Administration Regulations of Cyber Security on Telecommunications Business Article 8

The telecommunications equipment room of telecommunications enterprises shall be established in a physical isolation and be equipped with an independent entrance and exit.The access control security management systems, including all-weather intrusion alerts and video surveillance, shall be installed at the entrance and exit specified in the preceding paragraph. The alerts and recorded videos shall be retained for at least six months.The telecommunications equipment room specified in Paragraph 1 shall only be accessed by those with purposes of installation, maintenance, monitoring or other operational purposes deemed necessary.Telecommunications enterprises shall determine their respective security management and operation rules for telecommunications equipment rooms.The security management and operation rules as described in the preceding paragraph shall include at least the following items:1. Division of authority: including authorities related to the security maintenance zone, responsible units, staff organization and duties, and access to the telecommunications equipment room;2. Access control management: including the identification（name and ID card or passport number）, organization（institution）entry（exit）time and entry（exit）purposes of the persons entering and leaving the machine room; auditor’s audit records; and objects entering（leaving）the room;3. Maintenance management: management of the maintenance works conducted by internal staff or subcontractors.4. Environment management: management of fire-fighting, security, electricity and relevant facilities.5. Management records: including the access management, maintenance management and environment maintenance records.6. Audit（s）: regular and irregular audit works.The management records specified in Subparagraph 5 of the preceding paragraph shall be retained for at least six months.With respect to the security management and operation rules for telecommunications equipment rooms specified in Paragraph 4, the competent authority may require the telecommunications enterprise to make amendments according to the implementation status thereof.The telecommunications enterprise shall implement the security management and operation rules for telecommunications equipment rooms specified in Paragraph 4; the competent authority may conduct an inspection on a regular basis or when deemed necessary.