# GB/T 22239-2019 Multi-Level Protection Scheme 2.0 (Level 3)

Framework id: `mlps_2`. Regulatory. Publisher: Standardization Administration of China (SAC) / Ministry of Public Security. Version: 2019. Region: China. Mapping licence: CC BY-SA 4.0.
Source text: https://www.tc260.org.cn/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (62, average coverage 78%)
- 8.1.1.1 Physical Location Selection (物理位置选择): PE-01, PE-18 (65%)
- 8.1.1.2 Physical Access Control (物理访问控制): PE-02, PE-03, PE-06, PE-08 (90%)
- 8.1.1.3 Anti-theft and Anti-damage (防盗窃和防破坏): PE-03, PE-05, PE-06 (75%)
- 8.1.1.4 Lightning Protection (防雷击): PE-09, PE-01 (30%)
- 8.1.1.5 Fire Protection (防火): PE-13 (90%)
- 8.1.1.6 Water and Moisture Protection (防水和防潮): PE-15 (85%)
- 8.1.1.7 Static and Climate Control (防静电 / 温湿度控制): PE-14 (78%)
- 8.1.1.8 Power Supply (电力供应): PE-09, PE-11 (88%)
- 8.1.1.9 Electromagnetic Protection (电磁防护): PE-19, PE-21 (72%)
- 8.1.2.1 Network Architecture (网络架构): SC-07, SC-32, CP-08, AC-04 (88%)
- 8.1.2.2 Communication Transmission (通信传输): SC-08, SC-12, SC-13 (90%)
- 8.1.2.3 Trusted Verification — Network (可信验证): SI-07, SA-17 (45%)
- 8.1.3.1 Boundary Protection (边界防护): SC-07, AC-17, AC-18, AC-20 (90%)
- 8.1.3.2 Access Control — Boundary (访问控制): AC-03, AC-04, AC-12, SC-07 (88%)
- 8.1.3.3 Intrusion Prevention — Boundary (入侵防范): SI-04, SC-07, SI-03 (85%)
- 8.1.3.4 Malware and Spam Prevention — Boundary (恶意代码和垃圾邮件防范): SI-03, SI-08 (90%)
- 8.1.3.5 Security Audit — Boundary (安全审计): AU-02, AU-03, AU-06, AU-09, AU-12 (88%)
- 8.1.3.6 Trusted Verification — Boundary (可信验证): SI-07, SA-17 (45%)
- 8.1.4.1 Identity Authentication (身份鉴别): IA-02, IA-04, IA-05, IA-06, IA-08, IA-11, AC-07 (92%)
- 8.1.4.2 Access Control — Computing Environment (访问控制): AC-02, AC-03, AC-05, AC-06, AC-24 (90%)
- 8.1.4.3 Security Audit — Computing Environment (安全审计): AU-02, AU-03, AU-06, AU-08, AU-09, AU-11, AU-12 (90%)
- 8.1.4.4 Intrusion Prevention — Computing Environment (入侵防范): CM-07, SI-02, SI-04, SI-07, RA-05 (88%)
- 8.1.4.5 Malware Prevention — Computing Environment (恶意代码防范): SI-03, SI-04 (88%)
- 8.1.4.6 Trusted Verification — Computing Environment (可信验证): SI-07, SA-17 (45%)
- 8.1.4.7 Data Integrity (数据完整性): SC-08, SC-28, SI-07 (88%)
- 8.1.4.8 Data Confidentiality (数据保密性): SC-08, SC-13, SC-28, MP-05 (88%)
- 8.1.4.9 Data Backup and Recovery (数据备份恢复): CP-06, CP-07, CP-09, CP-10 (90%)
- 8.1.4.10 Residual Information Protection (剩余信息保护): AC-12, SC-04, MP-06 (85%)
- 8.1.4.11 Personal Information Protection (个人信息保护): PT-02, PT-03, SI-12 (68%)
- 8.1.5.1 System Management (系统管理): AC-06, CM-03, CM-05, AU-02 (85%)
- 8.1.5.2 Audit Management (审计管理): AU-01, AU-06, AU-07, AU-09, AU-13 (85%)
- 8.1.5.3 Security Management (安全管理): AC-01, PL-01, CA-07, CM-06 (82%)
- 8.1.5.4 Centralized Control — SOC/NOC (集中管控): SI-04, AU-06, IR-04, IR-05, IR-06 (85%)
- 8.1.6 Security Management System — Policy and Procedures (安全管理制度): PL-01, PL-02, PL-04, PM-01 (85%)
- 8.1.7.1 Security Organization — Structure and Staffing (安全管理机构): PM-02, PM-13 (70%)
- 8.1.7.2 Authorization, Communication, and Audit (授权审批/沟通合作/审核检查): AC-01, AC-02, PM-10, PM-15, PM-16, CA-02, CA-05, CA-07 (78%)
- 8.1.8.1 Personnel Recruitment and Departure (人员录用/人员离岗): PS-03, PS-04, PS-05, PS-06 (88%)
- 8.1.8.2 Security Awareness Education and Training (安全意识教育和培训): AT-01, AT-02, AT-03, AT-04 (90%)
- 8.1.8.3 External Personnel Access Management (外部人员访问管理): PE-02, PS-07, PE-08 (82%)
- 8.1.9.1 Classification and Filing (定级和备案): RA-02 (40%)
- 8.1.9.2 Security Plan Design (安全方案设计): PL-02, PL-07, PL-08, RA-03 (78%)
- 8.1.9.3 Product Procurement and Use (产品采购和使用): SA-04, SA-09, SR-01 (60%)
- 8.1.9.4 Software Development — In-house and Outsourced (自行/外包软件开发): SA-03, SA-08, SA-11, SA-15, CM-04, SA-04, SA-09, SR-03 (82%)
- 8.1.9.5 Implementation, Testing, and Delivery (工程实施/测试验收/系统交付): SA-03, SA-10, SA-11, CM-02, CA-02, SA-05 (75%)
- 8.1.9.6 Level Assessment (等级测评): CA-02, CA-05, CA-07 (42%)
- 8.1.9.7 Service Provider Selection (服务供应商选择): SA-09, SR-01, SR-06 (75%)
- 8.1.10.1 Environment, Asset, and Media Management (环境/资产/介质管理): PE-02, PE-03, PE-06, CM-08, PM-05, MP-02, MP-03, MP-04, MP-05, MP-06 (88%)
- 8.1.10.2 Equipment Maintenance (设备维护管理): MA-02, MA-03, MA-04, MA-05 (88%)
- 8.1.10.3 Vulnerability and Risk Management (漏洞和风险管理): RA-03, RA-05, SI-02, PM-04 (88%)
- 8.1.10.4 Network and System Security Management (网络和系统安全管理): CM-02, CM-03, CM-06, CM-07, AC-05, AC-06, SI-02 (85%)
- 8.1.10.5 Malware Prevention Management (恶意代码防范管理): SI-03, SI-04 (85%)
- 8.1.10.6 Configuration Management (配置管理): CM-02, CM-03, CM-06, CM-08 (88%)
- 8.1.10.7 Cryptography Management (密码管理): SC-12, SC-13, IA-05 (55%)
- 8.1.10.8 Change Management (变更管理): CM-03, CM-04, CM-05 (88%)
- 8.1.10.9 Backup and Recovery Management (备份与恢复管理): CP-04, CP-09, CP-10 (88%)
- 8.1.10.10 Security Incident Handling (安全事件处置): IR-01, IR-04, IR-05, IR-06, IR-08 (85%)
- 8.1.10.11 Emergency Response Planning (应急预案管理): CP-01, CP-02, CP-03, CP-04, IR-01, IR-08 (88%)
- 8.1.10.12 Outsourced Operations Management (外包运维管理): SA-09, SR-01, SR-03, SR-06 (78%)
- 8.2 Cloud Computing Security Extension (云计算安全扩展要求): SC-07, AC-04, SC-32, IA-02, AC-03, SI-04, AU-02, SC-28, CP-09, SC-04, CM-08, SA-09, SR-01 (68%)
- 8.3 Mobile Internet Security Extension (移动互联安全扩展要求): AC-18, AC-19, SC-07, SI-04, CM-08, SA-04 (65%)
- 8.4 IoT Security Extension (物联网安全扩展要求): PE-03, PE-20, AC-03, SI-04, IA-03, SC-08 (55%)
- 8.5 Industrial Control System Security Extension (工业控制系统安全扩展要求): SC-07, AC-04, AC-03, AC-18, PE-03, PE-20, SA-04, SI-04 (60%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=mlps_2
- Control-to-clause mappings as JSON: /api/v1/frameworks/mlps_2?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/mlps-2.json
- Page for people: /frameworks/mlps-2/