全国互联网安全管理服务平台【公安备案】- Instructions for Filling in the "安全评估报告"

During the public security filing process, sometimes you need to fill out the "Security Assessment Report". After entering the Security Assessment Report interface, it is divided into 4 steps in total: "Fill in the Self-Assessment Report", "Stamped Copy of the Self-Assessment Report", "Upload Third-Party Testing Report", and "Notes and Instructions". As shown in the figure below:

1. Submit Information (Fill in according to your actual situation; the following are examples)

In this step, you need to fill in relevant information according to regulations. "*" indicates required information. The first item to fill in is the "Assessment Object".

Type: Select "Website", "APP", "Mini Program", or "Other" according to the filing type you need to conduct a security assessment for.

Assessment Object: Select the filing business that needs assessment.

Assessment Status: Generally select "Launch of information services with public opinion attributes or social mobilization capabilities, or adding related functions to information services"

Assessment Method: Generally select "Self-assessment"

Then you need to fill in the "Main Content". This part is relatively complex, and a total of 7 major sections need to be filled in. They are mainly content related to security management, privacy protection, etc. Each item is limited to 450 characters, and must be answered in formal, standardized language.

(The following content uses APP as an example for sample wording. Please fill it in according to your actual situation. If it is a website, please change APP to website; if it is a Mini Program, please change APP to Mini Program.)

Security Management Person in Charge:

Fill in the name of the security management person in charge.

Measures for verifying users' real identities and retaining registration information:

Example: All users must use a mobile phone number to register an account, ensuring the authenticity of user identities. The system records information such as the mobile phone number, IP, MAC address, port, device ID, and timestamp in the user registration event. Registration information includes the user's nickname, gender, and avatar; this information is permanently retained in the database.

Measures for retaining log information such as user accounts, operation time, operation type, network source address and destination address, network source port, client hardware characteristics, and records of information published by users:

Example: In the APP, users must log in to post, and the user's posting time and posting content will be recorded. User comments and published information are permanently stored in the database. The backend can manually block non-compliant information published by users; manual blocking only makes it invisible on the user frontend, while the record is still retained in the database. The system permanently records business events and times for user orders, posts, and comments. Users' web network access logs are retained for more than half a year.

Measures for preventing and handling illegal and harmful information and preserving related records in service functions such as user accounts and communication group names, nicknames, profiles, remarks, identifiers, information publishing, forwarding, comments, and communication groups:

Fill it in according to the actual situation of the APP's relevant functions. If it does not meet the requirements, the reviewers will probably give you rectification opinions during the later review. At that time, develop the relevant functions and submit for review again.

Example: There is no communication group function inside the APP, nor is there a private message function. Users can only post and comment on posts in modules. The posting function provides users with a reporting entry point; after reporting, the backend will mark it, and the operations backend can process it. Information reviewers can manually block violating information and comments, and violating accounts can be manually muted or blacklisted. All posting and comment information is permanently retained.

Technical measures for personal information protection and for preventing the risks of illegal and harmful information spreading and loss of control over social mobilization functions:

This question mainly concerns privacy protection measures between users, as well as proving that you have measures and methods to block and handle inappropriate speech.

Example: For personal information protection, users can only view other people's avatars and user nicknames, and cannot view other users' gender, birthday, mobile phone number, or other personal information. For harmful information and the risk of loss of control over social mobilization functions, if posts and comments contain sensitive words, the system will replace them with * to block them; after successful publishing, if violating content is still found, ordinary users can report it, and backend administrators can block and retain the content. Administrators can also mute violating users, restricting them from publishing content and comments. Seriously violating users can be directly banned.

Whether a complaint and reporting mechanism has been established:

Choose according to your own website situation. If yes, select [Yes], and the content below will be filled in. If there really is none, select [No].

Establishing a complaint and reporting system, publishing information such as complaint and reporting methods, and promptly accepting and handling related complaints and reports:

Example: Reporting user posts is supported. When reporting, the reported content, the user who published the content, and the reason for the report are uploaded. In the backend, administrators can view the specific report information, block violating content, and mute users. Users can also, in the app–My–xx–xxx module, choose to provide report feedback by contacting online customer service or making a phone call.

Establishing a working mechanism to provide technical and data support and assistance for regulatory departments and law enforcement departments to perform their duties in accordance with the law:

Example: The backend management system provides an Internet police information query management function. Relevant departments can directly log in to the account to check related issues when necessary. If needed, we will actively respond and cooperate with the work of relevant departments.

Please be sure to ensure that the information filled in is true! Do not write functions or controls that the current product cannot achieve. If rejected, promptly improve the corresponding functions according to the rectification requirements.

After completing the information, click the "Next Step" button to enter the "Report Generation" page.

2. "Report Generation"

Click [Download] to download the report file in PDF format, then click [Next Step].

3. "Submit Report"

For the downloaded PDF file, it needs to be printed out, signed by the company's legal representative, and stamped with the legal representative seal and the company's official seal (if it is a third-party assessment, write the third-party name). Then take a photo and upload it to a computer, convert it to PDF format, upload it to the website, and finally click [Complete].

At this point, the submission process for the "Security Assessment Report" is complete. After the report is reviewed and approved, "Publicized" will be displayed in the backend. At this time, you can take photos or screenshots of the report, and then, according to the rules of each app market, upload it to the app market's copyright certificate section or special qualification upload section (the rules and names of each platform vary; please refer to the email).

Security Risk Handling Process:

If a developer's App has been found to have not carried out a security assessment and has been judged as "having potential risks", the following operations need to be performed:

1. Click "Security Risk Handling" on the left, check the product that needs to be handled, then click [Details], and repeat the above operations for submitting the "Security Assessment Report".

2. Make a risk appeal. For the appeal reason, write "I object to the product being assessed as having risks, and suggest that the competent authority re-check."