2
AU-08 Time Stamps
8.1.4.3
AU-09 Protection Of Audit Information
8.1.3.58.1.4.38.1.5.2
AU-11 Audit Record Retention
8.1.4.3
AU-12 Audit Record Generation
8.1.3.58.1.4.3
AU-13 Monitoring for Information Disclosure
8.1.5.2

CA Security Assessment and Authorization

Control Name MLPS 2.0 References
CA-02 Security Assessments
8.1.7.28.1.9.58.1.9.6
CA-05 Plan Of Action And Milestones
8.1.7.28.1.9.6
CA-07 Continuous Monitoring
8.1.5.38.1.7.28.1.9.6

CM Configuration Management

Control Name MLPS 2.0 References
CM-02 Baseline Configuration
8.1.10.48.1.10.68.1.9.5
CM-03 Configuration Change Control
8.1.10.48.1.10.68.1.10.88.1.5.1
CM-04 Monitoring Configuration Changes
8.1.10.88.1.9.4
CM-05 Access Restrictions For Change
8.1.10.88.1.5.1
CM-06 Configuration Settings
8.1.10.48.1.10.68.1.5.3
CM-07 Least Functionality
8.1.10.48.1.4.4
CM-08 Information System Component Inventory
8.1.10.18.1.10.68.28.3

CP Contingency Planning

Control Name MLPS 2.0 References
CP-01 Contingency Planning Policy And Procedures
8.1.10.11
CP-02 Contingency Plan
8.1.10.11
CP-03 Contingency Training
8.1.10.11
CP-04 Contingency Plan Testing And Exercises
8.1.10.118.1.10.9
CP-06 Alternate Storage Site
8.1.4.9
CP-07 Alternate Processing Site
8.1.4.9
CP-08 Telecommunications Services
8.1.2.1
CP-09 Information System Backup
8.1.10.98.1.4.98.2
CP-10 Information System Recovery And Reconstitution
8.1.10.98.1.4.9

IA Identification and Authentication

Control Name MLPS 2.0 References
IA-02 User Identification And Authentication
8.1.4.18.2
IA-03 Device Identification And Authentication
8.4
IA-04 Identifier Management
8.1.4.1
IA-05 Authenticator Management
8.1.10.78.1.4.1
IA-06 Authenticator Feedback
8.1.4.1
IA-08 Identification and Authentication (Non-Organizational Users)
8.1.4.1
IA-11 Re-authentication
8.1.4.1

IR Incident Response

Control Name MLPS 2.0 References
IR-01 Incident Response Policy And Procedures
8.1.10.108.1.10.11
IR-04 Incident Handling
8.1.10.108.1.5.4
IR-05 Incident Monitoring
8.1.10.108.1.5.4
IR-06 Incident Reporting
8.1.10.108.1.5.4
IR-08 Incident Response Plan
8.1.10.108.1.10.11

MA Maintenance

Control Name MLPS 2.0 References
MA-02 Controlled Maintenance
8.1.10.2
MA-03 Maintenance Tools
8.1.10.2
MA-04 Remote Maintenance
8.1.10.2
MA-05 Maintenance Personnel
8.1.10.2

MP Media Protection

Control Name MLPS 2.0 References
MP-02 Media Access
8.1.10.1
MP-03 Media Labeling
8.1.10.1
MP-04 Media Storage
8.1.10.1
MP-05 Media Transport
8.1.10.18.1.4.8
MP-06 Media Sanitization And Disposal
8.1.10.18.1.4.10

PE Physical and Environmental Protection

Control Name MLPS 2.0 References
PE-01 Physical And Environmental Protection Policy And Procedures
8.1.1.18.1.1.4
PE-02 Physical Access Authorizations
8.1.1.28.1.10.18.1.8.3
PE-03 Physical Access Control
8.1.1.28.1.1.38.1.10.18.48.5
PE-05 Access Control For Display Medium
8.1.1.3
PE-06 Monitoring Physical Access
8.1.1.28.1.1.38.1.10.1
PE-08 Access Records
8.1.1.28.1.8.3
PE-09 Power Equipment And Power Cabling
8.1.1.48.1.1.8
PE-11 Emergency Power
8.1.1.8
PE-13 Fire Protection
8.1.1.5
PE-14 Temperature And Humidity Controls
8.1.1.7
PE-15 Water Damage Protection
8.1.1.6
PE-18 Location Of Information System Components
8.1.1.1
PE-19 Information Leakage
8.1.1.9
PE-20 Asset Monitoring and Tracking
8.48.5
PE-21 Electromagnetic Pulse Protection
8.1.1.9

PL Planning

Control Name MLPS 2.0 References
PL-01 Security Planning Policy And Procedures
8.1.5.38.1.6
PL-02 System Security Plan
8.1.68.1.9.2
PL-04 Rules Of Behavior
8.1.6
PL-07 Concept of Operations
8.1.9.2
PL-08 Security and Privacy Architectures
8.1.9.2

PM Program Management

Control Name MLPS 2.0 References
PM-01 Information Security Program Plan
8.1.6
PM-02 Information Security Program Leadership Role
8.1.7.1
PM-04 Plan of Action and Milestones Process
8.1.10.3
PM-05 System Inventory
8.1.10.1
PM-10 Authorization Process
8.1.7.2
PM-13 Security and Privacy Workforce
8.1.7.1
PM-15 Security and Privacy Groups and Associations
8.1.7.2
PM-16 Threat Awareness Program
8.1.7.2

PS Personnel Security

Control Name MLPS 2.0 References
PS-03 Personnel Screening
8.1.8.1
PS-04 Personnel Termination
8.1.8.1
PS-05 Personnel Transfer
8.1.8.1
PS-06 Access Agreements
8.1.8.1
PS-07 Third-Party Personnel Security
8.1.8.3

PT Personally Identifiable Information Processing and Transparency

Control Name MLPS 2.0 References
PT-02 Authority to Process Personally Identifiable Information
8.1.4.11
PT-03 Personally Identifiable Information Processing Purposes
8.1.4.11

RA Risk Assessment

Control Name MLPS 2.0 References
RA-02 Security Categorization
8.1.9.1
RA-03 Risk Assessment
8.1.10.38.1.9.2
RA-05 Vulnerability Scanning
8.1.10.38.1.4.4

SA System and Services Acquisition

Control Name MLPS 2.0 References
SA-03 Life Cycle Support
8.1.9.48.1.9.5
SA-04 Acquisitions
8.1.9.38.1.9.48.38.5
SA-05 Information System Documentation
8.1.9.5
SA-08 Security Engineering Principles
8.1.9.4
SA-09 External Information System Services
8.1.10.128.1.9.38.1.9.48.1.9.78.2
SA-10 Developer Configuration Management
8.1.9.5
SA-11 Developer Security Testing
8.1.9.48.1.9.5
SA-15 Development Process, Standards, and Tools
8.1.9.4
SA-17 Developer Security and Privacy Architecture and Design
8.1.2.38.1.3.68.1.4.6

SC System and Communications Protection

Control Name MLPS 2.0 References
SC-04 Information Remnance
8.1.4.108.2
SC-07 Boundary Protection
8.1.2.18.1.3.18.1.3.28.1.3.38.28.38.5
SC-08 Transmission Integrity
8.1.2.28.1.4.78.1.4.88.4
SC-12 Cryptographic Key Establishment And Management
8.1.10.78.1.2.2
SC-13 Use Of Cryptography
8.1.10.78.1.2.28.1.4.8
SC-28 Protection of Information at Rest
8.1.4.78.1.4.88.2
SC-32 System Partitioning
8.1.2.18.2

SI System and Information Integrity

Control Name MLPS 2.0 References
SI-02 Flaw Remediation
8.1.10.38.1.10.48.1.4.4
SI-03 Malicious Code Protection
8.1.10.58.1.3.38.1.3.48.1.4.5
SI-04 Information System Monitoring Tools And Techniques
8.1.10.58.1.3.38.1.4.48.1.4.58.1.5.48.28.38.48.5
SI-07 Software And Information Integrity
8.1.2.38.1.3.68.1.4.48.1.4.68.1.4.7
SI-08 Spam Protection
8.1.3.4
SI-12 Information Output Handling And Retention
8.1.4.11

SR Supply Chain Risk Management

Control Name MLPS 2.0 References
SR-01 Policy and Procedures
8.1.10.128.1.9.38.1.9.78.2
SR-03 Supply Chain Controls and Processes
8.1.10.128.1.9.4
SR-06 Supplier Assessments and Reviews
8.1.10.128.1.9.7