Safeguarding National Economic Security through Information Security

Security is the prerequisite for development, and development is the safeguard of security. The outline of the 14th Five-Year Plan proposes to “safeguard national economic security.” Economic security is the key to sustained and healthy economic development, and also an important guarantee for Chinese-path modernization. With the development of digital technology and the expansion of the scale of the digital industry, the digital economy has become a major driver of high-quality development. At the same time, digital security risks are increasingly prominent. General Secretary Xi Jinping emphasizes, “We must resolutely safeguard our country’s development interests, actively guard against various risks, and ensure national economic security,” and “We must safeguard national data security and protect personal information and commercial secrets.” Against the backdrop of the rapid global development of the digital economy and digital factors becoming core means of production, ensuring information security has become an inevitable requirement for defending economic security. We should base ourselves on a holistic approach to national security, carry out systematic deployment in areas such as regulatory and policy guarantees, cultivation of information security talent and technological research and development, enhancement of information security awareness, and international cooperation on information security, so as to safeguard national economic security through information security, and lay a solid foundation for comprehensively advancing the building of a strong country and the great rejuvenation of the Chinese nation through Chinese-path modernization.

安全是发展的前提，发展是安全的保障。“十五五”规划纲要提出，“保障国家经济安全”。经济安全是经济持续健康发展的关键，也是中国式现代化建设的重要保障。随着数字技术的发展和数字产业规模的扩大，数字经济已成为经济高质量发展的重要驱动。与此同时，数字安全风险日益凸显。习近平总书记强调，“我们要坚决维护我国发展利益，积极防范各种风险，确保国家经济安全”，“要维护国家数据安全，保护个人信息和商业秘密”。在全球数字经济高速发展、数字要素成为核心生产资料的时代背景下，保障信息安全已成为捍卫经济安全的必然要求。应立足总体国家安全观，从法规政策保障、信息安全人才培养与技术研发、强化信息安全意识、国际信息安全合作等方面进行系统布局，以信息安全保障国家经济安全，为以中国式现代化全面推进强国建设、民族复兴伟业筑牢根基。

1. Improve the regulatory guarantee system for information security

1. 健全信息安全法规保障体系

We should further improve the system of laws, regulations, and supporting policies for information security. On the basis of the existing legal framework, including the Data Security Law and the Cybersecurity Law, we should refine supporting regulations and implementation rules, and clarify the responsibilities and obligations of all parties in ensuring information security.

应进一步完善信息安全法律法规及配套政策体系，在数据安全法、网络安全法等现行法律框架基础上，细化配套法规与实施细则，明确各方主体在信息安全保障中的责任与义务。

Strengthen rigid constraints in key areas and optimize governance models for critical industries. For key areas such as critical information infrastructure, personal privacy, and state secrets, strictly implement the requirement that “raw data does not leave the domain, backup data is traceable, and highly sensitive data is localized.” For key emerging industries such as artificial intelligence, on the one hand, focus on security risks to formulate special rules and policies, and formulate detailed rules on standards for verifying the sources of training data, requirements for preventing algorithmic discrimination, and obligations for labeling generated content; on the other hand, accelerate the incorporation of requirements for the self-developed proportion of data processing algorithms into the legal framework, and guide enterprises to tackle core algorithm technologies and improve the security autonomy of their data processing through supporting policies such as the establishment of special support funds.

强化重点领域刚性约束，优化关键行业治理模式。对关键信息基础设施、个人隐私以及国家涉密等重点领域数据，严格落实“原始数据不出域，备份数据可追溯，高敏感数据本地化”的要求。针对人工智能等重点新兴产业，一方面，聚焦安全风险制定专项规则政策，针对训练数据来源核验标准、算法歧视防控要求以及生成内容标识义务等方面制定规则细则；另一方面，加快将数据处理算法自研占比要求纳入法律框架，通过设立专项扶持资金等配套政策，引导企业攻关算法核心技术，提高企业数据处理的安全自主性。

Correctly handle the relationship between data security and efficiency, always treat security as the top priority, and regulate data circulation and transaction behavior. At the domestic level, formulate clear data transaction rules and procedures to ensure the legality, standardization, and transparency of data transactions, and ensure transaction security through technical means such as data encryption, access control, and security auditing. At the cross-border level, optimize the regulatory mechanism for cross-border data flow: establish a dynamic management mechanism of “whitelist + security assessment” for cross-border data flow, clarify the scope of countries and regions that are legally permitted to receive data, and ensure that the cross-border flow of data is controllable and traceable; build a full-chain regulatory system of “pre-event assessment—in-process monitoring—post-event tracing,” requiring data operators to complete the collection and storage of information data within the country, conduct security assessments before data leaves the country, and submit corresponding security reports.

正确处理数据安全与效益的关系，始终把安全作为头等大事来抓，规范数据流通交易行为。国内层面，制定明确的数据交易规则和流程，确保数据交易合法性、规范性与透明度，并通过数据加密、访问控制和安全审计等技术手段保障交易安全。境外层面，优化数据跨境流通监管机制：建立数据跨境流通“白名单+安全评估”的动态管理机制，明确合法接收数据的国家和地区范围，确保数据跨境流向可控可溯；构建“事前评估—事中监测—事后追溯”的全链条监管体系，要求数据运营商在境内完成信息数据的采集和存储，在出境前进行安全评估并提交相应的安全报告。

Build a multi-stakeholder collaborative guarantee system and improve the cross-departmental coordination and supervision mechanism. Establish a joint meeting mechanism for relevant departments to share key information such as data security filing, circulation and transactions, entry-exit management, risk assessment, and post-event handling. Build a national information security assessment platform and a unified indicator system, improve the information sharing mechanism, and promote the formation of an information security protection ecosystem involving the joint participation of multiple stakeholders, including the government, enterprises, associations, and research institutes.

构建多主体协同保障体系，完善跨部门协调监管机制。建立联席会议机制，相关部门共享数据安全备案、流通交易、出入境管理、风险评估和事后处置等关键信息。构建国家信息安全评估平台与统一指标体系，健全信息共享机制，推动形成政府、企业、协会、科研院所等多主体共同参与的信息安全保护生态。

Strengthen law enforcement and supervision, and improve the emergency response mechanism. Strictly implement the key data review system, apply technologies such as “encrypted transmission + implicit watermarking” to key data to ensure the security of data transmission; conduct cybersecurity testing and risk assessments for data operators and related enterprises based on data volume and type, and carry out regular special inspections to prevent problems before they occur; formulate graded and classified emergency plans for information security incidents, and under the emergency response framework of “detection—control—assessment—handling—remediation—summary,” clarify standardized handling procedures for scenarios such as data breaches, cyberattacks, and system paralysis, ensuring the timeliness and effectiveness of emergency response.

强化执法监管力度，完善应急响应机制。严格执行重点数据审查制度，对关键数据应用“加密传输+隐式水印”等技术，确保数据传输安全；根据数据体量、类型对数据运营商及相关企业开展网络安全检测和风险评估，定期进行专项检查，防患于未然；制定分级分类信息安全事件应急预案，在“发现—控制—评估—处理—补救—总结”的应急响应框架下，明确数据泄露、网络攻击、系统瘫痪等场景的标准化处置流程，保证应急处理的及时性和有效性。

2. Strengthen the cultivation of information security talent and technological research and development

2. 加强信息安全人才培养与技术研发

Information security work requires support from high-quality talent and takes innovation-driven development as its core. Only by advancing education, science and technology, and talent development in an integrated manner, doing a good job in talent cultivation, insisting on leading industrial upgrading with technological research and development, and accelerating the transformation of scientific and technological achievements, can we empower national information security work through talent cultivation and technological research and development, and lay the talent and technological foundation for effectively protecting information security.

信息安全工作需要以高质量人才为支撑，以创新驱动为核心。只有一体推进教育科技人才发展，做好人才培养工作，坚持以技术研发引领产业升级，加快科技成果转化，才能以人才培养和技术研发赋能国家信息安全工作，为有效保护信息安全奠定人才和技术基础。

Strengthen the cultivation of high-level talent and enhance practical training in information security. Guide universities to set up customized professional directions in the field of information security, optimize the training system, and focus on laying out interdisciplinary directions integrating information security with artificial intelligence, biomedicine, economics, and law, so as to cultivate high-quality talent with interdisciplinary research backgrounds. Deepen industry-university-research collaborative education, support the establishment of stable cooperative relationships among universities, science and technology enterprises in the field of information security, and research institutions, and cultivate composite talent with both innovation and practical abilities by deepening the integration of industry, academia, and research in the field of information security. In digital economy demonstration zones, support universities, research institutions, and enterprises in jointly building information security training bases, and cultivate a group of professional and technical personnel with practical experience in computer science, artificial intelligence, and information security. Precisely integrate ideological and political education into the entire process of course teaching and practical training, and build a high-quality information security talent team that is loyal to the Party, patriotic, and firm in belief.

强化高水平人才培养，加强信息安全实践培训。应引导高校面向信息安全领域开设定制专业方向、优化培养体系，重点布局信息安全与人工智能、生物医学、经济法律等学科的交叉融合方向，培养具有交叉学科研究背景的优质人才。深化产学研协同育人，支持高校、信息安全领域的科技企业、科研机构建立稳定合作关系，通过深化信息安全领域产学研融合，培养兼具创新与实践能力的复合型人才。在数字经济示范区，支持高校、科研机构和企业共建信息安全实训基地，培育一批具有计算机、人工智能和信息安全等相关实践经历的专业技术人才。将思政教育精准融入课程教学和实践实训全过程，打造一支向党爱国、信仰坚定的高素质信息安全人才队伍。

Increase government investment in information security and accelerate the research, development, and application of security technologies. First, increase investment in basic research and core technology research and development in the field of information security, such as establishing a national special fund for information security technology, introducing policies such as scientific and technological innovation awards, financial support, and government procurement, with a focus on supporting the research and development of key core technologies such as data encryption, security auditing, and intrusion detection, and encouraging and guiding enterprises to carry out research and development of information security protection technologies. Second, support universities, research institutions, and enterprises in jointly building innovation platforms, promote the deep integration of scientific and technological innovation and industrial innovation in the field of information security, and open up all links in the chain from “basic research—technological breakthrough—industrial application.” Finally, promote the application of advanced technologies such as “security sandboxing,” “data masking,” and “zero trust architecture” in the field of information security, encourage enterprises to use localized information security technologies, and achieve structured management of “information security filtering + intellectual property protection + personal information masking.”

加大政府信息安全投入，加快安全技术研发应用。首先，加大信息安全领域基础研究与核心技术研发的投入，如设立国家级信息安全技术专项基金，出台科技创新奖励、金融支持和政府采购等政策，重点支持数据加密、安全审计、入侵检测等关键核心技术的研发工作，鼓励引导企业开展信息安全防护技术研发。其次，支持高校、科研机构与企业共建创新平台，推动信息安全领域科技创新与产业创新深度融合，打通“基础研究—技术攻关—产业应用”全链条各环节。最后，推动“安全沙箱”“数据脱敏”“零信任架构”等先进技术在信息安全领域的应用，鼓励企业使用本土化信息安全技术，实现“信息安全过滤+知识产权保护+个人信息脱敏”的结构化管理。

3. Raise information security awareness

3. 提高信息安全意识

Firmly establishing a national security awareness and creating a strong social atmosphere that values information security are the value goals and practical orientation for effectively carrying out information security work. We should strengthen the information security awareness of enterprises, vigorously enhance the information security literacy of the masses, resolutely hold the bottom line of information security, and form a strong joint force across society to safeguard national information security.

牢固树立国家安全意识，营造全社会注重信息安全的浓厚氛围，是有效开展信息安全工作的价值目标和实践导向。应强化企业的信息安全意识，大力提升群众信息安全素质，坚决守牢信息安全底线，形成全社会维护国家信息安全的强大合力。

Establish specialized information security governance organizations by industry, and establish industry security assessment and information-sharing mechanisms. On the one hand, support key industries such as finance, energy, and artificial intelligence in establishing specialized information security protection organizations, bringing together enterprise leaders, scientific research experts, and information security practitioners to jointly formulate industry self-discipline conventions on information security, clarifying behavioral norms for all links including data collection, storage, and transaction. Focus on improving technical specifications for information security protection, refining requirements for key technical operations, and embedding the principles of “minimum necessity” and “informed consent” into the entire data processing process, creating a compliant and orderly industry ecosystem. On the other hand, industry associations should take the lead in conducting annual security compliance ratings, publishing industry security white papers and typical risk cases, and building cross-enterprise security information-sharing platforms to provide risk warning services for small and medium-sized enterprises.

分行业组建专业化信息安全治理组织，建立行业安全评估与共享机制。一方面，支持金融、能源和人工智能等重点行业成立专业化信息安全保护组织，吸纳企业负责人、科研专家和信息安全从业人员共同制定行业信息安全自律公约，明确数据采集、存储、交易等全环节行为规范。重点完善信息安全保护技术规范，细化关键技术操作要求，将“最小必要”和“知情同意”原则嵌入数据处理全流程，营造合规有序的行业生态。另一方面，由行业协会牵头开展年度安全合规评级，发布行业安全白皮书与典型风险案例，搭建跨企业安全信息共享平台，为中小企业提供风险预警服务。

Strengthen the primary responsibility of enterprises and build a solid line of defense for information security. Encourage enterprises to embed the concept of information security into their development strategies, conduct regular specialized training, and reinforce the information security awareness of all employees. Promote the establishment and improvement of a data lifecycle management system within enterprises, achieving closed-loop supervision across the entire chain of data collection, storage, use, and destruction. Improve the tiered evaluation system for enterprises’ digital information management capabilities, granting incentive policies such as government priority procurement and project application preferences to enterprises with higher ratings, thereby guiding enterprises to enhance their autonomous information security protection capabilities.

强化企业主体责任，筑牢信息安全防线。鼓励企业将信息安全理念内嵌于发展战略中，开展常态化专题培训，强化全体员工的信息安全意识。推动企业建立健全数据全生命周期管理制度，实现数据采集、存储、使用、销毁的全链条闭环监管。健全企业数字信息管理能力分级评价体系，对评级较高的企业给予政府优先采购、项目申报倾斜等激励政策，引导企业提升信息安全自主保护能力。

Carry out universal science popularization education to enhance the information security literacy of the entire society. On one hand, relevant departments should coordinate efforts, relying on multiple channels such as television, social media, and community outreach, to strengthen the interpretation of information security policies, risk warnings, and knowledge dissemination, thereby raising the public’s information security awareness and risk prevention awareness. On the other hand, support industry associations and information security enterprises in providing free public-interest consultations, offering voluntary assistance to the public on issues such as personal information protection and network security problem troubleshooting. Additionally, pay attention to the risks of information leakage in citizens’ cross-border exchanges, carry out special publicity and education, publish and popularize cross-border information security guidelines, and ensure the information security of citizens’ cross-border exchanges.

开展全民科普教育，提升全社会的信息安全素养。一方面，由相关部门统筹，依托电视、社交媒体和社区宣传等多种渠道，加强信息安全政策解读、风险警示与知识普及，提高全民信息安全意识和风险防范意识。另一方面，支持行业协会、信息安全企业开展免费公益咨询，为公众提供个人信息保护、网络安全问题排查等志愿帮助。此外，关注公民跨境交流中的信息泄露风险，开展专项宣传教育，发布并普及跨境信息安全指引，保障公民跨境交流的信息安全。

4. Participate in International Information Security Cooperation

4. 参与国际信息安全合作

The rapid evolution of emerging technologies such as artificial intelligence and cloud computing has made information attack methods increasingly diverse and intelligent. Faced with these common challenges, no country can remain unaffected, nor can any country solve them alone. Only by actively participating in international information security cooperation and reaching international consensus can we provide a secure information network environment and a safe and orderly ecosystem for human development and progress.

人工智能、云计算等新兴技术的快速演进，使得信息攻击手段日益多样化与智能化。面对这些共同挑战，没有哪个国家能够独善其身，也没有哪个国家能够独自解决。积极参与国家信息安全合作，达成国际共识，才能为人类发展进步提供安全的信息网络环境和安全有序生态。

Deeply participate in the formulation of international rules for information security and align with high-standard digital trade and economic rules. In terms of rule-making, rely on the United Nations, the Group of Twenty, the Asia-Pacific Economic Cooperation, and other platforms to deeply participate in international standard consultations in areas such as critical information infrastructure, network security, personal information protection, and data security, contributing Chinese solutions for information security governance. Establish efficient information security response cooperation mechanisms with governments of various countries, focusing on promoting consensus on issues such as “mutual recognition of security assessments” and “alignment of compliance systems” for cross-border data flows, thereby improving the response and handling capabilities for cross-border information and data security incidents. In terms of technical standard application, rely on the International Organization for Standardization to take the lead in formulating technical usage norms for data encryption, anonymization processing, and generative artificial intelligence security labeling, promoting the transformation of China’s advantageous technical solutions in fields such as quantum secure communication and industrial internet security into international standards.

深度参与信息安全国际规则制定，对接高标准数字经贸规则。在规则制定方面，以联合国、二十国集团、亚太经合组织等为依托，深度参与关键信息基础设施、网络安全、个人信息保护与数据安全等领域的国际标准磋商，贡献信息安全治理的中国方案。与各国政府建立高效信息安全响应合作机制，重点推动数据跨境流动“安全评估互认”“合规体系对接”等达成共识，提高对跨境信息和数据安全事件的响应和处理能力。在技术标准应用方面，依托国际标准化组织，牵头制定数据加密、匿名化处理、生成式人工智能安全标识等技术使用规范，推动我国量子安全通信、工业互联网安全等优势领域的技术方案转化为国际标准。

Build multi-level and multilateral information security cooperation and strengthen cross-border collaborative governance capabilities. Actively establish cross-border cooperation frameworks, strengthen mutual trust through high-level dialogues and special meetings, and establish an international security cooperation system for cross-border data flows. Deepen cross-border joint research and development of key information security technologies, focusing on core areas such as data encryption and anonymization to carry out cooperation, and consolidate global consensus on maintaining information security. Additionally, actively promote academic exchanges and cooperation between China’s information security research teams and the world’s top institutions, jointly cultivating high-quality information security talent. Establish a collaborative mechanism for handling information security crimes, jointly combating cross-border illegal acts such as data theft, personal privacy leakage, and attacks on enterprise property rights.

构建多层次多边信息安全合作，强化跨国协同治理能力。积极搭建跨国合作框架，通过高层对话、专项会议等强化互信，建立跨境数据流动国际安全合作体系。深化关键信息安全技术跨国联合研发，聚焦数据加密、匿名化等核心领域开展合作，凝聚维护信息安全的全球共识。此外，积极推动我国信息安全领域科研团队与世界顶尖机构的学术交流与合作，共同培育高素质信息安全人才。建立信息安全犯罪协作处理机制，协同打击数据窃取、个人隐私泄露、企业产权攻击等跨境非法行为。

Improve the system for safeguarding the rights and interests of enterprises abroad and build a solid security barrier for “going global.” Establish an information security maintenance service platform to provide services such as information security assessment, risk warning, and legal adaptation for Chinese enterprises abroad, guiding enterprises to respond to overseas data reviews and security lawsuits. Classify and handle overseas information security threats: for general overseas information security threats, urge relevant parties to make timely rectifications through bilateral consultations, public statements, and other means; for serious infringements such as malicious suppression, data theft, and cyber attacks, take reciprocal countermeasures in accordance with the law under the premise of complying with international rules.

健全企业境外权益保障体系，筑牢“出海”安全屏障。应设立信息安全维护服务平台，为境外中国企业提供信息安全评估、风险预警和法律适配等服务，指导企业应对境外数据审查与安全诉讼。分类处置境外信息安全威胁：针对一般性的境外信息安全威胁，通过双边磋商、发声等方式督促相关方及时整改；针对恶意打压、数据窃取和网络攻击等严重侵权行为，在遵守国际规则的前提下依法采取对等反制措施。

(Authors: Sun Zao, Wang Le, both are professors at the School of Economics and Finance, Xi’an Jiaotong University)

（作者：孙早 王乐，均系西安交通大学经济与金融学院教授）