China opens public consultation on draft industrial data security maturity model
China’s National Cybersecurity Standardisation Technical Committee has launched a public consultation on a draft practice guide setting out a data security capability maturity model for industrial enterprises.
On 4 January 2026, China’s National Cybersecurity Standardisation Technical Committee (TC260) opened a public consultation on the draft Cybersecurity Standards Practice Guide – Industrial Enterprise Data Security Capability Maturity Model. The consultation will remain open until 18 January 2026.
The draft practice guide is intended to support the implementation of China’s Data Security Law, the Regulations on the Administration of Network Data Security, and the Measures for the Administration of Data Security in the Industrial and Information Technology Sector (Trial). It aims to guide industrial enterprises in systematically strengthening and evaluating their data security capabilities.
The document introduces a data security capability maturity model tailored to industrial enterprises. It defines a set of capability elements and outlines five maturity levels, together with evaluation methods to assess an organisation’s current level of data security maturity. The model covers data across the full lifecycle, as well as general security requirements relevant to industrial contexts.
In addition, the draft guide sets out key process domains, reference frameworks, assessment methodologies, and baseline requirements. These elements are designed to help enterprises build, measure, and continuously improve their data security capabilities in a structured and comparable manner.
According to the consultation notice, the practice guide was compiled by the TC260 Secretariat in line with the committee’s procedures for developing cybersecurity standards practice guidelines. Stakeholders are invited to submit comments and suggestions to the Secretariat by 18 January 2026.
