# China ERP Data Security and Compliance Self-Assessment > Source: https://netray.co/tools/china-erp-data-security-compliance-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Ten questions covering data location, cross-border transfer, personal information, classified protection and access control for an ERP running in China. ## Category compliance-legal ## Region China ## Audience - CIO - IT security manager - Legal and compliance ## Tool **Kind:** assessment **Questions:** #### Where is your China entity's ERP data hosted? **Help:** Include production, backup and test copies. **Options:** ##### Inside mainland China with a documented hosting contract **Score:** 10 ##### Mixed, some copies outside China **Score:** 5 ##### Outside China and not reviewed **Score:** 0 #### Do you know which ERP data contains personal information? **Help:** Employees, customer contacts, supplier contacts, field staff. **Options:** ##### Yes, mapped and recorded **Score:** 10 ##### Partly known **Score:** 5 ##### No inventory exists **Score:** 0 #### Is there a legal basis and notice for processing employee and contact data? **Options:** ##### Yes, with consent or another documented basis **Score:** 10 ##### In progress **Score:** 5 ##### Not reviewed **Score:** 0 #### Do you transfer ERP data to headquarters or group systems outside China? **Help:** Includes consolidation feeds, BI exports, support access. **Options:** ##### No transfer, or transfers assessed against current cross-border rules **Score:** 10 ##### Yes, transfers exist and review is under way **Score:** 5 ##### Yes, and no review has been done **Score:** 0 #### Has the ERP system been assessed under the classified protection scheme (MLPS)? **Options:** ##### Graded, filed and assessed as required **Score:** 10 ##### Grading in progress **Score:** 5 ##### Not graded **Score:** 0 #### How is access to the ERP controlled? **Options:** ##### Role-based access, MFA and periodic review **Score:** 10 ##### Role-based access, no regular review **Score:** 5 ##### Shared accounts or broad admin rights **Score:** 0 #### Is there a process for remote access by overseas support or consultants? **Options:** ##### Controlled, logged and approved case by case **Score:** 10 ##### Allowed with limited logging **Score:** 5 ##### Open access without approval **Score:** 0 #### Are important business data categories identified and graded? **Help:** For example production, customer and pricing data. **Options:** ##### Yes, graded with owners **Score:** 10 ##### Informally understood **Score:** 5 ##### No grading **Score:** 0 #### Do you have a tested incident response and breach notification plan? **Options:** ##### Documented and tested in the past year **Score:** 10 ##### Documented, not tested **Score:** 5 ##### No plan **Score:** 0 #### Are logs of system and data access retained and reviewed? **Options:** ##### Retained for the required period and reviewed **Score:** 10 ##### Retained, not reviewed **Score:** 5 ##### Not retained **Score:** 0 **Bands:** #### High exposure **Min:** 0 **Max:** 34 **Verdict:** Core controls are missing and the entity may be exposed to regulatory and operational risk. **Recommendations:** - Build a data inventory of ERP personal and important data first - Confirm hosting location and cross-border flows with legal counsel - Remove shared accounts and review administrator rights #### Partial coverage **Min:** 35 **Max:** 59 **Verdict:** Some controls exist but gaps remain in the areas that regulators and auditors look at first. **Recommendations:** - Complete the personal information mapping and legal basis review - Document and assess every outbound data transfer - Start or finish the classified protection grading #### Largely in place **Min:** 60 **Max:** 84 **Verdict:** Most controls exist. Focus on testing, review cadence and evidence. **Recommendations:** - Test the incident response plan with a table-top exercise - Schedule periodic access reviews with sign-off - Keep evidence in one folder for audits #### Well managed **Min:** 85 **Max:** 100 **Verdict:** Controls look mature. Keep them current as rules and systems change. **Recommendations:** - Track new regulations and guidance on a regular cycle - Re-run this assessment after any ERP or hosting change - Review third party and support access annually ## Content **Intro:** Foreign companies running an ERP in China face several overlapping laws: the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law, plus the classified protection scheme. This ten question self-assessment shows where your ERP setup stands. **Sections:** #### How to use the assessment **Body:** Answer for the China entity's ERP landscape, including backups, test copies and reporting extracts, since these often sit outside the main hosting arrangement. Have IT and legal answer together. The score is a percentage of the maximum and maps to four bands, each with next steps you can export to PDF for the steering group. #### What the questions are based on **Body:** The questions follow common themes in Chinese data regulation: where data is stored, what personal information is processed and on what basis, how data leaves China, how systems are graded and protected, and how incidents are handled. They are not a legal opinion. Requirements depend on industry, data volume and the type of data, so use the result to prepare questions for your counsel rather than as a verdict. **Bullets:** - Data location and hosting contracts - Personal information inventory and legal basis - Cross-border transfer review - Classified protection grading - Access control, logging and incident response #### Reading the result **Body:** A low score is most often driven by the absence of an inventory and of reviews, not by missing technology. Companies tend to find that group consolidation feeds, BI extracts and overseas support access were never assessed. These are cheap to fix on paper and painful to find in an audit. #### Common mistakes **Body:** Treating the ERP as the only place data lives is the biggest one: spreadsheets, email attachments and cloud file shares carry the same data. Another mistake is giving overseas consultants standing access to production. Use time limited, logged sessions and avoid copying production data abroad for testing. **Cta:** Where the answer to data location is that data must stay on premises, Netray builds private and on-prem AI that works over ERP data without sending it to an external service. We can discuss how that fits your setup. **Faq:** #### Is this a legal compliance check? **Answer:** No. It is a self-assessment that highlights common gaps. Legal obligations depend on your sector, size and data types, so confirm with qualified counsel in China. #### Does my ERP need to be hosted inside China? **Answer:** Not always as a blanket rule, but certain operators and data categories face localization and transfer requirements, and personal information transfers need a lawful mechanism. Check with counsel for your specific case. #### What is MLPS 2.0? **Answer:** It is the multi-level protection scheme for information systems. Systems are graded by importance and must meet matching security requirements, with filing and periodic assessments for higher levels. #### Does using a foreign cloud ERP cause problems in China? **Answer:** It can, depending on where data is stored and how it moves. Many vendors offer a China region operated through a local partner. Review the contract, hosting location and transfer arrangements. ## Search terms china erp data compliance, pipl erp compliance checklist, china data localization erp, china cybersecurity law erp, mlps 2.0 erp, china cross border data transfer erp, china data security law manufacturing, foreign company china erp data hosting --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json