Secure · Deep Dive

Information Security & Compliance Solution for Financial Institutions in China

For financial institutions operating in China, ESUN Technology provides comprehensive support across information security, regulatory compliance, data governance, audit readiness, and incident response — helping clients build a clear, executable, and auditable compliance backbone that bridges Chinese regulatory requirements and the group's global security framework.

Our goal is not simply to help clients “pass an inspection,” but to build a management foundation that can sustain regulatory examinations, MLPS assessments, parent-company audits, data governance, and security operations over the long term.

For financial institutions, information security and compliance are never standalone technical matters. They span laws and regulations, regulatory expectations, group policy, system architecture, data flows, access control, log retention, vendor management, incident response, and ongoing operations. The Secure solution is built to translate these layered requirements into an executable, manageable, and continuously improvable operating system.

Applicability

Designed for these client scenarios

01Preparing for or currently undergoing MLPS 2.0 Level 3 assessment

02Facing regulatory inspection, CSRC technical filings, or specific compliance requirements

03Need a gap analysis against China's Cybersecurity Law, Data Security Law, and PIPL

04Need to localize the group's global information-security, risk, and audit standards into China

05Need to establish a cross-border data governance, classification, and flow management framework

06Preparing for parent-company IT audit, information-security audit, or ISO 27001-aligned audit

07Need to mature incident response plans, tabletop exercises, and security incident handling processes

08Need to systematically organize existing security controls, technical documentation, ops records, and audit evidence

09Internal team needs external advisory to drive compliance projects, remediation closure, and ongoing regulatory support

Solution Objectives

Beyond passing inspection — building sustainable security and compliance capability

ESUN Technology's information-security and compliance solution is built around the following objectives:

01Identify the gaps between China local regulatory requirements and the group's global security standards

02Establish an information-security control framework that meets regulatory, audit, and internal governance requirements

03Support MLPS 2.0 Level 3 assessment, remediation, evidence preparation, and assessor coordination

04Map data classification, data flows, cross-border access, and data security management requirements

05Establish an auditable, traceable, and handover-ready security documentation system

06Support regulatory inspections, parent-company audits, and third-party audits

07Establish incident response, tabletop exercise, and continuous-improvement mechanisms

08Convert one-off compliance projects into sustainable security and compliance operations

Solution Architecture

Seven coordinated workstreams. Can be delivered individually for a specific compliance need, or as an integrated security and compliance engagement.

Compliance Gap Analysis & Regulatory Mapping

We identify gaps and priorities in the client's IT and security management system across three lenses: China local laws and regulations, financial-industry regulator expectations, and the group's global security framework.

Core Scope

Mapping of China cybersecurity, data security, and personal-information requirements
Financial-industry regulator expectations and business-scenario mapping
Collection of group global information-security, risk, audit, and control requirements
Current-state assessment of systems, network, data, permissions, logging, and operations
Compliance gap identification, risk grading, and remediation priority recommendation
Differential analysis between regulator, group policy, and local execution conditions
Compliance remediation roadmap and implementation plan

Typical Deliverables

Compliance gap analysis report
Regulatory requirement mapping matrix
Group security requirement alignment matrix
Risk and remediation priority list
Compliance remediation roadmap
Project implementation plan

MLPS 2.0 Level 3 Assessment & Remediation Support

We support MLPS 2.0 Level 3 readiness, gap identification, remediation tracking, evidence organization, and assessor coordination — embedding MLPS work into the client's broader security governance rather than treating it as a one-off certification exercise.

Core Scope

MLPS classification, registration, and assessment preparation support
MLPS 2.0 Level 3 technical and management gap analysis
Mapping of network zoning, access control, log auditing, perimeter protection, and security management
Remediation support across host, network, endpoint, application, data, and management policy
Coordination with assessor, client IT/security/business teams, and vendors
Remediation tracking, verification, and closure
Preparation of technical documents, configuration records, and management materials for assessment

Typical Deliverables

MLPS readiness plan
MLPS gap analysis report
MLPS remediation checklist
Security control and configuration verification record
Assessment evidence pack
Remediation tracker
Assessor coordination log

Information Security Control Framework Design

We help clients establish an information-security control framework suited to China operations — one that simultaneously carries regulatory requirements, group governance standards, and real operational needs.

Core Scope

Local information-security control framework design
Network zoning, security boundaries, and access-control principles
Identity authentication, permissions, and privileged-account control design
Endpoint security, patch management, baseline, and AV policy mapping
Log retention, monitoring, audit, and anomaly tracking requirements
Vendor access, remote support, and third-party management requirements
Security policy, operational process, and management system recommendations

Typical Deliverables

Information security control framework
Access control and permissions matrix
Privileged-account management recommendations
Log and monitoring requirements specification
Endpoint security baseline recommendations
Vendor security management requirements
Security management policy recommendations list

Data Security & Cross-Border Data Governance

For global financial institutions, China operations typically involve local data processing, group-system access, cross-border collaboration, and offshore management requirements. We help clients map data classification, data flows, and cross-border access scenarios — building a clearer data-governance foundation.

Core Scope

Local data types, system scope, and business scenario mapping
Data classification, grading, and sensitive-data identification support
Data flow mapping across local systems, group systems, cloud, and third parties
Cross-border access, transfer, and remote-operations scenario identification
Data security control requirements, access permissions, and audit-trail requirements
Personal information protection, least-privilege principle, and authorization boundaries
Data governance documentation and management process recommendations

Typical Deliverables

Data classification and grading recommendations
Data flow diagram
Cross-border data scenario inventory
Data access and permission control matrix
Data security risk inventory
Data governance framework recommendation
Data security management document pack

ISO 27001 Alignment & Audit Readiness

For clients aligned to or preparing for ISO 27001, we help organize ISMS requirements, local control execution evidence, and audit-readiness materials — so the China environment can support group information-security governance and external audit requirements.

Core Scope

ISO 27001 control mapping to local execution status
Information security policies, processes, records, and control evidence
Risk assessment, asset management, access control, and vendor management materials
Logs, change, incident, vulnerability, and audit record organization
Audit interview preparation and evidence organization
Non-conformity, observation, and improvement item tracking
Coordination with group infosec, internal audit, and external auditors

Typical Deliverables

ISO 27001 alignment matrix
Control evidence inventory
Audit readiness material pack
Risk assessment supporting materials
Vendor and asset management records
Audit finding tracker
Remediation and improvement plan

Incident Response Planning & Tabletop Exercise

We help build incident-response mechanisms suited to China operations and validate the process, roles, escalation paths, and communication mechanisms through tabletop exercises.

Core Scope

Security incident classification and response process design
Responsibility boundary confirmation across local team, group IT, security, vendors, and management
Typical scenario design: ransomware, data leak, network outage, critical system unavailability
Emergency contacts, escalation paths, and communication template organization
Tabletop exercise plan, scenario scripts, and material preparation
Exercise recording, issue identification, and improvement recommendations
Emergency plan and SOP update support

Typical Deliverables

Incident response plan
Security incident classification standard
Emergency contact and escalation matrix
Tabletop exercise plan
Exercise scripts and records
Exercise summary report
Improvement item tracker

Regulatory Inspection & Parent-Company Audit Support

We translate the client's day-to-day IT, security, and compliance work into reviewable, explainable, and traceable evidence — supporting regulatory inspections, parent-company audits, and internal governance requirements.

Core Scope

Material checklist for regulatory inspection, MLPS, and group audit
Organization of IT architecture, network, system, security, and data-flow materials
Account permissions, access control, log retention, and change record preparation
Security baseline, vulnerability remediation, incident records, and vendor management evidence
Audit issue explanation, technical clarification, and supplementary material preparation
Audit finding and remediation item tracking
Coordination with client management, group audit, security, and third-party institutions

Typical Deliverables

Regulatory inspection preparation pack
Audit evidence pack
Technical clarification documents
Permission and access control records
Change and operations records
Security remediation tracker
Audit issue response record

Standard Implementation Path

Four phases over approximately 12 weeks — assessment, gap analysis, remediation, and verification.

PHASE 01

Weeks 1–2

Current-State Assessment & Requirement Mapping

Key Tasks

Project kickoff and stakeholder confirmation
Collection of client's existing IT, security, data, and compliance state
Mapping of China local regulatory and industry requirements
Collection of group security policy, audit, and control standards
Confirmation of system, data, vendor, and responsibility scope
Initial gap identification and risk grading

Phase Outputs

Project kickoff document
Current-state assessment inventory
Regulatory & group requirement mapping
Initial gap analysis
Risk and issue list

PHASE 02

Weeks 3–5

Gap Analysis & Remediation Design

Key Tasks

MLPS, regulatory, data security, and group governance gap analysis
Technical control, management process, and documentation gap identification
Remediation measure design and prioritization
Owner, deadline, and dependency confirmation
Initial design of security control and data governance frameworks
Remediation roadmap and implementation plan confirmation

Phase Outputs

Compliance gap analysis report
Remediation list and priorities
Security control framework draft
Data governance framework draft
Remediation implementation plan
RAID Log

PHASE 03

Weeks 6–10

Remediation Execution & Material Preparation

Key Tasks

Security control and configuration remediation support
Account permissions, access control, logs, monitoring, and operations process improvement
MLPS, audit, and regulatory material preparation
Data flow, cross-border access, and system boundary documentation
Incident response plan and tabletop exercise preparation
Coordination with vendors, group teams, assessors, and auditors
Remediation progress tracking and closure verification

Phase Outputs

Remediation tracker
Security configuration and control records
MLPS assessment evidence pack
Audit evidence material pack
Data flow and cross-border scenario documentation
Incident response documentation
Tabletop exercise materials

PHASE 04

Weeks 11–12

Verification, Review & Continuous Improvement

Key Tasks

Remediation result verification
Documentation completeness review
Readiness review for assessment, audit, or inspection
Critical item supplementary remediation
Final communication with management, group teams, and external bodies
Continuous improvement plan formation
Transition to long-term security and compliance advisory

Phase Outputs

Readiness Review Report
Final Evidence Pack
Open Issue and Risk Register
Management Summary
Continuous Improvement Plan
Long-Term Advisory Transition Plan

Project Governance

Governance Mechanisms

Project kickoff meeting
Weekly project status meeting
Security and compliance working sessions
Remediation progress checkpoint
Pre-assessment / pre-audit readiness review
Incident exercise debrief
Project closure and continuous improvement meeting

Management Tools

Master Project Plan
RAID Log
Compliance Requirement Matrix
Remediation Tracker
Evidence Tracker
Decision Log
Audit Finding Tracker
Continuous Improvement Backlog

Key Roles

Client local management team
Group information security team
Group IT team
Compliance, legal, and audit stakeholders
Local systems and infrastructure team
External assessor or audit firm
Relevant platform vendors and providers
ESUN Technology security and compliance team

Deliverables Overview

Bridging China regulation and the group's global security framework

Systematically map Chinese laws, financial-industry regulator expectations, and group global information-security standards — avoiding disconnects between local execution and group governance.

Lower uncertainty in compliance preparation

Structured gap analysis, remediation planning, and evidence preparation help clients clearly understand current state, remediation priorities, and inspection readiness.

Convert security controls into executable mechanisms

Not just policy text — also the technical configuration, process execution, responsibility boundaries, log evidence, and whether ongoing operations are truly sustainable.

Support regulatory inspection and parent-company audit

Pre-organize architecture, permissions, logs, changes, security remediation, and management records — so clients face inspections, assessments, and audits with confidence.

From one-off remediation to continuous improvement

Through ongoing risk tracking, periodic review, and long-term advisory, one-off compliance projects evolve into long-running information-security management capability.

Engagement Models

MODEL 01

Project-based Compliance Engagement

Suited for milestone scenarios: MLPS assessment, regulatory inspection, parent-company audit, ISO 27001 alignment, incident exercise.

Typical cycle of 2–4 months, depending on environment complexity and external body scheduling.

MODEL 02

Specialist Advisory

Suited for focused topics: cross-border data governance, classification, security framework design, audit finding remediation, policy improvement.

Scope and duration defined per topic. Can be delivered as a standalone engagement or chained sequentially.

MODEL 03

Long-term Security & Compliance Advisory

Suited for clients needing continuous regulatory support, quarterly security review, annual audit preparation, and ongoing remediation tracking.

Delivered on a monthly or quarterly retainer basis.

POSITIONING

ESUN Technology's Information Security & Compliance Solution helps financial institutions in China build a compliance backbone that bridges local regulatory requirements and the group's global security framework — translating security controls, data governance, audit evidence, and incident response into an executable, auditable, and continuously improvable operating mechanism.

Discuss this service