Work Toward CCRC Qualification
and Open Doors to Government & SOE Projects
8 service categories · Level 3 to Level 1 consulting · one-stop support from application through certification
Shenzhen Puhuazhike (深圳市普华智科) — 15 years in the certification industry
What Is CCRC Qualification?
Information security service capability certification issued by the China Cybersecurity Review Certification and Market Regulation Big Data Center (中国网络安全审查认证和市场监管大数据中心)
Required for Government & SOE Projects
Procurement projects such as xinchuang (信创, IT application innovation), smart city and digital government explicitly require bidders to hold CCRC qualification — it works as an entry threshold for suppliers.
Stronger Market Position
A credential that sets you apart from general system integrators in IT service procurement, and one that counts in bid evaluation.
Compliance Driven
MLPS 2.0 (等保2.0) and the Regulations on the Protection of Critical Information Infrastructure require security service providers to demonstrate capability; CCRC is one of the more direct ways to show it.
Access to Larger Projects
Certified companies can take on higher-level security projects, so the per-project value range can widen accordingly (depending on the company's qualifications and on the circumstances of each project).
Eight Service Categories
Match the category to your actual business — newcomers are usually advised to start at Level 3 in security O&M or security integration
Information System Security Integration
Recommended for companies that sell security equipment along with installation and commissioning. Integration contract volume tends to be larger, and the evidence is comparatively easier to organize.
Information System Security Operations & Maintenance
Recommended for companies that maintain security equipment or platforms for clients. O&M contracts are common, and the evidence trail is relatively clear.
Information Security Risk Assessment
For companies that carry out MLPS evaluation, grading and filing, and security assessment projects. The professional bar is higher.
Information Security Emergency Response
For companies working on red-team/blue-team exercises, security incident response and emergency drills. Cases are scarcer, but the field is less crowded.
Software Security Development
For software development companies. It requires secure coding and code audit capability and suits teams with their own products.
Information System Disaster Backup & Recovery
For companies that build disaster recovery centers and design DR plans. Higher specialization, fewer competitors.
Network Security Audit
For information system security audit providers — a narrower segment, with more room to differentiate.
Not sure which one fits?
Contact us and we will help you identify a suitable category
Free assessment →Three Qualification Levels
From the Level 3 entry point to Level 1 expert, step by step. Many companies start at Level 3, on a reference timeline of 2-4 months (subject to the certification body's actual schedule).
| Level | Eligibility Threshold | Typical Use | Consulting Timeline (reference) |
|---|---|---|---|
| ★ Level 3 | Basic capability; one relevant project case is sufficient | Bidding on small and mid-size projects; entry-level qualification | 1-2 months |
| ★★ Level 2 | Intermediate capability; multiple cases required | Called for by many government / SOE projects | 2-3 months |
| ★★★ Level 1 | Advanced capability; extensive cases plus technical tools | Large projects and provincial-level projects | 3-4 months |
Timelines above are reference timelines, subject to the certification body's schedule and to your company's own conditions.
Why Work With Us
15 years in the certification industry — we know the process, the audit, and how to get ready for both
Experienced Team
CCAA-registered auditor background, familiar with the full CCRC process and with what auditors look at, ask about and flag.
Organizing Existing Project Evidence
We help you organize the security service work already covered by your existing IT project contracts into a verifiable evidence trail — a key step in a CCRC application.
Pre-Submission Review
We know the common reasons files are sent back at document review, and we help you avoid them up front. Needs survey report, service plan and evidence trail, all handled in one place.
Cost-Effective
A lean one-person practice, without the management overhead of a large consulting firm. Covers the full document set, the filing and on-site audit coaching.
End-to-End Handling
From initial screening → document preparation → system submission → document review → on-site audit → certificate, you only supply the source materials.
Two-Way Referral Opportunity
Clients already using product certification can take on CCRC consulting as well, and the other way round. One-stop service supports client retention.
Application Process
Typically 2-4 months — a reference timeline, subject to the certification body's schedule and to your company's conditions
Initial Screening
Quick feasibility check; we settle on a suitable category and level
Document Preparation
Needs survey report + service plan + organized contracts and evidence
System Submission
Online filing through the certification body's business management system (网数中心业务管理系统)
Document Review
Wait for the review result; files may be returned for revision, and we help with the corrections
On-Site Audit
Auditors visit your site; we run a rehearsal beforehand and sit in on the day
Certificate
The certification decision is made and the certificate issued; valid for 3 years
CCRC vs ISMS (ISO 27001)
The two are complementary rather than competing. Government projects look for CCRC; international business looks for ISMS.
| Dimension | CCRC | ISMS (ISO 27001) |
|---|---|---|
| Nature | Service qualification certification | Management system certification |
| Focus | "Can security services be delivered well?" | "Is information security being managed well?" |
| Issuing body | CCRC (China) | Third-party certification body |
| Validity | 3 years | 3 years (annual surveillance audit) |
| International recognition | Domestic only | Internationally recognized (IAF) |
| Domestic value | Frequently required for government projects | Broadly recognized |
| Application timeline | 2-4 months | 3-6 months |
| Consulting fee | Contact us for a quote | Contact us for a quote |
CCRC + ISMS as a combined approach
Many clients apply for both at once; the same documentation can be reused, which keeps the extra effort low
Discuss a combined plan →Frequently Asked Questions
The questions clients ask us about CCRC certification
Q: Our company mainly does system integration and has no dedicated security team. Can we apply?
A: Yes. If your contracts cover security equipment installation and commissioning, security configuration or similar scope, that work can be organized into security integration project experience. Many of our clients come from a system integration background.
Q: How long does the application take, and what does approval depend on?
A: About 2 months if things go smoothly, 3-4 months if rework is needed (reference timeline, subject to the certification body's actual schedule). Whether the application is approved depends on your company's actual conditions and on how well the documents are prepared; we carry out a pre-submission review to reduce the risk of the file being returned.
Q: Our project contracts are relatively small (a few tens of thousands of RMB). Can they be used?
A: We can help you organize several smaller contracts into one combined set of project evidence.
Q: Should we do CCRC or ISO 27001 first?
A: If government / SOE projects are your main market, go with CCRC first — it is a common bidding requirement. If your clients are mainly multinational companies, go with ISO 27001 first. The two do not conflict, and holding both strengthens your competitive position.
Q: Does the certificate need annual maintenance?
A: It is valid for 3 years, and you apply for recertification 3 months before expiry. Some categories may involve annual surveillance, which is lighter than the yearly audit under ISO 27001. Keep building up new projects after certification to draw on at recertification.
Q: What is the difference between filing ourselves and working with you?
A: The main challenges when you file on your own: not knowing what auditors look at, a higher rate of returned files, and uncertainty about how to document the evidence trail. Our role is to help you avoid those pitfalls and cut down the back-and-forth for your team.
Get a CCRC Plan for Your Company
A free initial assessment to help you identify a suitable category and level
Talk to Us
+86 18675582602 Jerry Guo · Shenzhen Puhuazhike Technology Co., Ltd. (深圳市普华智科技术有限公司)