- On 6 August 2026 the Cybersecurity Review Office (under the Cyberspace Administration of China) announced a network-security review of products sold by Palo Alto Networks in China, citing protection of critical information infrastructure.
2026年8月6日，国家网络安全审查办公室公告，依据《国家安全法》《网络安全法》和《网络安全审查办法》，对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查。
- The review signals heightened scrutiny of foreign cybersecurity vendors whose products plug into China’s critical information infrastructure (CII).
该审查释放出对深度接入中国关键信息基础设施（CII）的外国网络安全厂商审查趋严的信号。
- Under the Cybersecurity Review Measures, suppliers of network products and services to CII operators are subject to review; a completed review can lead to procurement restrictions for affected products.
依据《网络安全审查办法》，向关键信息基础设施运营者提供网络产品和服务的供应商须接受审查；审查结论可导致相关产品采购受限。
- China’s 2026 measures on cybersecurity and data governance — including the draft rules for large personal-information processors published on 7 August 2026 — continue to raise the compliance bar for foreign technology firms.
中国2026年的网络安全与数据治理措施——包括2026年8月7日公布的《大型个人信息处理者个人信息保护规定（征求意见稿）》——持续提高外资科技企业的合规门槛。
- The review comes amid a broader set of reciprocal measures, including export-control adjustments on drones and countermeasures against US entities announced by MOFCOM on 5 August 2026.
该审查发生在更广泛的对等措施背景下，包括商务部2026年8月5日公布的无人机出口管制调整与针对美国实体的反制措施。
- For foreign vendors, the practical implication is to design China offerings with review-readiness: data localisation, source-code and architecture transparency, and CII supply-chain documentation.
对外国厂商而言，实际含义是在设计中国产品时就具备审查就绪性：数据本地化、源代码与架构透明度、以及CII供应链文档。
Cybersecurity Review in China 2026: New Scrutiny for Foreign Security Vendors | 中国2026年网络安全审查：外国安全厂商的新一轮审视
Why this matters now
On 6 August 2026, China’s Cybersecurity Review Office announced a network-security review of products that Palo Alto Networks sells in China. The announcement, published on the Cyberspace Administration of China (CAC) website, invokes the National Security Law, the Cybersecurity Law and the Cybersecurity Review Measures, and states the purpose as protecting critical information infrastructure and guarding against network-security risks. For foreign technology companies — especially cybersecurity vendors, cloud providers and equipment makers whose products sit inside Chinese enterprises’ networks — the review is a concrete reminder that China’s security review regime is an active, operational gate, not a dormant provision.
The review framework at work
The Cybersecurity Review Measures (effective 15 February 2022) establish the legal basis for reviewing network products and services that operators of critical information infrastructure (CII) intend to purchase, or that could affect national security. A review focuses on risks to the security and stable operation of CII; risks of illegal data collection, retention, use, processing and export; risks of products or services being illegally controlled or interrupted; and risks to supply-chain security. Where a review is opened, the outcome can range from conditions attached to procurement to prohibitions on use. The Palo Alto review sits in this framework: a foreign security vendor whose products are deployed in networks that may include CII must now demonstrate that its offering does not create unacceptable risks. For vendors, the review process itself demands cooperation — providing information, materials, technical documents and access for assessment — and non-cooperation can itself lead to a negative conclusion.
The broader 2026 context
The announcement is not isolated. On 7 August 2026, CAC published the draft Provisions on the Protection of Personal Information by Large Personal Information Processors, consolidating two earlier drafts, with a comment deadline of 7 September 2026. The draft extends obligations to processors handling personal information of 10 million or more individuals, deepening the regime that foreign platforms and data-heavy businesses must already navigate. On 5 August 2026, MOFCOM announced tightened export controls on drones and drone-related dual-use items to the United States (Announcement No. 34 of 2026), along with countermeasures against several US entities (Order No. 2 and Order No. 3 of 2026). Taken together, the sequence shows a government that is simultaneously building out its cybersecurity gate, its data-governance rulebook and its reciprocal-trade toolkit — all of which foreign technology firms must treat as a single, connected compliance environment.
Practical steps for foreign technology vendors
- Assess CII exposure. Determine whether your products or services are used by operators of critical information infrastructure in China; if so, map which products fall within review scope.
- Prepare review documentation. Assemble security designs, source-code access arrangements, data-flow maps, third-party component lists and supply-chain documentation in a review-ready format.
- Review data practices. Confirm that products deployed in China comply with personal-information protection and data-export rules, including the emerging large-processor obligations for relevant businesses.
- Structure local presence. Where possible, align with data localisation expectations and consider whether a local entity, local storage and local support improve the review posture.
- Monitor the political risk layer. Because security reviews can interact with broader reciprocity measures, maintain a watch on MOFCOM export-control and countermeasure announcements that may affect your group.
- Build in response discipline. If a review opens, cooperate within statutory timeframes, keep internal records consistent, and engage counsel familiar with the Cybersecurity Review Measures.
Risks and compliance notes
The highest risk for a foreign vendor is complacency: assuming that a sale to a Chinese enterprise is “just a commercial deal” when the product’s deployment may trigger review. Sales into government, finance, energy, transportation and telecom networks — classic CII sectors — deserve the most scrutiny. Also note that the review regime is evolving quickly; the large-processor draft shows that obligations can expand to new categories of actors. Finally, the interconnection with export controls and countermeasures means a vendor’s Chinese business can be affected by measures aimed at its home country; global compliance teams should model those scenarios. None of this argues against the Chinese market — it argues for entering it with the same security-review maturity that the market now expects.
中国2026年网络安全审查：外国安全厂商的新一轮审视
为什么当下重要
2026年8月6日，国家网络安全审查办公室宣布对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查。公告发布于中央网信办（国家互联网信息办公室）官网，援引《国家安全法》《网络安全法》和《网络安全审查办法》，目的表述为保障关键信息基础设施安全稳定运行、防范网络安全风险隐患。对外资科技企业——尤其是产品部署在中国企业网络内部的安全厂商、云服务商与设备制造商——这次审查是一个具体提醒：中国的安全审查制度是一道活跃、运转中的闸门，而非沉睡的条款。
运行中的审查框架
《网络安全审查办法》（2022年2月15日施行）为审查关键信息基础设施（CII）运营者拟采购、或可能影响国家安全的网络产品与服务确立了法律依据。审查聚焦以下风险：关键信息基础设施安全稳定运行；非法收集、存储、使用、加工、传输、提供、公开、删除个人信息与重要数据；产品服务被非法控制或干扰；以及供应链安全。一旦启动审查，结论可能从附加采购条件到禁止使用。派拓审查正处在此框架中：产品可能部署于包含CII的网络中的外国安全厂商，现在必须证明其产品不会产生不可接受的风险。对厂商而言，审查过程本身要求配合——提供信息、材料、技术文档并接受评估——不配合本身即可导致不利结论。
2026年更宏观的背景
该公告并非孤立事件。2026年8月7日，国家网信办公布《大型个人信息处理者个人信息保护规定（征求意见稿）》，整合两份早前草案，意见反馈截止2026年9月7日。草案将义务扩展到处理1000万人以上个人信息的处理者，深化了外资平台与数据密集型企业本已必须应对的监管体系。2026年8月5日，商务部公布加强对美国无人机及无人机相关两用物项出口管制（2026年第34号公告），并对多家美国实体采取反制措施（2026年第2号、第3号令）。综合来看，这一系列动作显示政府正同步构建网络安全闸门、数据治理规则与对等贸易工具箱——外资科技企业必须将三者视为一个相互联通的整体合规环境。
外资科技厂商的操作步骤
- 评估CII敞口。 确定产品或服务是否被中国关键信息基础设施运营者使用；如是，梳理哪些产品落入审查范围。
- 准备审查文档。 以审查就绪格式汇编安全设计、源代码访问安排、数据流图、第三方组件清单与供应链文档。
- 复核数据实践。 确认部署于中国的产品符合个人信息保护与数据出境规则，包括相关业务将面对的新兴大型处理者义务。
- 构建本地存在。 在可行处与数据本地化预期对齐，评估本地实体、本地存储与本地支持是否改善审查姿态。
- 盯住政治风险层。 由于安全审查可能与更广泛的对等措施相互作用，持续关注可能影响集团的商务部出口管制与反制公告。
- 建立应对纪律。 一旦启动审查，在法定期限内配合、保持内部记录一致，并聘请熟悉《网络安全审查办法》的法律顾问。
风险与合规提示
外国厂商最大的风险是自满：当产品部署可能触发审查时，却把对中资企业的销售仅当作”一桩商业交易”。政府、金融、能源、交通与电信网络——典型的CII领域——的销售最值得审慎对待。还需注意，审查制度正在快速演进；大型处理者草案表明义务可以扩展到新的主体类别。最后，与出口管制和反制措施的相互关联意味着，厂商的中国业务可能受到针对其母国措施的影响；全球合规团队应建模这些情景。这些都不构成回避中国市场的理由——而是提示要以市场现在所期望的同样的安全审查成熟度进入这个市场。
Sources
- 中央网信办官网《国家互联网信息办公室关于〈大型个人信息处理者个人信息保护规定（征求意见稿）〉公开征求意见的通知》（2026-08-07，意见反馈截止2026-09-07）：<https://www.cac.gov.cn/2026-08/07/c_1787851071612596.htm>
- 国家网络安全审查办公室2026-08-06公告：对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查（据清华国际金融与经济研究中心2026年中美贸易争端大事记引述原文链接）：<https://cifer.pbcsf.tsinghua.edu.cn/info/1136/3737.htm>
- 商务部《政策》栏目：商务部公告2026年第34号 公布加强无人机相关两用物项对美国出口管制（2026-08-05）；商务部令二〇二六年第2号、第3号 反制决定（2026-08-05）：<https://www.mofcom.gov.cn/zcfb/index.html>
- 商务部官网《政务公开》：商务部公告2026年第33号 对进口打印复印办公设备发起对外贸易国家安全立案调查（2026-08-05，与网络安全审查同批对等动向）：<https://www.mofcom.gov.cn/zwgk/index.html>