Chapter I General Provisions
Article 1 With a view to strengthening the administration of commercial cipher codes, protecting the information security and the legitimate rights and interests of citizens and organizations, and safeguarding the security and interests of the State, the Regulations is formulated.
Article 2 The term "commercial cipher codes" as mentioned in the Regulations refers to the cryptographic techniques and cryptographic products used for encipherment protection or security certificate on the information not involved in state secrets.
Article 3 Commercial cryptographic techniques belong to state secret. The State implements special control over the research, production, sales and use of commercial cryptographic products.
Article 4 State Encryption Management Commission and its office (hereinafter referred to as the cryptography administration organization of the State) are responsible for the administrative affairs of commercial cipher codes throughout the country. The cryptography administration organization of provinces, autonomous regions and municipalities directly under the Central Government shall undertake the administrative affairs of commercial cipher codes under the entrustment of the cryptography administration organization of the State.
Chapter II Management of Scientific Research and Production
Article 5 The scientific research task of commercial cipher codes shall be undertaken by the unit designated by the cryptography administration organization of the State. The designated scientific research unit of commercial cipher codes must be provided with the corresponding technical strength and equipment, can adopt advanced coding theory and technology and compile commercial cryptographic algorithm with high confidentiality and anti-attack capability.
Article 6 The scientific research achievements of commercial cipher codes shall be reviewed and authenticated by experts organized by the cryptography administration organization of the State in accordance with the technical standards and technical specifications for commercial cipher codes.
Article 7 The commercial cryptographic products are produced by the unit designated by the cryptography administration organization of the State. Any unit or individual, without designation, shall not produce such products. The designated production unit of commercial cryptographic products must have the appropriate technical strength and the equipment, production process and quality assurance system to ensure the quality of commercial cryptographic products.
Article 8 The varieties and models of commercial cryptographic products produced by the designated production units must be approved by the cryptography administration organization of the State and shall not be out of the approved scope.
Article 9 The commercial cryptographic products must pass the testing of production quality testing organization designated by the cryptography administration organization of the State.
Chapter III Sales Management
Article 10 The commercial cryptographic products are sold by the unit permitted by the cryptography administration organization of the State. Any unit or individual, without permission, shall not sell such products.
Article 11 The sales unit of commercial cryptographic products shall propose application to the cryptography administration organization of the State, and shall:
(I) have personnel who is familiar with the knowledge of commercial cryptographic products and undertakes after-sales service;
(II) have perfect sales service and security management rules and regulations;
(III) have independent legal person qualification. The unit that has passed the examination can get a "Sales License for Commercial Cryptographic Products" issued by the cryptography administration organization of the State.
Article 12 For the sales of commercial cryptographic products, the name (full name), address (location), organization codes (resident identification number) of the user who directly uses the commercial cryptographic products, and the purpose of each commercial cryptographic product must be truthfully registered; and the registration status is reported to the cryptography administration organization of the State for the record.
Article 13 Imported cryptographic products and equipment containing cryptographic techniques or exported commercial cryptographic products must be reported to the cryptography administration organization of the State for approval. Any unit or individual shall not sell overseas cryptographic products.
Chapter IV Use Management
Article 14 Any unit or individual can only use commercial cryptographic products approved by the cryptography administration organization of the State, and shall not use cryptographic products developed by itself or produced overseas.
Article 15 The use of cryptographic products or equipment containing cryptographic techniques by an overseas organization or individual in China, excluding foreign diplomatic missions or consulates, must be reported to the cryptography administration organization of the State for approval.
Article 16 The users of commercial cryptographic products shall not transfer the commercial cryptographic products used by them. In case of fault, the commercial cryptographic products must be repaired by the unit designated by the cryptography administration organization of the State. The scrapping and destruction of commercial cryptographic products shall be reported to the cryptography administration organization of the State for the record.
