Top 10 Non-Conformities in China's MLPS 2.0 Level-3 Assessments
Across 100+ MLPS 2.0 Level-3 engagements, Halocent finds that 80% of non-conformities cluster into a small number of areas. This article collects the top ten and pairs each with a concrete remediation.
Top 10 findings
1) No periodic account/permission review (§8.1.4.1)
Typical: shared admin accounts, offboarded accounts still active, privileged accounts not reviewed in 90 days.
Fix: named account owners, quarterly audit reports, HR-triggered auto-disable via IAM/AD.
2) Critical operations without MFA (§8.1.4.2)
Typical: SSH / RDP / DB clients password-only; single-factor VPN.
Fix: at minimum MFA on ops channels, bastion, and critical business back-office. Prefer TOTP / FIDO2.
3) Logs retained less than 6 months (§8.1.4.3)
Fix: centralise logs in SIEM, retention ≥ 180d (critical systems ≥ 1y), full-text searchable.
4) Malware protection not covering servers (§8.1.4.4)
Fix: deploy lightweight HIDS/EDR on Linux servers (osquery + wazuh, or a commercial product), policies refreshed quarterly.
5) Sensitive data transmitted in cleartext (§8.1.4.5)
Fix: TLS 1.2+ everywhere; internal CA-issued certs; forced SSL for DB connections.
6) Backups not off-site or never tested (§8.1.4.6)
Fix: off-site or multi-AZ backup, quarterly restore drills, published RTO/RPO reports.
7) Incident-response plan on paper only (§8.1.4.7)
Fix: named IC/forensics/comms roles, tabletop exercise every 6 months with records.
8) Loose supply-chain access (§8.1.10)
Fix: temporary account + bastion + full audit for vendor engineers; standard security clauses in every contract.
9) Change management without security review (§8.1.9)
Fix: every production change is ticketed, Security is a mandatory approver, major changes require pre-launch scan.
10) Data classification incomplete (§8.1.6)
Fix: at least four tiers plus field-level identification (national ID, phone, bank card), backed by real technical controls.
Halocent stat: covering these ten items lifts first-time Level-3 pass-rate from 62% to 91%.
Suggested project cadence
- T-8 weeks: gap analysis (Halocent offers a free lightweight version).
- T-6 weeks: named remediation owners + budget, weekly plan.
- T-3 weeks: core remediation shipped and change-freeze begins.
- T-1 week: internal mock assessment covering common sample requests.
- During assessment: dedicated liaison ensures assessors receive materials within 24 hours.
Preparing your first Level-3? Contact us — Halocent offers a 2-hour free gap-analysis call.
← Back to News & Insights