政企项目中的等保合规实践

A Common Dilemma: What Exactly Does Grade Protection Require?

Last year we took on a government service platform project for a district administrative approval bureau. As the project was about to launch, the client said: “Oh right, this system needs to pass Level 3 grade protection assessment — you guys handle it.”

We asked: “Have you done any grade protection-related work before?” The client said: “No, we don’t know what needs to be done. You’re the tech company — you figure it out.”

This is a common problem in government and enterprise projects — grade protection compliance is treated as “the last step before launch” rather than a requirement贯穿 the entire project. The result: when assessment is imminent, you discover problems everywhere, and scrambling to fix them costs both money and time.

Over the past few years, we’ve done over a dozen grade protection projects — from Level 2 to Level 3 — and stepped in many pitfalls. We’ve also developed a mature implementation approach. Today let’s talk about how grade protection compliance should actually work in government and enterprise projects.

First, Understand: What Does Grade Protection 2.0 Require?

When many people hear “grade protection,” they think it’s a bunch of rules and regulations that are hard to understand and remember. Actually, Grade Protection 2.0 requirements can be summarized as “one center, three layers of protection”:

• One Center: Security Management Center (centralized control)
• Three Layers: Secure Communication Network, Secure Zone Boundaries, Secure Computing Environment

Plus five management-level requirements: Security Management System, Security Management Organization, Security Management Personnel, Security Construction Management, Security Operations Management.

Still sounds abstract? Don’t worry — we can translate it into more down-to-earth terms:

Ten categories total, with Level 3 having roughly 200-300 specific requirement items. It sounds like a lot, but most are standard practices. The real challenge is implementing these requirements into specific technical solutions and management systems.

Our Methodology: Three Steps

For grade protection projects, we generally follow three steps:

Step 1: Gap Assessment (1-2 Weeks)

Don’t rush to change things. First, understand the current state — what already meets requirements, and what falls short.

How to do a gap assessment:

1. Asset inventory: List all assets — servers, network devices, security devices, applications, databases — leave nothing out.
2. Policy inventory: Gather all existing security policies, check what exists, what’s complete, what’s compliant.
3. Item-by-item comparison: Go through the grade protection checklist item by item, marking what’s met, partially met, or completely missing.
4. Report output: Produce a gap assessment report listing all gaps, remediation recommendations, and approximate costs.

This step is crucial. Many clients start by saying “we need to pass grade protection, give us a quote.” But without a gap assessment first, any quote is inaccurate — you don’t know the current state, so how can you know how much remediation will cost?

Step 2: Remediation & Construction (4-8 Weeks)

After the gap assessment, you know what needs to change. Remediation follows two tracks: technical and management.

Technical Remediation

Technical remediation is mainly about adding equipment, configurations, and features.

Common remediation items:

• Network layer: Add firewalls, IDS/IPS, WAF, log auditing systems, bastion hosts.
• Host layer: Server patching, configuration hardening, antivirus installation, audit logging enabled.
• Application layer: Add authentication (two-factor), access control, audit logging, encrypted data transmission.
• Data layer: Database encryption, data backup, sensitive data masking.
• Management center: Deploy a unified security management platform for centralized monitoring and auditing.

One pitfall to warn about: don’t buy a bunch of useless equipment just to pass the assessment. Many integrators stuff proposals with the most expensive equipment regardless of whether the client actually needs it. The result: lots of money spent, equipment sitting around collecting dust.

Our principle: enough is enough, reuse what you can. If the client already has equipment that works, use it — don’t buy duplicates. In cloud environments, many security capabilities are already provided by the cloud vendor — use those directly, don’t buy your own.

Management Remediation

Management remediation is mainly about adding policies, records, and training.

Many clients spend hundreds of thousands on technical remediation but the management side is a mess — no policies, no records, no training. The result: during assessment, the management section loses so many points that they still fail.

What management remediation involves:

• Policy system building: Develop a complete set of security policies, including overall strategy, management policies, operational procedures, and record forms.
• Organizational structure building: Define security management departments and roles, define responsibilities.
• Personnel training: Provide grade protection training and security awareness training to relevant personnel.
• Record completion: Fill in various daily operations records — inspection records, vulnerability remediation records, change records, backup records, etc.

Management remediation may seem like “just paperwork,” but it’s actually very important. In grade protection assessment, the management section accounts for roughly half the weight, and management remediation is inexpensive — high ROI.

Step 3: Assessment Preparation + Formal Assessment (2-4 Weeks)

After remediation, you can prepare for assessment.

Assessment isn’t just finishing remediation and having the assessment agency show up. We generally do a pre-assessment first — go through the assessment requirements ourselves, see if there are still issues, and fix them ahead of time.

Once the pre-assessment passes, we bring in the assessment agency for the formal assessment. Formal assessment generally takes about a week, then you wait for the agency to issue the report. Once the report passes, you can file with the public security bureau.

The Most Common Pitfalls

After doing so many projects, we’ve summarized the most common pitfalls:

Pitfall 1: Only Remembering Grade Protection Right Before Launch

This is the most common pitfall. The project is almost done before anyone remembers grade protection is needed. Then you discover the architecture wasn’t designed with security in mind, and there’s so much to change — either launch gets delayed, or you spend a fortune patching things at the last minute.

Right approach: Consider grade protection requirements from project kickoff. Factor security into the architecture design phase — remediation costs will be much lower later.

Pitfall 2: Only Focusing on Technology, Ignoring Management

Many clients think grade protection is just buying equipment and doing tech work — the management part doesn’t matter. Then during assessment, the management section loses tons of points, the technical section barely loses any, and the total score still isn’t enough.

Right approach: Work on both technical and management tracks together. Management remediation is low-cost, fast, and high-ROI — definitely worth重视.

Pitfall 3: Unclear Responsibility Boundaries in Cloud Environments

Now many government and enterprise projects run on the cloud. In cloud environments, grade protection responsibilities are divided — the cloud vendor is responsible for cloud platform security, and the customer is responsible for their own application and data security. But many clients don’t understand this and think using the cloud means they don’t have to do anything.

Right approach: Understand the responsibility boundary clearly. Cloud vendors handle “security of the cloud,” you handle “security in the cloud.” What the cloud vendor provides, get from them; what you’re responsible for, do well yourself.

Pitfall 4: Choosing a Bad Assessment Agency

Assessment agencies vary widely in quality. Some are strict, some are lenient; some are experienced, some don’t know what they’re doing. Choose the wrong agency, and you either fail or the process is a nightmare.

Right approach: Choose a certified, experienced, well-regarded assessment agency. Ideally, communicate with them beforehand to gauge their professional level.

Pitfall 5: Thinking Passing Grade Protection Means You’re Done

Many clients think once they pass, they’re finished and don’t need to worry about it anymore. But grade protection isn’t “pass once and you’re set forever” — Level 3 requires annual reassessment, and daily security operations can’t stop.

Right approach: Make grade protection compliance a常态化 (ongoing) practice. Do regular security checks, regular vulnerability scans, regular policy updates, regular personnel training. Security isn’t a one-time thing — it’s continuous.

How Much Does It Cost?

This is what clients care about most. The cost of Level 3 grade protection remediation varies widely — from hundreds of thousands to millions of yuan — depending mainly on:

• Current state: How good is your existing security foundation? The worse the foundation, the higher the remediation cost.
• Deployment model: Self-built data center or cloud? In cloud environments, many security capabilities can be purchased on-demand, lowering costs.
• System scale: How many servers, how many applications, how complex is the network architecture?
• Management foundation: Do you have existing policies and teams? The worse the management foundation, the more remediation work is needed.

Generally speaking, for a medium-sized government system running on the cloud, the total cost of Level 3 remediation (technology + management + assessment fees) is roughly 300,000 to 800,000 yuan. If it’s a self-built data center where you have to buy all your own equipment, costs are much higher.

Closing Thoughts

Many companies see grade protection compliance as an “expensive hassle.” But think about it differently — grade protection is actually an opportunity to systematically梳理 (sort through) your security risks and improve your security posture.

Going through the grade protection process seriously will qualitatively improve your system’s security level. It’s not just about passing the assessment — it’s about genuinely reducing security risks.

We’ve seen too many clients who don’t重视 security until something happens, then they regret it. Instead of spending a fortune fixing things after an incident, it’s better to spend a little on security proactively. Grade protection is a great way to do that.