Chapter II
CYBERSECURITY OF NATIONAL SECURITY INFORMATION SYSTEMS
Article 10. National security information systems
1. A national security information system is an information system which will cause serious cybersecurity issues if is broken down, infiltrated, overridden, interfered with, disrupted, paralyzed, attacked or sabotaged.
2. National security information systems include:
a) Military, security, diplomacy and cryptography information systems;
b) Systems for archiving and processing state-secret information;
c) Information systems serving storage of particularly important items and documents;
d) Information systems serving storage of materials or substances that are particularly harmful to humans or the environment;
dd) Information systems serving storage, manufacturing and management of other facilities relevant to national security;
e) Important information systems serving operation of central organizations;
g) National information systems serving energy, finance, banking, telecommunications, transport, resources and environment, chemical, health, culture and press authorities;
h) Automatic monitoring and control systems at important works relevant to national security or national security targets.
3. The Prime Minister shall promulgate and revise the list of national security information systems.
4. The Government shall provide for cooperation between the Ministry of Public Security, the Ministry of National Defense, the Ministry of Information and Communications, Vietnam Government Certificate Authority (VGCA) and other ministries in appraisal, assessment, inspection, supervision of national security information systems and responses to incidents occurring thereto.
Article 11. Appraisal of cybersecurity of national security information systems
1. Cybersecurity security means assessment of cybersecurity contents as the basis for deciding development or upgrade of the information system.
2. Cybersecurity appraisal shall be carried out for:
a) Pre-feasibility study report and design documents of the information system;
b) Information system upgrade scheme.
3. Cybersecurity appraisal contents:
a) Conformity of the design with cybersecurity regulations and conditions;
b) Conformity with the cybersecurity protection and incident response plan, cybersecurity personnel.
4. The power to appraise cybersecurity of national security information systems:
a) The professional cybersecurity force of the Ministry of Public Security shall appraise cybersecurity of national security information systems, except for those mentioned in Point b and Point c of this Clause;
b) The professional cybersecurity force of the Ministry of National Defense shall appraise cybersecurity of military information systems;
c) VGCA shall appraise cybersecurity of information systems thereof.
Article 12. Assessment of cybersecurity of national security information systems
1. Assessment of cybersecurity means considering the cybersecurity capacity of the information system before such system is put into operation.
2. A national security information system shall have:
a) Regulations, procedures and plans for assurance of cybersecurity; system operators and administrators;
b) Assurance of cybersecurity of equipment, hardware and software that are system components;
c) Technical measures for monitoring and protecting cybersecurity; measures for protecting the automatic monitoring and control system. the Internet of things (IoT), mixed reality systems, cloud computing, big data, rapid data and artificial intelligence systems;
d) Physical protection measures, including isolation, prevention of data leak, information transmission control.
3. The power to assess cybersecurity of national security information systems:
a) The professional cybersecurity force of the Ministry of Public Security shall assess and certify cybersecurity of national security information systems, except for those mentioned in Point b and Point c of this Clause;
b) The professional cybersecurity force of the Ministry of National Defense shall assess and certify cybersecurity of military information systems;
c) VGCA shall assess and certify cybersecurity of information systems thereof.
4. A national security information systems will be put into operation after its cybersecurity is certified.
5. The Government shall elaborate Clause 2 of this Article.
Article 13. Inspection of cybersecurity of national security information systems
1. Inspection of cybersecurity means determination of cybersecurity status of an information system, information system infrastructure or information stored, processed or transmitted within the information system in order to prevent, discover and handle cybersecurity threats; implement plans and measures for ensuring normal operation of the information system.
2. A national security information system shall undergo cybersecurity inspection in the following cases:
a) An or network information security service or electronic device is put into use in the information system;
b) There are changes to status of the information system;
c) Annual inspection;
d) Ad hoc inspection in case of cybersecurity incidents or cybersecurity violations; at the request of a cybersecurity authority; expiration of the deadline for remediating vulnerabilities recommended by a professional cybersecurity force.
3. Cybersecurity inspection shall be carried out for:
a) Hardware systems, software systems, digital devices in information systems;
b) Cybersecurity regulations and measures;
c) Information stored, processed and transmitted within the information system;
d) Cybersecurity incident response and remediation plans of the information system admin;
dd) Measures for protection of state secrets; prevention of leak of state secrets through technical channels;
e) Cybersecurity protection.
4. The administrator of a national security information system shall carry out cybersecurity inspection in the cases mentioned in Point a through c Clause 2 of this Article and send the annual inspection report to the professional cybersecurity force of the Ministry of Public Security (or the Ministry of National Defense for military information systems) before October.
5. Ad hoc inspection of cybersecurity:
a) The cybersecurity force shall send a written notification to the system’s administrator at least 12 hours before the inspection in case of a cybersecurity incident or cybersecurity violation; at least 72 hours if the inspection is meant to serve state management of cybersecurity or the deadline for remediation of vulnerabilities has expired;
b) Within 30 days from the end of the inspection, the cybersecurity force shall send a notification and requests to the administrator in case weaknesses or vulnerabilities are found; provide instructions if requested by the admin;
c) The cybersecurity force of the Ministry of Public Security shall carry out ad hoc inspection of national security information systems other than those under the management of the Ministry of National Defense, cryptography systems of VGCA and cryptography products provided by VGCA for protection of state-secret information.
The professional cybersecurity force of the Ministry of National Defense shall carry out ad hoc cybersecurity inspection of military information systems.
VGCA shall carry out ad hoc cybersecurity inspection of its cryptography systems and cryptography products it provides for protection of state-secret information.
d) Administrators of national security information systems shall cooperate with professional cybersecurity forces in the ad hoc cybersecurity inspections.
6. The cybersecurity inspection results shall be kept confidential as prescribed by law.
Article 14. Supervision of cybersecurity of national security information systems
1. Cybersecurity supervision means collection and analysis of information in order to identify cybersecurity threats, cybersecurity incidents, weaknesses and vulnerabilities, malicious codes and hardware, based on which warnings and solutions will be made.
2. d) Administrators of national security information systems shall cooperate with professional cybersecurity forces in supervision of the systems; establish a mechanism to give warnings and receive warnings about cybersecurity threats, cybersecurity incidents, vulnerabilities, malicious codes, malicious hardware and develop emergency response plans.
3. Professional cybersecurity forces shall supervise national security information systems under their management; give warnings and cooperate with their administrators in responding to cybersecurity threats, cybersecurity incidents, vulnerabilities, malicious codes and malicious hardware.
Article 15. Response and remediation of cybersecurity incidents occurring to National security information systems
1. Response and remediation of cybersecurity incidents occurring to National security information systems include the following activities:
a) Discovery and identification of cybersecurity incidents;
b) Scene protection and evidence collection;
c) Limiting the scope of and damage caused by the incident;
d) Determination of the scope of response and subjects that need assistance;
dd) Verification, analysis, assessment and classification of the cybersecurity incident;
e) Execution of the response and remediation plan;
g) Identifying causes and origins of the incident;
h) Investigation and handling;
2. Administrators of national security information systems shall devise plans for responding to and remediating cybersecurity incidents that occur to their systems; implement such plans in case a cybersecurity incident occurs and promptly inform the competent cybersecurity force.
3. Coordinating response and remediation of cybersecurity incidents occurring to national security information systems:
a) Professional cybersecurity forces of the Ministry of Public Security shall coordinate response and remediation of cybersecurity incidents that occur to national security information systems other than those mentioned in Point b and Point c of this Clause; participate in cybersecurity incident response and remediation activities on request; inform the system administrators whenever a cyberattack or cybersecurity incident is discovered;
b) The professional cybersecurity force of the Ministry of National Defense shall coordinate response and remediation of cybersecurity incidents that occur to military information systems;
c) VGCA shall coordinate response and remediation of cybersecurity incidents that occur to their cryptography systems.
4. Other organizations and individuals are responsible for participating in response and remediation of cybersecurity incidents that occur to national security information systems at the request of the coordinating authority.
Tìm kiếm
Luật An ninh mạng 2018 (Bản Pdf)
Luật An ninh mạng 2018 (Bản Word)
