Chương IV Luật An toàn thông tin mạng 2015: Tiêu chuẩn, quy chuẩn kỹ thuật an toàn thông tin mạng

Chapter IV

STANDARDS AND TECHNICAL REGULATIONS ON CYBERINFORMATION SECURITY

Article 37. Standards and technical regulations on cyberinformation security

1. Standards on cyberinformation security include international standards, regional standards, foreign standards, national standards and manufacturer standards on information systems, hardware, software, and systems for management and safe operation of cyberinformation which are announced and recognized for application in Vietnam.

2. Technical regulations on cyberinformation security include national technical regulations and local technical regulations on information systems, hardware, software, and systems for management and safe operation of cyberinformation which are developed, promulgated and applied in Vietnam.

Article 38. Management of standards and technical regulations on cyberinformation security

1. Cyberinformation security regulation conformity certification means a conformity certification organization certifying the conformity of information systems, hardware, software, and systems for management and safe operation of cyberinformation with technical regulations on cyberinformation security.

2. Cyberinformation security regulation conformity announcement means an organization or enterprise announcing the conformity of information systems, hardware, software, and systems for management and safe operation of cyberinformation with technical regulations on cyberinformation security.

3. Cyberinformation security standard conformity certification means a conformity certification organization certifying the conformity of information systems, hardware, software, and systems for management and safe operation of cyberinformation with standards on cyberinformation security.

4. Cyberinformation security standard conformity announcement means an organization or enterprise announcing the conformity of information systems, hardware, software, and systems for management and safe operation of cyberinformation with standards on cyberinformation security.

5. The Ministry of Science and Technology shall assume the prime responsibility for, and coordinate with related agencies in, appraising and announcing national standards on cyberinformation security in accordance with the law on standards and technical regulations.

6. The Ministry of Information and Communications shall:

a/ Draft national standards on cyberinformation security, except national standards mentioned in Clause 7 of this Article;

b/ Promulgate national technical regulations on cyberinformation security, except national technical regulations mentioned in Clause 7 of this Article; and stipulate cyberinformation security regulation conformity assessment;

c/ Manage the quality of cyberinformation security products and services, except civil cryptographic products and services;

d/ Register, designate, and manage the operation of, cyberinformation security conformity certification organizations, except conformity certification organizations for civil cryptographic products and services.

7. The Government Cipher Committee shall assist the Minister of National Defense in drafting national standards on civil cryptographic products and services for submission to competent state agencies for announcement and guidance for implementation; develop and submit to the Minister of National Defense for promulgation national technical regulations on civil cryptographic products and services; designate, and manage the operation of, conformity certification organizations for civil cryptographic products and services; and manage the quality of civil cryptographic products and services.

8. Provincial-level People’s Committees shall develop, promulgate, and guide the implementation of, local technical regulations on cyberinformation security; and manage the quality of cyberinformation security products and services in localities.

Article 39. Assessment of cyberinformation security standard or regulation conformity

1. Assessment of cyberinformation security standard or regulation conformity shall be conducted in the following cases:

a/ Regulation conformity certification or announcement shall be conducted and regulation conformity stamps shall be used before an organization or individual markets cyberinformation security products;

b/ To serve the state management of cyberinformation security.

2. Assessment of cyberinformation security standard or regulation conformity serving national important information systems and serving the state management of cyberinformation security shall be conducted by conformity certification organizations designated by the Minister of Information and Communications.

3. Assessment of standard or regulation conformity for civil cryptographic products and services shall be conducted by conformity certification organizations designated by the Minister of National Defense.

4. The recognition of cyberinformation security standard or regulation conformity assessment results between Vietnam and other countries and territories and between conformity certification organizations of Vietnam and other countries and teưitories must comply with the law on standards and technical regulations.