4 Major Challenges of Implementing MLPS 2.0 in SMEs

Since MLPS 2.0 (China’s Multi-Level Protection Scheme) came into force in 2019, plenty of small and medium-sized enterprises in Beijing have been told by clients or larger contracting parties to “get MLPS certified.” Only after digging through the materials themselves do they realise the process is far more complicated than expected. Grading and filing means visiting the competent authorities, gap analysis means hiring a qualified assessment body, remediation means buying equipment and upgrading systems, and the evaluation itself is billed separately — once the numbers are added up, many companies find their budgets blown badly. Today we’ll skip the concepts and talk only about practice.

Challenge One: Grading and Filing — You May Think Your System Is Critical, but the Competent Authority Decides

The first step in MLPS is grading, which sounds simple: the enterprise decides which level its system falls under, then files with the public security authorities. In practice, however, over-grading is the most common mistake. Many companies assume that because a system matters and serves many staff, they should file at Level 3 — and their remediation and evaluation costs then double. Others err in the opposite direction, grading a business system that holds large volumes of user data as Level 2, only to have it sent back for re-grading during the authority’s review, wasting all the work already done.

A practical recommendation: before formal grading, review the three factors set out in the Guidelines for Grading of Cybersecurity Multi-Level Protection — the type of business the system supports, the object harmed by a breach, and the degree of impact. If the company is unsure internally, it is worth having a qualified evaluation body carry out an informal assessment; that is far less trouble than filing first and then being ordered to re-grade. Grading and filing materials include the system topology diagram, the emergency response plan, and a data asset inventory — incomplete submissions will be returned again and again.

Challenge Two: Gap Analysis — Checking Against the Standard Is Easy, but Finding Where the Real Spending Lies Is Not

Once they have the technical and management control items required by MLPS, in-house IT staff usually run a self-check first. Verifying that servers are patched, logs are retained, and password policies are compliant — these surface items are easy to pass. What actually blocks an evaluation, however, tends to be structural deficiencies: a core switch that does not support flow logs, a missing admission control system, or no intrusion detection equipment at the security zone boundary.

The quality of the gap analysis report directly determines the subsequent remediation budget. A sloppy assessment body lists problems without estimating costs, and the company only discovers the budget is insufficient when it takes the report to management for approval. A professional report tiers its findings into “mandatory remediation,” “recommended remediation,” and “optional optimisation,” making it easy for the company to invest in phases. One reminder: gap analysis is not a one-off exercise — re-testing is required after remediation, and if the remediation falls short, the evaluation body will issue a failed report, which affects whether the company obtains its certificate.

Challenge Three: Remediation Workload — Buy the Right Equipment, Finish the Upgrades, and Management Policies Are Still the Big Pitfall

Technical remediation is relatively easy to quantify: firewalls, log auditing, bastion hosts, and vulnerability scanning tools all carry clear market prices. But MLPS 2.0’s requirements for management policies catch many companies off guard. A Level 2 system requires an information security management policy framework; Level 3 requires a complete set of security policy documents, emergency plans, inspection records, and staff security training records. Many SMEs have no dedicated security engineer, so policy documents are either copied from online templates that do not fit at all, or drafted by an agency — and the gaps show the moment an expert asks for details during the evaluation.

Challenge Four: Evaluation Fees — Behind a Low Bid There May Be a Second Round of Charges

Quotes in the MLPS evaluation market vary widely: a Level 2 system evaluation may be quoted at under RMB 30,000, or at over RMB 80,000. A low price is not necessarily a trap, but you must ask clearly whether it includes: re-testing fees if the first evaluation fails, on-site technical support during remediation, and filing accompaniment services after the report is issued. Some bodies sign at a low price and then, during the evaluation, demand extra payment on the grounds that “high-risk vulnerabilities requiring remediation were found” — refusing to issue a passing report otherwise.

Level 3 system evaluation fees typically run between RMB 120,000 and RMB 250,000, with the spread driven mainly by system complexity. You also need to account for the downtime window during remediation — evaluation usually takes one to two days, during which the system must be available for testing and business cannot be interrupted. Some companies opt for nighttime evaluation, but employees must be notified in advance and data backups prepared.

Common Misconceptions: “Getting MLPS Certified” Does Not Mean You Are Secure

MLPS is not something a single certificate can resolve. Passing the evaluation only means the system met the standard’s requirements at one point in time, while cyber threats evolve every day. Many companies power down their security equipment the moment the certificate arrives, believing the job is done — that is the biggest misconception of all. MLPS 2.0 itself requires companies to conduct vulnerability scanning, security training, and emergency drills on a regular basis; sustained investment is what matters.

Another common misconception is that “internal network systems don’t need MLPS.” As long as a system carries business data, user information, or financial data, it must be graded and filed regardless of whether it is exposed to the internet. A manufacturing company once assumed that its isolated production intranet needed no MLPS, only to be picked up in a spot check by the competent authority, ordered to complete the paperwork retroactively, and required to explain its data flows — making the remediation cost higher than it would have been.

A Reference Plan for a 100-Person Company: How to Handle a Level 2 System

Take a Beijing SME of around 100 employees: its IT infrastructure typically includes two to three physical servers or a virtualisation platform, a core switch, behaviour management or a firewall, and separate network zones for the office network and business systems. At this scale, for Level 2 MLPS we recommend a two-phase approach:

1. Phase One: Grading and filing + gap analysis (2 to 3 weeks). Engage a qualified evaluation body to complete the grading and filing, commission a full gap analysis, and produce a remediation checklist. Costs at this stage run roughly RMB 15,000 to RMB 30,000.
2. Phase Two: Technical remediation + policy development (4 to 8 weeks). Purchase the necessary equipment based on the gap analysis findings; a suggested list includes a log auditing system, a bastion host, and a next-generation firewall or unified threat management appliance. For management policies, templates can be customised, but they must be adapted to the company’s actual business processes. Once remediation is complete, book the evaluation body for the formal assessment.

Overall cost estimate: RMB 40,000–80,000 for evaluation, RMB 80,000–150,000 for technical remediation, and RMB 10,000–20,000 for management policies and training. If the company already deployed basic security equipment as part of IT Operations Outsourcing, remediation costs can be reduced further.

For companies that would rather not keep investing in security hardware piece by piece, bundling security capabilities with network infrastructure is another option. The Network Equipment Package from Siwenlide includes equipment provision for the term of the contract, and our IT Operations Outsourcing team can help the company manage the entire MLPS remediation process end to end, avoiding the detours that come with building an in-house team. If you are interested, talk to our technical consultants first to see how far your current IT environment is from passing MLPS.