“We need to pass MLPS 2.0, but our staff are still connecting to the company intranet from their home computers. How do we fix this without losing points?” — this is what SME owners and IT managers going through an MLPS assessment keep asking lately. Today I’ll lay out what MLPS 2.0 actually requires for remote work and remote access, the common point-deduction traps, and how an SME can get fully compliant at low cost.
What MLPS 2.0 actually requires for “remote access”
MLPS 2.0 (GB/T 22239) sets out explicit clauses on remote access to the internal network across secure communication networks, secure area boundaries and secure computing environments. For an SME, it comes down to just a few points:
- Identity verification: remote login must use two-factor / strong authentication, not a single username and password
- Access control: authorization on a need-to-use basis — who can reach which systems must be controllable; connecting must not open up the entire intranet
- Communication encryption: remote transmission encrypted end to end to prevent eavesdropping and tampering
- Security audit: who, at what time, from where, and what was accessed must be captured in retained, retrievable logs (typically ≥6 months)
- Boundary protection: the internal/external boundary needs access-control equipment, and unauthorized devices must not be able to connect
Why “traditional VPNs / overseas networking tools” often lose points here
| Assessment focus | Traditional VPN | ZeroTier/Tailscale |
|---|---|---|
| Rights after connecting | Full access once in; hard to limit by need | Virtual flat Layer 2; coarse granularity |
| Audit logs | Depends on the device; often lacks granularity | Control plane is overseas |
| Data / control plane location | Self-hosted and controllable | Overseas; cross-border transfer is questionable |
| Two-factor authentication | Requires additional purchase | Weak |
In short: the old VPN’s “connect once, reach everything” contradicts the on-demand access MLPS calls for; and with overseas networking tools, the control plane and metadata pass outside the country, making the audit and data-compliance checks hard to clear.
How an SME can get fully compliant at low cost
You don’t need hundreds of thousands of yuan worth of big-vendor equipment. The most cost-effective route for an SME is to use a zero trust (ZTNA) solution to replace the remote-access link, which maps directly onto several of the MLPS requirements:
- ? Strong identity + single-device login → satisfies identity verification; even a stolen account struggles to move laterally
- ? Per-user authorization of subnets/IPs/ports → satisfies “never trust, access on demand”
- ? Full-session encryption → satisfies communication encryption
- ? Retained access logs → satisfies traceable security auditing
- ? Control plane in domestic data centers, with ICP filing completed → data and metadata never leave the country, no compliance hard defects
Our in-house sTrust Zero Trust was built exactly on this approach: SaaS activation, no hardware to buy, live in 5 minutes — turning remote access from a deduction item into a plus. We already serve enterprises such as TongTech, with data in Alibaba Cloud’s Beijing data center and audit logs retained by default.
FAQ
Q: If I only fix remote access, will I pass the MLPS assessment?
A: No. MLPS is systemic (hosts, network, management policies and more all count), but remote access is one of the most common deduction items for SMEs; shoring it up with zero trust removes a major hard defect. We can also work through the remaining items together with your assessment body.
Q: Does the remediation require stopping business or rebuilding the intranet?
A: Basically not. Zero trust is an access layer layered on top of your existing network — staff simply log in with a new client, the intranet structure stays as it is, and the switch is smooth.
Q: Will this replace our IT team’s job?
A: No. We work alongside your IT team to get compliance done — designing the solution, configuring policies, and liaising with the assessment body. IT keeps managing what it manages; we come in as outside support to cover the security gap.
Need to pass MLPS and get remote access right in one go?
sTrust Zero Trust — control plane entirely in China, MLPS-ready, with audit logs. Free 30-day trial for 5 users: strust.siwenlide.com, or call 400-686-2011.
