The National Energy Administration issued the "Energy Industry Data Security Management Measures".

The information network storing and processing important data in the energy industry should implement the requirements of network security levels three and above. For information networks storing and processing core data in the energy industry, such as those involving critical information infrastructure, they should implement the security protection requirements for critical information infrastructure on the basis of the network security level protection system; for those not involving critical information infrastructure, they should implement the requirements of network security level four. If laws and regulations require the use of commercial passwords for protection, relevant regulations on commercial password protection should also be followed.