FAQs About the Security Assessment Report

You can refer to this document when releasing apps in the Chinese mainland.

HUAWEI AppGallery has provided the following FAQs and guidance related to the security assessment report, to strengthen security management of Internet information services and corresponding new technologies and apps that destabilize public opinions, and implement the policies stipulated in: Cybersecurity Law of the People's Republic of China, Regulation on Internet Information Service of the People's Republic of China, Measures for the Administration of Security Protection of Computer Information Networks with International Interconnections, Administrative Regulations on Assessing the Security of New Technologies and Applications for Internet News Information Service, Provisions on the Security Assessment for Internet Information Services with Public Opinion Attributes or Social Mobilization Capabilities, Provisions on the Administration of Deep Synthesis Internet Information Services, and Provisional Measures for Management of Generative AI Services. This helps ensure that you are better able to assess security risks, and work closely with AppGallery to maintain a secure network environment.

1. Why do I need to submit the security assessment report, and for which apps is the report required?

• The Provisions on the Security Assessment for Internet Information Services with Public Opinion Attributes or Social Mobilization Capabilities ("the Provisions" for short) stipulate that Internet information service providers who are able to destabilize public opinions shall perform security assessments on their own, or via a third party, based on the legality of their information services, new technologies, and new apps, and the effectiveness of implementing security measures and preventing and controlling security risks. For apps that have passed the security assessment and comply with laws, administrative regulations, departmental rules, and standards, a security assessment report shall be developed and submitted to the cyberspace administration and the public security organs on the National Internet Security Management Service Platform.
  According to Article 3 of the Provisions, Internet information service providers that fall under any of the following circumstances shall conduct a security assessment on their own in accordance with the Provisions and shall be responsible for the assessment results:
  (1) Launching information services with public opinion attributes or social mobilization capabilities, or adding related functions to existing services.
  (2) Using new technologies or apps that cause significant changes to the functional attributes, technical implementation methods, or underlying resource configurations of the information service, resulting in substantial changes to its public opinion attributes or social mobilization capabilities.
  (3) Significant increase in the user scale, leading to substantial changes in the public opinion attributes or social mobilization capabilities of the information service.
  (4) Occurrence of dissemination or spread of illegal or harmful information, indicating that existing security measures are insufficient to effectively prevent cybersecurity risks.
  (5) Other circumstances where cybersecurity authorities at or above the municipal level, or public security authorities, issue a written notice requiring a security assessment.
  The term "Internet information services with public opinion attributes or social mobilization capabilities" as referenced in the Provisions includes the following circumstances:
  (1) Operating information services such as forums, blogs, microblogs, chat rooms, communication groups, public accounts, short-video platforms, live-streaming services, information-sharing services, mini programs, or providing corresponding functions.
  (2) Operating other Internet information services that provide channels for public opinion expression or have the capability to mobilize the public to engage in specific activities.
• According to the Provisions on the Administration of Deep Synthesis Internet Information Services and Provisional Measures for Management of Generative AI Services, the deep synthesis or generative AI service providers and technical support parties that provide tools, including models and templates, with any of the following functions, shall perform a security assessment by themselves or by entrusting a professional institute to do so:
  (1) Function that generates or edits biometric information such as facial and voice information
  (2) Function that generates or edits non-biometric information about special objects or scenarios that may involve national security and public interests.

The following are representative examples of such apps: