💡 Bottom line first: CCRC Level 3 security operations has exactly five written conditions — an independent legal entity, a fixed place of business, suitably qualified personnel, at least one completed project, and a management system document set. The threshold looks low, but the last three are what actually stop companies: the people have to add up, the projects must be ones you genuinely delivered yourself, and the system documents must form a set that can be put to work. Money is usually not the biggest hurdle. This article takes the five conditions one by one, so after reading you can judge whether you can apply now, where the gap is, and what to fix first.
1. First, stop mixing up three concepts
Many companies hearing about CCRC for the first time lump it together with ISO 27001 or with MLPS (dengbao). The three are not the same thing:
🏛️ CCRC Information Security Service Qualification
Issued by the China Cybersecurity Review, Certification and Market Regulation Big Data Center. It measures your capability to deliver information security services. Grades run from Level 3 (the entry level) up to Level 2 and Level 1, and companies normally start at Level 3.
📋 ISO 27001
A management system certification. It examines whether your system has been built and is actually running.
⚖️ MLPS (dengbao)
A statutory requirement (Article 21 of the Cybersecurity Law). Not doing it can lead to regulatory interviews and penalties.
In one line: CCRC is like CNAS accreditation — it tests "capability"; ISO 27001 is like product certification — it checks the "system"; MLPS is a "legal gate".
The two frequent CCRC directions are security operations (O&M inspection, monitoring, incident response) and security integration (security product deployment, solution design), with risk assessment, emergency handling and security audit alongside them. Manufacturers and IT service companies normally start with Level 3 security operations.
2. The five hard conditions, one by one
The official Level 3 requirement is a single sentence, but there is a trap behind every word:
🏢 Independent legal entity
The applicant entity must be the same entity that holds the project, the personnel and the signed contracts. If the project sits with a branch while social insurance sits with the head office, the review will not reconcile and will stall.
📍 Fixed premises
You need an actual office or service location. Companies generally meet this one.
👥 Qualified personnel (6 people)
The item that stops applicants. The six people must match security operations job competencies, and the review checks their qualifications. A large headcount whose competencies do not match, or social insurance and certificates not held by this entity, will not pass.
📁 At least 1 completed project
The second hurdle. It must be a project your own company genuinely delivered; another company's project cannot be used. If you have no external project yet, a consultant can help organize your existing internal project evidence for the filing.
📄 Management system documents
A complete set of policies, processes and records that can be put to work. The review checks four things: project documents, personnel qualifications, management documents and technical tools.
* For comparison: Level 2 expects around 20 people plus 5 projects, and registered capital usually of RMB 5 million. Start at Level 3, and you can apply to upgrade after one year of operation.
3. What the application process looks like
Total reference timeline is about 3–6 months, subject to the certification body's schedule. After certification there is an annual surveillance audit, and renewal when the 3 years expire.
4. Timeline and effort: roughly how long it takes
| Item | Reference |
|---|---|
| Preparation stage | About 1–2 months |
| Submission and review | About 1–2 months |
| Total timeline | About 3–6 months |
| Validity | 3 years, annual surveillance, renewal on expiry |
5. A self-check list: can you apply now?
- ✅Independent legal entity, with the same entity throughout
- ✅Fixed office or service premises
- ⬜Able to field a 6-person security operations team whose competencies match the roles
- ⬜At least 1 project your own company delivered (or internal project evidence a consultant can help organize)
- ⬜Willing to invest in a set of system documents that can be put to work
Any line marked ⬜ is what you need to resolve first. Certification is not the finish line — annual self-checks, project accumulation and staff training are the ongoing work across the three years.
Final thoughts
CCRC Level 3 security operations is the entry ticket for manufacturers and IT service companies to enter the information security services market and to take part in government IT and state-owned enterprise procurement tenders (many qualification lists name it explicitly). The threshold is low on one condition — map the requirements out in advance, and do not stall halfway through. Where things are unclear, having someone who knows the process walk through each item with you costs far less than trial and error on your own.
▍If you have questions about this article, leave a comment or message me, with the note "CCRC Level 3 self-check"
Puhuazhike / CertFastLine | Export Certification & Testing & Management Systems Consulting
This article is a compliance reference for general information, not legal advice.
Not sure whether your company can apply for CCRC Level 3?
Tell us your company size and existing qualifications for a free eligibility assessment
📞 Free Consultation