From Order 151 to Order 176: What Do Retail Stores Need to Supplement?

A message was shared in the store manager group this morning: "Decree No. 176 of the Ministry of Public Security will take effect, and Decree No. 151 will be repealed at the same time. Do we need to redo the internet compliance for our store?" Discussions sprang up in the group. Some rushed to replace equipment, while others thought "nothing has gone wrong before". In fact, once you clarify the relationship between the two decrees and the specific items stores need to supplement, the issue is not that complicated.

I. Relationship Between the Two Decrees: Repeal and Implementation on the Same Day

First, clarify the timeline. Decree No. 176 of the Ministry of Public Security, Measures for the Supervision and Inspection of Cyberspace Security by Public Security Organs, will come into force on October 1, 2026, while the original Decree No. 151 will be repealed on the same day. For retail stores, this does not mean learning a brand-new regulation from scratch. Instead, the regulatory reference number has been updated, with inspection criteria continued and further clarified.

What stores truly need to focus on is not the decree number, but the inspection items specified in the document. The transition between the old and new rules takes effect on a single day, so preparations should be completed before the effective date rather than waiting until the implementation day.

Many store managers mistakenly interpret the "new decree" as a requirement for "new equipment". Decree No.176 governs supervision and inspection activities. Inspections cover real-name authentication and log traceability, alongside remote vulnerability scanning, penetration testing and other security verifications. Stores do not need to rebuild their network from scratch. Treating the decree as a signal to replace hardware wastes money and misses the key regulatory points.

II. Item (3) of Article 7: Inspection Focuses on the Traceability Chain

Item (3) of Article 7 of Decree No.176 clarifies the core inspection focus: whether user registration information and internet access logs are recorded and retained in accordance with the law. Breaking this down, there are two core deliverables for stores:
First, user registration information, namely the real identity verification of customers before they access Wi‑Fi. Second, internet access logs, which are records of online activities. These two correspond to two mandatory actions: real-name authentication and log retention. Store managers need not be intimidated by the title "Supervision and Inspection Measures". For frontline stores, the core work is delivering these two requirements.

Simply put, regulators need to reconstruct the full record: who accessed the internet, at what time, and what websites were visited. User registration information answers "who", while internet logs answer "what was accessed and when". Only with both records can the complete traceability chain of an internet session be closed. If only one part is implemented — for example, collecting identities without retaining logs — the chain breaks, and the store will still fail inspection.

Meanwhile, remote penetration testing and vulnerability scanning verify whether the traceability system itself is secure and protected from tampering or bypassing. Boundary security protection is therefore an indispensable part of the compliance solution.

III. Build a Closed-Loop Compliance System: Real-Name Authentication + 180-Day Log Retention + Boundary Security Protection

The Dream Gateway serves as the egress for authentication and logging. When guests connect to Wi‑Fi, an authentication portal pops up. Users can complete real-name verification via SMS verification code, identity document check or WeChat authentication. Identity data and the network session 4-tuple are recorded together. The Dream Gateway comes with built-in compliant SMS qualification, eliminating the long lead time for independent application.

For log management, the Dream Gateway locally stores logs on the hard disk in a rolling manner for no less than 180 days. Log fields include phone number / ID number, terminal MAC address, IP address, online time, accessed URL and uplink/downlink traffic. Records support search by phone number or time range and one-click export of compliance reports. Stores own the equipment and conduct local self-operation and maintenance. Records stay inside the gateway and do not rely on external links.

Security protection is also integrated on the Dream Gateway. It implements hard isolation between guest Wi‑Fi and internal networks for POS systems, monitoring and office terminals, blocking lateral penetration from guest devices. Built-in attack defense capabilities block port scanning, brute-force cracking, malicious outbound connections and other remote detection behaviors. It tightens management ports exposed to the public network to reduce the attack surface. Internet logs are encrypted upon writing with hierarchical permission control and anti-tampering mechanisms to prevent deletion or alteration of compliance records. It also supports alerts for abnormal online behaviors to identify risks in a timely manner.

This solution is designed to be non-intrusive for stores: the Dream Gateway integrates authentication and logging into one device. The original broadband and optical modem maintain connectivity, while the gateway handles recording. Guests can access the internet as usual, with only the extra compliance steps: real-name verification before access, traceable online records and active security protection. All these processes run locally automatically, requiring no daily manual operation from store managers.

IV. Inspection Methods Are Updated: What Should Stores Prepare in Advance

Decree No.176 defines three inspection forms: online patrols, remote vulnerability scanning / penetration testing and on-site verification. On-site verification will be notified 3 working days in advance. This means the network must pass online patrols on a daily basis. Real-name records and logs cannot be generated and patched up at the end of the year; they must be continuously produced and retained every day.

Preparations in advance: confirm the authentication portal pops up normally and guest identity data is properly stored; ensure the log rolling window stably covers 180 days, with logs retrievable and exportable at any time, and keep all security protection functions enabled.

Built on all-optical infrastructure, audio & video engine and security shielding, AINOPOL delivers an integrated "connectivity & security" solution. The Dream Gateway safeguards network boundaries, ensures guest identity data storage and rolling log retention, and supports one-click report export for inspections. With normalized compliance, stores can fully meet the requirements of the new decree.

FAQ

Q: Will inspectors show up without notice?
A: On-site verification is notified 3 working days in accordance with regulations. Online patrols can happen anytime, so real-name records and logs should be retained continuously instead of being prepared temporarily.
Q: Will inspections become more frequent after Decree No.176 takes effect?
A: Online patrols are explicitly listed as an inspection method, meaning patrols may be carried out on a routine basis. Stores should keep real-name authentication and logging running normally instead of making emergency preparations. The actual inspection frequency is subject to the local public security authority.