Chapter IV
CYBERSECURITY PROTECTION ACTIVITIES
Article 23. Cybersecurity protection in central and local authorities and political organizations
1. Struggle for cybersecurity protection includes:
a) Develop and complete regulations on use of local networks and the Internet; plans for assurance of cybersecurity of information systems; plans for cybersecurity incident response and remediation;
b) Implement and apply various cybersecurity protection plans, measures, technologies to information systems, information and documents created, stored and transmitted within information systems under their management;
c) Provide refresher training in cybersecurity for officials, public employees and other employees; improve the capacity of cybersecurity forces;
d) Ensure cybersecurity during provision of public services in cyberspace, exchange of information with other entities; internal and external transmission of information and other activities specified by the Government;
dd) Invest in and develop infrastructure suitable for assurance of cybersecurity of information systems;
e) Inspect cybersecurity of information systems; prevent and deal with violations against regulations of law on cybersecurity; respond to and remediate cybersecurity incidents.
2. Heads of organizations are responsible for organizing cybersecurity protection activities under their management.
Article 24. Inspection of cybersecurity of information systems other than national security information systems
1. An information system other than national security information systems shall undergo cybersecurity inspection in the following cases:
a) There is a violation of regulations of law on cybersecurity that violates national security or seriously disrupts public order;
b) The inspection is requested by the administrator of the information system.
2. Subjects of cybersecurity inspection:
a) Hardware systems, software systems, digital devices in information systems;
b) Information stored, processed and transmitted within the information system;
c) Measures for protection of state secrets; prevention and response to leak of state secrets through technical channels.
3. Administrators of information systems shall inform the professional cybersecurity force of the Ministry of Public Security upon discovery of cybersecurity breach on their systems.
4. The professional cybersecurity force of the Ministry of Public Security shall carryout cybersecurity inspection of information systems in the cases mentioned in Clause 1 of this Article.
5. The cybersecurity force shall inform the information system administrator in writing at least 12 hours before the inspection.
Within 30 days from the end of the inspection, the cybersecurity force shall send a notification and requests to the administrator in case weaknesses or vulnerabilities are found; provide instructions if requested by the admin.
6. The cybersecurity inspection results shall be kept confidential as prescribed by law.
7. The Government shall elaborate procedures for cybersecurity inspection mentioned in this Article.
Article 25. Protection of cybersecurity of national cyberspace infrastructure and international internet gateways
1. Protection of cybersecurity of national cyberspace infrastructure and international internet gateways shall combine cybersecurity protection and socio-economic development; international internet gateways located within Vietnam's territory will be given priority; investments in national cyberspace infrastructure will be given priority.
2. Responsibility of users of national cyberspace infrastructure and international internet gateways:
a) Protect cybersecurity under their management; facilitate administration and inspection and comply with cybersecurity requirements by competent authorities;
b) Enable and implement administrative and technical measures necessary for competent authorities to protect cybersecurity upon request.
Article 26. Assurance of information security in cyberspace
1. Information mentioned in Clause 1 through 5 Article 16 of this Law and other information that violates national security are not allowed on websites, web portals and social media pages of any organization or individual.
2. Domestic and overseas providers of telecommunications services, internet services and value-added services in Vietnam’s cyberspace have the responsibility to:
a) Verify users’ information when they open digital accounts; protect confidentiality of users’ information and accounts; provide users’ information for professional cybersecurity forces of the Ministry of Public Security upon request in writing to serve investigation into cybersecurity violations;
b) Block and delete information mentioned in Clause 1 through 5 Article 16 of this Law on their services or information systems within 24 hours after a request is given by the cybersecurity force of the Ministry of Public Security or a competent authority of the Ministry of Information and Communications; keep a log of such events to serve investigation into cybersecurity violations for a certain period of time specified by the Government;
c) Stop providing or refuse to provide the aforementioned services for the organizations or individuals that post the information mentioned in Clause 1 through 5 Article 16 of this Law upon request by the cybersecurity force of the Ministry of Public Security or a competent authority of the Ministry of Information and Communications.
3. Domestic and overseas providers of telecommunications services, internet services and value-added services in Vietnam’s cyberspace that collect, analyze or process private information or data about relationships of their service users or data created by their service users in Vietnam shall retain such data for a specific period of time defined by the Government.
Overseas enterprises mentioned in this Clause shall open branches or representative offices in Vietnam.
4. The Government shall elaborate Clause 3 of this Article.
Article 27. Cybersecurity research and development
1. Cybersecurity research and development include:
a) Development of cybersecurity software and equipment;
b) Solutions for appraisal of cybersecurity software and equipment; remediation of weaknesses, vulnerability and malicious software;
c) Methods for inspection of functionality of hardware and software;
d) Methods for state-secret information, work secrets, business secrets, personal secrets, family secrets and privacy; security of information transmitted in cyberspace;
dd) Tracing origins of information transmitted in cyberspace;
e) Elimination of cybersecurity threats;
g) Development of cyberspace boot camps and cybersecurity testing environment;
h) Technical initiatives for improving cybersecurity skills and awareness;
i) Cybersecurity forecasting;
k) Cybersecurity practice research and cybersecurity theory development.
2. All organizations and individuals have the right to carry out cybersecurity research and development.
Article 28. Improvement of cybersecurity independence
1. The State will encourage and enable all organizations and individuals to improve their capacity of cybersecurity and the ability to product, inspect, assess digital devices, network services and network applications.
2. The Government shall implement the following measures to improve cybersecurity independence:
a) Promote transfer, research, mastery and development of cybersecurity technology, products, services and applications;
b) Promote application of new and advanced cybersecurity technologies;
c) Organize provision of training, development and employment of cybersecurity personnel
d) Enhance business environment, improve competitiveness and support for enterprises that research or produce cybersecurity products services and applications.
Article 29. Protection of children in cyberspace
1. Children have the right to be protected, access information, participate in social activities and entertainment, personal information confidentiality and other rights in cyberspace.
2. Administrators of information systems, TSPs, ISPs and VAS providers have the responsibility to make sure information on their systems or services are not harmful children and do not violate children’s rights; block and delete information harmful to children or violating children's rights; Promptly inform and cooperate with the cybersecurity force of the Ministry of Public Security whenever such information is detected.
3. Organizations and individuals operating in cyberspace shall cooperate with competent authorities I protecting children’s rights in cyberspace and prevent information harmful to children in accordance with this Law and children laws.
4. Organizations, parents, teachers, caretakers and relevant individuals have the responsibility to protect children’s rights and protect children in cyberspace in accordance with children laws.
5. Professional cybersecurity forces and other competent authorities shall implement every measure necessary for preventing, detecting, intervening harms to children or violations of children’s rights by means of cyberspace.
Tìm kiếm
Luật An ninh mạng 2018 (Bản Pdf)
Luật An ninh mạng 2018 (Bản Word)