Which of CCRC's Eight Categories Should You Choose? One Table to Match Yourself — Don't Wait Until the Materials Are Wrong to Start Over

Bottom line first: the CCRC information security service qualification is divided into eight categories, and each one examines a different service capability. The cost of picking the wrong category is not "spending a little more" — it is starting the entire document set over from zero, because personnel composition, project evidence, technical tools and system documents are all configured per category. This article gives you a "match-yourself table": first look at what your company actually sells and what the contracts say, then decide which category and which level to apply for.

1. First, get clear on CCRC's eight categories

The information security service qualification of CCRC (China Cybersecurity Review, Certification and Market Regulation Big Data Center) is divided into eight categories by service content:

2. Match yourself in three steps

Choosing a category is not "pick whichever one looks easier" — it is working backwards from the business you already have, because the audit looks at real capability.

Step 1: Look at what you actually sell

Answer one question first: in the past 1–2 years, what have customers been paying you for as a "service"?

• Selling security equipment + installation and commissioning, building security solutions → Security Integration
• Helping customers maintain security equipment/platforms, running inspection and monitoring → Security Operations & Maintenance
• Doing MLPS testing, classification and filing, security assessment → Risk Assessment
• Doing red team exercises, security incident response → Emergency Response
• Having your own software product and a development team → Software Security Development
• Providing data center / cloud resources for disaster recovery → Disaster Recovery (resource service type)
• Doing disaster recovery solution design, drills and switchover → Disaster Recovery (technical service type)
• Doing security audits, compliance checks → Network Security Audit

Many manufacturing and IT service companies land in the first two categories: security operations and maintenance, and security integration.

Step 2: Look at what evidence you hold

At its core, CCRC is about "proving with evidence that you have really done the work". So the second step is not about what you want to do, but about what your contracts and projects actually look like:

If the evidence doesn't line up, no level of qualification will get you through. No ready external project in hand? A consultant can help you organize and consolidate existing internal project evidence into the declared project file — this is the standard route for companies new to the scheme.

Step 3: Look at people and technical tools

Each category sets different requirements for personnel role competence and technical tools:

• Security O&M: operations, monitoring and incident response roles, which need to map to tools (monitoring platform, vulnerability scanning, etc.)
• Security integration: security design, implementation and hardening roles
• Risk assessment: assessment methodology, testing tools
• Software security development: secure coding and code audit capability

On headcount, Level 3 generally requires a supporting team of 6, and the core personnel's social insurance must be with the applicant entity (this is where applications commonly come apart).

3. Setting the level: start at Level 3, don't go all the way at once

Every category is graded Level 3, Level 2 and Level 1 (Level 1 is the highest, Level 3 the lowest).

Start at Level 3: the threshold is the lowest, the process is relatively simple, and after running at Level 3 for a while, moving up to Level 2 goes more smoothly. Going straight for Level 2 or Level 1 means any mismatch in people, projects or capital gets the file returned.

4. Four common ways to pick the wrong category

• Choosing by "what looks easier" instead of by business. For example, a company that clearly does operations and maintenance applies for security integration because "integration sounds more senior" — and it turns out every piece of project evidence is an O&M contract that doesn't match.
• If one category doesn't go through, switch to another and try again. The difference between categories is not difficulty, it is a difference in capability direction. Switching categories does not solve an evidence problem.
• Inconsistent entities. The project sits with a branch, staff social insurance with the head office, the contract signed by an affiliate — the audit cannot reconcile them and stops right there.
• Assuming "an older company can apply for a higher level". The level depends on capability and case history, not on years in business.

5. A self-check table: which category should you apply for

Go through them in order:

• ⬜ I can state clearly what core service customers paid for in the past 1–2 years
• ⬜ I hold contracts/projects that correspond to that service (or internal projects that can be consolidated)
• ⬜ I can put together the supporting team for that category (generally 6 people at Level 3), and core personnel's social insurance is with this entity
• ⬜ I have tools/platforms/methods that demonstrate technical capability (even if not fully mature)
• ⬜ I am willing to invest in a set of system documents that can actually be put into practice

If all five line up, the category is basically settled. If any one of them doesn't, fix that one first, then talk about which category to apply for.

Final thoughts

CCRC category selection is essentially "translating what you are already doing into the language the auditor recognises". Choose correctly and the work is an exercise in organizing existing project evidence; choose wrongly and the work is an exercise in redoing everything. Take stock of the business and the evidence first, then set the category and level — get this step right and you save more than half the effort later on.

If you can't work out which category or which level you should apply for, having someone who understands the audit logic go through it with you item by item costs far less than learning by trial and error yourself.

▍Not sure which category you should apply for? Leave a comment or message me, note "CCRC category self-check table", and I'll send you a point-by-point checklist

Puhuazhike / CertFastLine Certification | Export Certification & Testing & Management Systems Consulting This article is a compliance reference for general information, not legal advice