Chapter III
CIVIL CRYPTOGRAPHY
Article 30. Civil cryptographic products and services
1. Civil cryptographic products include cryptographic documents and technical and professional equipment used to protect information not classified as state secret.
2. Civil cryptographic services include services of protection of information using civil cryptographic products; inspection and assessment of civil cryptographic products; and counseling on cyberinformation confidentiality and security using civil cryptographic products.
Article 31. Trading in civil cryptographic products and services
1. An enterprise that wishes to trade in civil cryptographic products and services on the list of civil cryptographic products and services shall obtain a license for doing so.
2. An enterprise shall be granted a license for trading in civil cryptographic products and services when fully meeting the following conditions:
a/ Having managerial, administration and technical staff members who meet professional requirements on information confidentiality and security;
b/ Having equipment and physical foundations suitable to the scale of provision of civil cryptographic products and services;
c/ Having a technical plan conformable with standards and technical regulations;
d/ Having a cyberinformation confidentiality and security plan in the course of management and provision of civil cryptographic products and services;
dd/ Having an appropriate business plan.
3. Civil cryptographic products shall be inspected and certified as conformable with regulations before being marketed.
4. To obtain a license for trading in civil cryptographic products and services, an enterprise shall pay a fee in accordance with the law on charges and fees.
5. The Government shall promulgate a list of civil cryptographic products and services and detail this Article.
Article 32. Order and procedures for grant of licenses for trading in civil cryptographic products and services
1. An enterprise applying for a license for trading in civil cryptographic products and services shall submit a dossier of application for a license at the Government Cipher Committee.
2. A dossier of application for a license for trading in civil cryptographic products and services shall be made in two sets, each comprising:
a/ An application for a license for trading in civil cryptographic products and services;
b/ A copy of the enterprise registration certificate, investment registration certificate or another paper of equivalent validity;
c/ Copies of information confidentiality and security diplomas or certificates of managerial, administration and technical staff members;
d/ A technical plan, consisting of papers on technical characteristics and specifications of products; standards or technical regulations of products; standards and quality of services; technical measures and solutions; and product waưanty and maintenance plan;
dd/ A cyberinformation confidentiality and security plan in the course of management and provision of civil cryptographic products and services;
e/ A business plan, indicating the scope of provision and recipients of products and services, scale and quantity of products and services, customer service networks, and technical assurance.
3. Within 30 days after receiving a complete dossier, the Government Cipher Committee shall appraise it and grant a license for trading in civil cryptographic products and services; if refusing to grant a license, it shall issue a written notice clearly stating the reason.
4. A license for trading in civil cryptographic products and services shall be valid for 10 years.
Article 33. Modification, supplementation, re-grant, extension, suspension and revocation of licenses for trading in civil cryptographic products and services
1. A license for trading in civil cryptographic products and services shall be modified and supplemented in case the enterprise possessing this license is renamed, replaces its at-law representative, or changes or adds civil cryptographic products and services.
An enterprise shall submit a dossier for license modification and supplementation at the Government Cipher Committee. Such dossier shall be made in two sets, each comprising:
a/ A written request for license modification and supplementation;
b/ A copy of the enterprise registration certificate, investment registration certificate or another paper of equivalent validity;
c/ The granted license for trading in civil cryptographic products and services;
d/ A technical plan, a cyberinformation confidentiality and security plan, and a business plan for products and services to be added as specified at Points d, dd and e, Clause 2, Article 32 of this Law, in case the enterprise wishes to add civil cryptographic products and services or business lines;
Within 10 working days after receiving a complete dossier, the Government Cipher Committee shall appraise it, modify and supplement the license and re-grant a license to the enterprise; if refusing to re-grant a license, it shall issue a written notice clearly stating the reason.
2. If its license for trading in civil cryptographic products and services is lost or damaged, an enterprise shall send a written request for re-grant,’ clearly stating the reason, to the Government Cipher Committee. Within 5 working days after receiving the request, the Government Cipher Committee shall consider it and re-grant a license to the enterprise.
3. An enterprise that does not violate the law on trading in civil cryptographic products and services may have its license for trading in civil cryptographic products and services extended once for no more than one year.
A dossier for license extension shall be sent to the Government Cipher Committee at least 60 days before the license expires, and shall be made in two sets, each comprising:
a/ A written request for license extension;
b/ The license for trading in civil cryptographic products and services which remains valid;
c/ A report on the enterprise’s operation over the latest 2 years.
Within 20 days after receiving a complete dossier, the Government Cipher Committee shall appraise it, decide to extend the license and re-grant a license to the enterprises; if refusing to re-grant a license, it shall issue a written notice clearly stating the reason.
4. An enterprise shall be suspended from trading in civil cryptographic products and services for up to 6 months in the following cases:
a/ It provides products and services not stated in the license;
b/ It fails to satisfy one of the conditions specified in Clause 2, Article 31 of this Law;
c/ Other cases provided for by law.
5. An enterprise will have its license for trading in civil cryptographic products and services revoked in the following cases:
a/ It fails to provide the services within one year after being granted the license without a plausible reason;
b/ The license expires;
c/ It is unable to remedy the problems mentioned in Clause 4 of this Article after the suspension period expires.
Article 34. Export and import of civil cryptographic products
1. If wishing to export and import civil cryptographic products on the list of civil cryptographic products subject to export and import permit, an enterprise must obtain a permit for export and import of civil cryptographic products from a competent state agency.
2. An enterprise shall be granted a permit for export and import of civil cryptographic products when fully meeting the following conditions:
a/ Possessing a license for trading in civil cryptographic products and services;
b/ Having to-be-imported civil cryptographic products certified and announced as conformable with regulations under Article 39 of this Law;
c/ Ensuring that users and use purposes of civil cryptographic products do not harm national defense and security or social order ad safety.
3. A dossier of application for a permit for export and import of civil cryptographic products must comprise:
a/ An application for a permit for export and import of civil cryptographic products;
b/ A copy of the license for trading in civil cryptographic products and services;
c/ A copy of the regulation conformity certificate, for civil cryptographic products to be imported.
4. Within 10 working days after receiving a complete dossier, the Government Cipher Committee shall appraise it and grant a permit for export and import of civil cryptographic products to the enterprise; if refusing to grant a license, it shall issue a written notice clearly stating the reason.
5. The Government shall promulgate a list of civil cryptographic products subject to export and import permit and detail this Article.
Article 35. Responsibilities of enterprises trading in civil cryptographic products and services
1. To manage dossiers and documents on technical solutions and technologies of the products.
2. To establish, store and secure customer information, and names, types, quantities and use purposes of civil cryptographic products and services.
3. To report to the Government Cipher Committee on the trading in and export and import of civil cryptographic products and services and summarize customer information before December 31 every year.
4. To take measures to ensure secure and safe transportation and preservation of civil cryptographic products.
5. To refuse to provide civil cryptographic products and services when detecting their users’ violations of the law on use of civil cryptographic products and services or violations of agreed commitments on use of the products and services provided by the enterprises.
6. To suspend or stop providing civil cryptographic products and services in order to ensure national defense and security and social order and safety at the request of competent state agencies.
7. To coordinate with and create conditions for competent state agencies to take professional measures upon request.
Article 36. Responsibilities of users of civil cryptographic products and services
1. To comply with the commitments with enterprises providing civil cryptographic products and services regarding the use management of cryptographic keys, transfer, repair, maintenance, abandonment and destruction of civil cryptography products, and other relevant contents.
2. To provide necessary information relating to cryptographic keys for competent state agencies upon request.
3. To coordinate with and create conditions for competent state agencies to take measures to prevent crimes of stealing information or cryptographic keys and using civil cryptographic products for illegal purposes.
4. Except for diplomatic representative missions, foreign consular offices and representative missions of inter-governmental international organizations in Vietnam, organizations and individuals that use civil cryptographic products provided by those other than enterprises licensed to trade in civil cryptographic products shall declare such to the Government Cipher Committee.
Tìm kiếm
Luật an toàn thông tin mạng 2015 (Bản Pdf)
Luật an toàn thông tin mạng 2015 (Bản Word)