Critical Information Infrastructure (CII) assessment is a systematic security evaluation that verifies whether vital network facilities and information systems in sectors such as energy, finance, transportation, and public services meet statutory protection obligations. Accredited third-party laboratories perform these evaluations in alignment with the Cybersecurity Law, the Critical Information Infrastructure Security Protection Regulations, and national standards including GB/T 39204-2022. This article explains the technical scope, assessment objects, testing items, methodologies, industry applications, and frequently asked questions related to CII assessment programs.
Technical Overview
Critical Information Infrastructure refers to network facilities and information systems operated in important industries and fields, including public communication and information services, energy, transportation, water conservancy, finance, public services, electronic governance, and defense-related industries, whose destruction, malfunction, or data breach may seriously endanger national security, the national economy, people's livelihood, or the public interest. A Critical Information Infrastructure assessment is a structured evaluation that measures the effectiveness of the security protection measures applied to these systems and verifies compliance with applicable legal and standards-based requirements.
The assessment framework rests on a layered regulatory and technical foundation. The Cybersecurity Law establishes the overarching protection obligation for network operators; the Critical Information Infrastructure Security Protection Regulations define the duties of operators and competent protection departments; GB/T 39204-2022 specifies baseline security protection requirements for critical information infrastructure; and the graded protection scheme commonly known as MLPS 2.0, defined in GB/T 22239-2019, provides the foundational control baseline on which enhanced CII protections are built. Supporting risk methodology is drawn from GB/T 20984 and internationally recognized standards such as ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27005.
A complete assessment program combines compliance verification, technical security testing, and quantitative risk analysis. The outcome is documented evidence of conformity, a prioritized risk register, and a remediation roadmap that operators can use to strengthen their protection posture and demonstrate due diligence to regulators and protection departments.
Testing Samples
The objects examined during a CII assessment, commonly referred to as samples or assessment targets, typically fall into the following categories.
Network and Communication Infrastructure
Core and aggregation routers, switches, firewalls, intrusion prevention systems, VPN gateways, bastion hosts, load balancers, DNS servers, wireless infrastructure, and interconnect links. Evaluation covers architecture redundancy, boundary protection strength, network segregation between zones, and secure management channels for critical devices.
Industrial Control and Operational Technology Systems
SCADA servers, programmable logic controllers, distributed control systems, human-machine interfaces, engineering workstations, safety instrumented systems, and remote terminal units deployed in energy, water, and transport environments. Testing is planned around IEC 62443 principles and adapted to the availability-first operating constraints of OT networks, prioritizing non-intrusive methods.
Core Business Systems, Applications, and Data Centers
Transaction and payment platforms, core banking or ERP systems, customer information databases, e-government portals, identity and access management systems, middleware, virtualization platforms, storage arrays, and backup and archiving facilities. Sample selection focuses on systems whose failure would interrupt essential services or expose sensitive data.
Cloud Platforms, Big Data Systems, and Supply Chain Components
Cloud infrastructure and platform services, container orchestration clusters, big data processing frameworks, data-sharing interfaces, commercial off-the-shelf software, open-source components, and outsourced development or operations arrangements that fall within the scope of supply chain security review obligations.
Testing Items
Testing items are derived from the control families of GB/T 39204-2022, the applicable MLPS grade requirements, and recognized risk management practices. The principal item groups are summarized below.
Compliance and Governance Evaluation
- Identification, classification, and filing of critical assets and critical business processes.
- Appointment and accountability of the primary security responsible person and supporting security functions.
- Review of security management policies, organizational structure, personnel screening, and security awareness training records.
- Supply chain and procurement security management, including vendor qualification, software provenance, and secure development requirements.
- Data governance items covering classification, important data protection, cross-border transfer compliance, and personal information protection alignment.
- Evidence of cooperation with protection departments, security reporting channels, and statutory notification obligations.
Technical Security Testing
- Network architecture analysis, zone segregation verification, and exposure of internet-facing assets.
- Vulnerability scanning of hosts, network devices, operating systems, middleware, and databases with verified findings.
- Penetration testing of web applications, APIs, mobile clients, and remote access paths, including business-logic abuse scenarios.
- Configuration baseline reviews against hardened benchmarks for servers, databases, and network equipment.
- Identity, authentication, and authorization control verification, including privileged access and multi-factor coverage.
- Effectiveness testing of malware defense, intrusion detection and prevention, and centralized log audit capabilities.
- Data security control testing covering encryption at rest and in transit, key management, desensitization, and leakage prevention.
- Cloud-native and container security checks, including image integrity, registry controls, and API gateway protections.
- ICS protocol and controller assessment for OT environments, including protocol weakness and unauthorized command exposure.
Resilience and Incident Response Verification
- Backup integrity validation and disaster recovery testing with recovery time and recovery point objective measurement.
- Incident response plan review and tabletop exercise execution for representative attack scenarios.
- Business continuity management verification consistent with ISO 22301 management concepts.
- Validation of emergency reporting chains, escalation thresholds, and communication with competent authorities.
Testing Methods
Assessment teams apply a combination of documentary, interview-based, and hands-on technical methods. Every intrusive activity is preceded by a written scope authorization and, in operational environments, by an agreed test window and rollback plan.
- Document and evidence review of policies, topology diagrams, asset inventories, change records, and prior audit results.
- Structured interviews and on-site inspection of equipment rooms, control centers, and physical protection measures.
- Automated vulnerability scanning using accredited tools, followed by manual verification to eliminate false positives.
- Manual penetration testing and optional red team exercises simulating realistic multi-stage attack chains.
- Configuration benchmark comparison of device and platform settings against secure baseline references.
- Quantitative risk assessment following GB/T 20984 methodology: asset identification, threat identification, vulnerability identification, likelihood and consequence analysis, and risk computation with treatment planning.
- External attack surface discovery and passive monitoring of exposed services and leaked credentials.
- Controlled social engineering simulations and physical security walkthroughs where contractually authorized.
Deliverables typically include a detailed assessment report, a compliance gap matrix, a severity-rated vulnerability and risk register, photographic and log evidence appendices, a prioritized remediation roadmap, and an executive summary suitable for submission to protection departments.
Applications
CII assessment services are applied wherever systems are designated or candidate-designated as critical information infrastructure, and increasingly as a due diligence instrument in sectors with heightened operational risk.
- Energy and electric power: grid dispatch systems, generation control networks, and energy management systems.
- Finance: payment and clearing platforms, core banking systems, securities trading infrastructure, and credit data platforms.
- Transportation: rail signaling networks, air traffic management systems, highway tolling, and port logistics platforms.
- Water conservancy and public utilities: water treatment SCADA, flood control monitoring, and gas distribution control systems.
- Healthcare: hospital information systems, regional health data platforms, and emergency response networks.
- Government and electronic governance: government cloud platforms, shared databases, and citizen service portals.
- Telecommunications: core networks, subscriber data systems, and interconnection infrastructure.
FAQ
What is the difference between a CII assessment and an MLPS grading evaluation?
MLPS grading evaluation verifies the baseline graded protection requirements applicable to all network operators, while a CII assessment is a supplementary and stricter evaluation applied to designated critical infrastructure under GB/T 39204-2022. The CII assessment adds enhanced requirements such as supply chain security, security protection department coordination, and heightened resilience obligations, and a designated operator must satisfy both regimes.
Who needs to undergo a Critical Information Infrastructure assessment?
Operators of facilities formally identified as critical information infrastructure by the competent protection department under the applicable identification rules. Operators in listed sectors that may meet the identification criteria are also advised to conduct readiness assessments in advance of formal designation.
How often should the assessment be performed?
Regulatory guidance and industry best practice call for a comprehensive assessment at least once per year, together with re-assessment after major events such as system integration, architecture migration, organizational restructuring, or significant security incidents. Continuous monitoring complements the periodic evaluation cycle.
How long does a typical assessment take?
Duration depends on scope. A focused assessment of a single-site business system generally requires two to four weeks, while a large multi-site operator with industrial control environments may require eight to twelve weeks or a phased multi-cycle program.
Can the testing be performed without disrupting production services?
Yes. Non-intrusive methods such as passive traffic analysis, configuration export review, and read-only inspection are used for sensitive OT systems, and any intrusive tests are scheduled within approved maintenance windows or executed against staging environments that mirror production.
What qualifications should an assessment provider hold?
Assessments should be performed by accredited third-party laboratories or qualified evaluation institutions with demonstrated competence in the relevant standards, certified security personnel, controlled testing methodologies, and experience in the operator's specific industry sector.