Legal analysis: Level Protection 2.0 modifies the three basic characteristics of the classification object as follows: 1) has a defined main security responsibility subject) carries relatively independent business applications) contains multiple resources that are interconnected.

After years of piloting, promotion, industry standards development, implementation, due to the emergence of new technologies, new applications, a large number of new business forms, especially big data, Internet of Things, cloud computing and other large number of applications, as well as security trends and changes in the situation, the original release of the standard is no longer applicable to the current security requirements, or in the case of new technologies and new applications can no longer meet the need for a new level of protection basis. Reformulation of new standards for equal protection basic requirements, so the security requirements for level protection gradually began to develop 2.0 standards, but this time, in addition to the development of general requirements for general-purpose systems, but also added to the cloud computing, big data, mobile Internet, industrial control, Internet of Things and other aspects of the security scalability requirements, enriched the protection of the content and requirements.

Legal basis: "The Chinese People's **** and State Network Security Law" Article 21 of the national network security level protection system. Network operators shall, in accordance with the requirements of the network security level protection system, perform the following security protection obligations to safeguard the network from interference, damage or unauthorized access, and to prevent network data leakage or theft, tampering: (a) the development of the internal security management system and operating procedures, to determine the person in charge of network security, and the implementation of the responsibility for the protection of network security; (b) to take measures to prevent computer viruses and network attacks, Network intrusion and other technical measures to jeopardize network security behavior; (C) to take monitoring, recording network operation status, network security events, technical measures, and in accordance with the provisions of the retention of the relevant network logs for not less than six months; (D) to take measures such as data classification, backup and encryption of important data; (E) laws, administrative regulations and other obligations.