How Alibaba’s Data Security Maturity Model (DSMM) Is Shaping China’s Data Protection Landscape

Recent high‑profile personal data breaches such as CSDN, 12306, Yahoo, and Equifax have highlighted the critical need for robust data security, a point emphasized by researcher Zhou Hanhua at the Yunqi Conference.

Alibaba’s security division senior director Hou Jingang announced the launch of a “Data Security Partner Program” built on the Data Security Maturity Model (DSMM), inviting partners to share Alibaba’s experience and help enterprises elevate systematic data‑security capabilities.

First batch of 17 partners join DSMM

Since Alibaba first proposed DSMM in 2014 and standardized its practices in 2015, the model has been adopted across the industry. This year, 17 renowned consulting and professional service firms—including Deloitte, EY, Hangzhou Shanjie, and Lixin—partnered with Alibaba to provide specialized data‑security services for organizations that value big‑data management and protection.

Within the data‑security ecosystem, evaluators, certification bodies, and solution providers assess organizations against DSMM’s dimensions, offering targeted or comprehensive services to raise overall industry security levels.

DSMM addresses data‑security management throughout the data lifecycle—collection, storage, transmission, processing, exchange, and destruction—covering four capability dimensions: organizational structure, policies & processes, technical tools, and personnel skills.

According to Alibaba senior security expert Pan Liang, DSMM applies broadly across sectors such as finance, retail, entertainment, manufacturing, metallurgy, power, logistics, and emerging internet‑plus enterprises.

Alibaba also contributes to international standards, leading ITU‑T’s “Security reference architecture for lifecycle management of e‑commerce business data,” ISO’s “Big data security capability maturity model,” and CCSA’s industry framework, with DSMM expected to become a national standard by year‑end.

DingTalk and China Southern Power Grid recognized as data‑security benchmark enterprises

DSMM evaluates organizations across more than 30 security domains, assigning maturity levels from “informal execution” to “continuous optimization.” Only entities reaching at least level three demonstrate comprehensive risk control.

Assessments by the China Academy of Information and Communications Technology identified DingTalk and China Southern Power Grid as leading examples, noting DingTalk’s multi‑layered encryption, third‑party key management, and compliance with China’s “Information System Security Level Protection” certification.

Alibaba and partners build a cloud data‑security protection wall

To assist organizations with low maturity scores, Alibaba Cloud and its partners have created a cloud‑data‑security solution suite based on DSMM, initially focusing on private‑cloud scenarios and later expanding to public‑cloud offerings.

The solution addresses three core needs: compliance with regulations such as the Cybersecurity Law and DSMM standards; private‑cloud and hybrid‑cloud governance that provides visibility into data location, sensitivity, and access controls; and secure data exchange with mechanisms for outbound data permission control, auditing, and masking.