Chương II Bảo đảm an toàn thông tin mạng: Bảo đảm an toàn thông tin mạng

Chapter II

ASSURANCE OF CYBERINFORMATION SECURITY

Section 1. CYBERINFORMATION PROTECTION

Article 9. Classification of information

1. Information-owning agencies and organizations shall classify information based on its secrecy in order to take appropriate protection measures.

2. Information regarded as state secret shall be classified and protected in accordance with the law on protection of state secrets.

Agencies and organizations that use classified and unclassified information in activities within their fields shall develop regulations and procedures for processing information; determine contents and methods of recording authorized accesses to classified information.

Article 10. Management of sending of information

1. The sending of information in cyberspace must meet the following requirements:

a/ Not forging the information sender source;

b/ Complying with this Law and other relevant laws.

2. Commercial information may not be sent to electronic addresses of recipients when the latter has not yet consented or has refused to receive, unless the recipients are obliged to receive information under law.

3. Telecommunications enterprises, enterprises providing telecommunications application services and enterprises providing information technology services that send information shall:

a/ Comply with the law on storage of information and protection of personal information and private information of organizations and individuals;

b/ Take blocking and handling measures upon receiving notices of organizations or individuals that the sending of information is illegal;

c/ Offer recipients to refuse to receive information;

d/ Provide necessary technical and professional conditions upon request for competent state agencies to manage and ensure cyberinformation security.

Article 11. Prevention, detection, stoppage and handling of malware

1. Agencies, organizations and individuals shall prevent and stop malware as guided or requested by competent state agencies.

2. The managing body of a national important information system shall put into operation technical and professional systems for preventing, detecting, stopping and promptly handling malware.

3. Enterprises providing email services or transmitting and storing information must have malware filtering systems in the course of sending, receiving and storing information via their systems and shall send reports to competent state agencies in accordance with law.

4. Internet service-providing enterprises shall take measures to manage, prevent, detect, and stop the spread of, malware and handle it at the request of competent state agencies.

5. The Ministry of Information and Communications shall assume the prime responsibility for, and coordinate with the Ministry of National Defense, the Ministry of Public Security and related ministries and sectors in, preventing, detecting, stopping and handling malware that affects national defense and security.

Article 12. Security assurance for telecommunications resources

1. Users of telecommunications resources shall:

a/ Apply managerial and technical measures to prevent cyberinformation insecurity arising from their frequencies, number stores, domain names and internet addresses;

b/ Coordinate with, and provide information relating to telecommunications resource security for, competent state agencies upon request.

2. Enterprises providing services on the internet shall manage, and coordinate in preventing cyberinformation insecurity arising from, internet resources and their clients; provide adequate information at the request of competent state agencies; coordinate in connection and routing to ensure secure and stable operation of Vietnam’s system of national domain name servers.

3. The Ministry of Information and Communications shall ensure cyberinformation security for Vietnam’s system of national domain name servers.

Article 13. Response to cyberinformation security incidents

1. Response to a cyberinformation security incident means activities aiming to handle and remedy an incident that causes cyberinformation insecurity.

2. Response to cyberinformation security incidents must adhere to the following principles:

a/ Being prompt, rapid, accurate, synchronous and effective;

b/ Complying with the law on coordination of response to cyberinformation security incidents;

c/ Ensuring coordination among domestic and foreign agencies, organizations and enterprises.

3. Ministries, ministerial-level agencies, government-attached agencies, provincial- level People’s Committees, telecommunications enterprises and managing bodies of national important information systems shall establish or appoint a specialized division to respond to cyberinformation security incidents.

4. The Ministry of Information and Communications shall coordinate response to cyberinformation security incidents nationwide, and prescribe in detail coordination of response to cyberinformation security incidents.

Article 14. Emergency response to ensure national cyberinformation security

1. Emergency response to ensure national cyberinformation security means incident response activities in catastrophic circumstances or at the request of competent state agencies with a view to ensuring national cyberinformation security.

2. Emergency response to ensure national cyberinformation security must adhere to the following principles:

a/ Organizing response according to decentralized competence;

b/ Conducting response on the spot, rapidly, strictly and with close coordination;

c/ Applying effective and feasible technical measures.

3. Emergency response plans to ensure national cyberinformation security include:

a/ Emergency response plan to ensure national cyberinformation security;

b/ Emergency response plan to ensure cyberinformation security for state agencies, political organizations and socio-political organizations;

c/ Emergency response plan to ensure cyberinformation security for localities;

d/ Emergency response plan to ensure cyberinformation security for telecommunications enterprises.

4. Responsibilities to ensure national cyberinformation security are prescribed as follows:

a/ The Prime Minister shall decide on emergency response plans to ensure national cyberinformation security;

b/ The Ministry of Information and Communications shall coordinate emergency response to ensure national cyberinformation security;

c/ Ministries, sectors, People’s Committees at all levels, and related agencies and organizations shall, within the ambit of their tasks and powers, coordinate and direct emergency response to ensure national cyberinformation security;

d/ Telecommunications enterprises shall take emergency response measures and coordinate with the Ministry of Information and Communications and related ministries, sectors and People’s Committees at all levels in ensuring national cyberinformation security.

Article 15. Responsibilities of agencies, organizations and individuals in ensuring cyberinformation security

1. Agencies, organizations and individuals engaged in cyberinformation security activities shall coordinate with competent state agencies and other organizations and individuals in ensuring cyberinformation security.

2. Agencies, organizations and individuals using services in cyberspace shall promptly notify service-providing enterprises or specialized incident response units of cyberinformation security sabotaging acts or incidents.

Section 2. PROTECTION OF PERSONAL INFORMATION

Article 16. Principles of protecting personal information in cyberspace

1. Individuals shall themselves protect their personal information and comply with the law on provision of personal information when using services in cyberspace.

2. Agencies, organizations and individuals that process personal information shall ensure cyberinformation security for the information they process.

3. Organizations and individuals that process personal information shall develop and publicize their own measures to process and protect personal information.

4. The protection of personal information must comply with this Law and other relevant laws.

5. The processing of personal information for the purpose of ensuring national defense and security and social order and safety or for non-commercial purposes must comply with other relevant laws.

Article 17. Collection and use of personal information

1. Organizations and individuals that process personal information shall:

a/ Collect personal information only after obtaining the consent of its owners regarding the scope and purpose of collection and use of such information;

b/ Use the collected personal information for purposes other than the initial one only after obtaining the consent of its owners;

c/ Refrain from providing, sharing or spreading to a third party personal information they have collected, accessed or controlled, unless they obtain the consent of the owners of such personal information or at the request of competent state agencies.

2. State agencies shall secure and store personal information they have collected.

3. Owners of personal information may request personal information-processing organizations and individuals to provide their personal information collected and stored by the latter.

Article 18. Updating, alteration and cancellation of personal information

1. Owners of personal information may request personal information-processing organizations and individuals to update, alter or cancel their personal information collected or stored by the latter or to stop providing such personal information to a third party.

2. Upon receiving the request of an owner of personal information for update, alteration or cancellation of personal information or for stoppage of the provision of personal information to a third party, a personal information-processing organization or individual shall:

a/ Comply with the request and notify such owner or grant him/her/it the right to access information for the latter to update, alter or delete his/her/its personal information;

b/ Take appropriate measures to protect personal information; and notify such owner if it/he/she fails to comply with the request for technical or other reasons.

3. Personal information-processing organizations and individuals shall delete the stored personal information when they have accomplished their use purposes or the storage time has expired and notify such to the owners of such personal information, unless otherwise prescribed by law.

Article 19. Security assurance for personal information in cyberspace

1. Personal information-processing organizations and individuals shall take appropriate management and technical measures to protect personal information they have collected and stored; and comply with standards and technical regulations on assurance of cyberinformation security.

2. When a cyberinformation security incident occurs or threatens to occur, personal information-processing organizations and individuals shall take remedy and stoppage measures as soon as possible.

Article 20. Responsibilities of state management agencies in protecting personal information in cyberspace

1. To establish online information channels for receiving petitions and reports from the public which are related to security assurance for personal information in cyberspace.

2. To annually inspect and examine personal information-processing organizations and individuals; to conduct extraordinary inspection and examination when necessary.

Section 3. PROTECTION OF INFORMATION SYSTEMS

Article 21. Classification of security grades of information systems

1. Classification of information systems by security grade means the determination of information security grades of information systems in an ascending order from 1 to 5 for taking appropriate management and technical measures to properly protect information systems of each grade.

2. Information systems shall be classified by security grade as follows:

a/ Grade 1 means that when an information system is sabotaged, it will harm lawful rights and interests of organizations or individuals but will not harm public interests, social order and safety or national defense and security;

b/ Grade 2 means that when an information system is sabotaged, it will seriously harm lawful rights and interests of organizations or individuals or will harm public interests but will not harm social order and safety or national defense and security;

c/ Grade 3 means that when an information system is sabotaged, it will seriously harm production, public interests and social order and safety or will harm national defense and security;

d/ Grade 4 means that when an information system is sabotaged, it will cause extremely serious harms to public interests and social order and safety or will seriously harm national defense and security;

dd/ Grade 5 means that when an information system is sabotaged, it will cause exứemely serious harms to national defense and security.

3. The Government shall prescribe in detail criteria, competence, order and procedures for determining security grades of information systems and responsibility for ensuring security for information systems of each grade.

Article 22. Tasks of protecting information systems

1. To determine security grades of information systems.

2. To assess and manage security risks to information systems.

3. To urge, supervise and examine the protection of information systems.

4. To take measures to protect information systems.

5. To comply with the reporting regime.

6. To conduct public information for raising awareness about cyberinformation security.

Article 23. Measures to protect information systems

1. To promulgate regulations on cyberinformation security assurance in designing, developing, managing, operating, using, updating or abolishing information systems.

2. To apply management and technical measures according to standards and technical regulations on cyberinformation security for preventing and combating risks and remedying incidents to cyberinformation security.

3. To examine and supervise the observance of regulations and assess the effectiveness of applied management and technical measures.

4. To supervise security of information systems.

Article 24. Security supervision of information systems

1. Security supervision of an information system means activities of choosing a to-be- supervised object, and collecting, and analyzing the status of, information of this object with a view to identifying factors that affect the security of such information system; reporting on and warning acts of infringing upon cyberinformation security or acts threatening to cause cyberinformation security incidents to such information system; analyzing key factors that affect the status of cyberinformation security; and proposing change of technical measures.

2. Subject to security supervision of an information system are firewall, access control, major routes of information, important servers, important equipment and important terminal equipment.

3. Telecommunications enterprises, enterprises providing information technology services and enterprises providing cyberinformation security services shall coordinate with managing bodies of information systems in supervising the security of information systems at the request of competent state agencies.

Article 25. Responsibilities of managing bodies of information systems

1. Managing bodies of information systems shall protect information systems in accordance with Articles 22, 23 and 24 of this Law.

2. State-funded managing bodies of information systems shall perform the responsibilities defined in Clause 1 of this Article and shall:

a/ Make plans to ensure cyberinformation security appraised by competent state agencies when establishing, expanding or upgrading their information systems;

b/ Appoint individuals or units to take charge of cyberinformation security.

Article 26. National important information systems

1. When establishing, expanding or upgrading a national important information system, information security shall be inspected before putting this system into operation and exploitation.

2. The Ministry of Information and Communications shall assume the prime responsibility for, and coordinate with the Ministry of National Defense, the Ministry of Public Security and related ministries and sectors in, making a list of national important information systems for submission to the Prime Minister for promulgation.

Article 27. Responsibility to ensure cyberinformation security for national important information systems

1. The managing body of a national important information system shall:

a/ Comply with the provisions of Clause 2, Article 25 of this Law;

b/ Periodically have cyberinformation security risks assessed by a specialized organization designated by a competent state agency;

c/ Take standby measures for information systems;

d/ Plan and conduct drills in the protection of national important information systems.

2. The Ministry of Information and Communications shall:

a/ Assume the prime responsibility for, and coordinate with managing bodies of national important information systems, the Ministry of Public Security and related ministries and sectors in, guiding, urging, inspecting and examining the protection of cyberinformation security for national important information systems, except those specified in Clauses 3 and 4 of this Article;

b/ Request telecommunications enterprises, enterprises providing information technology services and enterprises providing cyberinformation security services to provide technical advice and assistance and respond to cyberinformation security incidents for national important information systems.

3. The Ministry of Public Security shall guide, urge, inspect and examine the protection of cyberinformation security for national important information systems under its management; and coordinate with the Ministry of Information and Communications, managing bodies of national important information systems and related ministries, sectors and People’s Committees at all levels in protecting other national important information systems at the request of competent state agencies.

4. The Ministry of National Defense shall guide, urge, inspect and examine the protection of cyberinformation security for national important information systems under its management.

5. The Government Cipher Committee shall organize the use of ciphers for protecting information in national important information systems of state agencies, political organizations and socio-political organizations; and coordinate with managing bodies of national important information systems in supervising cyberinformation security in accordance with law.

Section 4. STOPPAGE OF INFORMATION-RELATED CONFLICTS IN CYBERSPACE

Article 28. Responsibilities of organizations and individuals for stopping information- related conflicts in cyberspace

1. Within the ambit of their tasks and powers, organizations and individuals shall:

a/ Stop sabotaging information originating from their information systems; collaborate with one another in identifying sources, and repulsing, and remedying consequences of, cyber-attacks carried out via information systems of domestic and foreign organizations and individuals;

b/ Stop acts of domestic and foreign organizations and individuals that aim to sabotage the integrity of information networks;

c/ Preclude the organization of illegal cyberspace activities of domestic and foreign organizations and individuals that seriously affect national defense and security or social order and safety.

2. The Government shall prescribe in detail the stoppage of information-related conflicts in cyberspace.

Article 29. Stoppage of use of cyberspace for terrorist purposes

1. Measures to stop the use of cyberspace for terrorist purposes include:

a/ Nullifying internet sources used to commit terrorist acts;

b/ Stopping the establishment and expansion of the exchange of information on signals, factors, methods and ways to use the internet for committing terrorist acts, and on objectives and operation of cyber-terrorism organizations;

c/ Exchanging experiences and practices in controlling internet sources, and seeking and controlling contents of websites for teưorist purpose.

2. The Government shall prescribe in detail responsibilities and measures to stop the use of cyberspace for terrorist purposes prescribed in Clause 1 of this Article.