Chương V Luật An toàn thông tin mạng 2015: Kinh doanh trong lĩnh vực an toàn thông tin mạng

Chapter V

TRADING IN THE FIELD OF CYBERINFORMATION SECURITY

Section 1. GRANT OF LICENSES FOR TRADING IN CYBERINFORMATION SECURITY PRODUCTS AND SERVICES

Article 40. Trading in the field of cyberinformation security

1. Trading in the field of cyberinformation security is conditional and covers trading in cyberinformation security products and provision of cyberinformation security services.

2. To trade in cyberinformation security products and services specified in Article 41 of this Law, an enterprise must obtain a license for trading in cyberinformation security products and services from a competent state agency. Such a license shall be valid for 10 years.

3. Trading in cyberinformation security products and services must comply with this Law and other relevant laws.

Conditions and the order and procedures for grant of licenses for trading in civil cryptography products and services, export and import of civil cryptography products, responsibilities of enterprises trading in civil cryptography products and services, and use of civil cryptographic products and services must comply with Chapter III of this Law.

Conditions and the order and procedures for grant of licenses for provision of e-signature certification services must comply with the law on e-transactions.

Article 41. Cyberinformation security products and services

1. Cyberinformation security services include:

a/ Cyberinformation security testing and evaluation services;

b/ Information confidentiality services without using civil cryptography;

c/ Civil cryptographic services;

d/ E-signature certification services;

dd/ Cyberinformation security counseling services;

e/ Cyberinformation security supervision services;

g/ Cyberinformation security incident response services;

h/ Data recovery services;

i/ Cyber-attack prevention and combat services;

k/ Other cyberinformation security services.

2. Cyberinformation security products include:

a/ Civil cryptographic products;

b/ Cyberinformation security testing and evaluation products;

c/ Cyberinformation security supervision products;

d/ Attack and hacking combat products;

dd/ Other cyberinformation security products.

3. The Government shall issue detailed lists of cyberinformation security products and services mentioned at Point k, Clause 1, and Point dd, Clause 2, of this Article.

Article 42. Conditions for grant of licenses for trading in cyberinformation security products and services

1. An enterprise shall be granted a license for trading in cyberinformation security products and services, except those mentioned at Points a, b, c and d, Clause 1, and Point a, Clause 2, Article 41 of this Law, when fully meeting the following conditions:

a/ Such trading complies with the national strategy, master plan or plan on cyberinformation security development;

b/ It has equipment and physical foundations suitable to the scale of provision of cyberinformation security products and services;

c/ It has managerial, administration and technical staff members meeting professional requirements on information security; d/ It has a suitable business plan.

2. An enterprise shall be granted a license for provision of cyberinformation security testing and evaluation services when fully meeting the following conditions:

a/ The conditions specified in Clause 1 of this Article;

b/ It is established and operates lawfully in the Vietnamese territory, except foreign- invested enterprises;

c/ Its at-law representative and managerial, administration and technical staff members are Vietnamese citizens permanently residing in Vietnam;

d/ It has a technical plan conformable with relevant standards or technical regulations;

dd/ It has a customer information confidentiality plan in the course of service provision;

e/ Its managerial, administration and technical staff members possess information security testing and evaluation diplomas or certificates.

3. An enterprise shall be granted a license for provision of information confidentiality services without using civil cryptography when fully meeting the following conditions:

a/ The conditions specified at Points a, b, c, d and dd, Clause 2 of this Article;

b/ Its managerial, administration and technical staff members possess information confidentiality diplomas or certificates.

4. The Government shall detail this Article.

Article 43. Dossiers of application for licenses for ứading in cyberinformation security products and services

1. An enterprise that applies for a license for trading in cyberinformation security products and services shall submit a dossier of application at the Ministry of Information and Communications.

2. A dossier of application for a license for trading in cyberinformation security products and services shall be made in five sets, each comprising:

a/ An application for a license for trading in cyberinformation security products and services, specifying types of cyberinformation security products and services to be traded;

b/ A copy of the enterprise registration certificate, investment registration certificate or another paper of equivalent validity;

c/ A written explanation of the technical equipment system compliant with law;

d/ A business plan specifying the provision scope, users and standards and quality of products and services,

dd/ Copies of information security diplomas or certificates of managerial, administration and technical staff members.

3. In addition to the papers and documents mentioned in Clause 2 of this Article, a dossier of application for a license for provision of information security testing and evaluation services or information confidentiality services without using civil cryptography must comprise:

a/ Judicial record cards of the enterprise’s at-law representative and managerial, administration and technical staff members;

b/ A technical plan;

c/ A customer information confidentiality plan in the course of service provision.

Article 44. Appraisal of dossiers and grant of licenses for trading in cyberinformation security products and services

1. Within 40 days after receiving a complete dossier, the Ministry of Information and Communications shall assume the prime responsibility for, and coordinate with related ministries and sectors in, appraising the dossier, and grant a license for trading in cyberinformation security products and services, except products and services mentioned at Points c and d, Clause 1, and Point a, Clause 2, Article 41 of this Law; if refusing to grant a license, it shall issue a written notice clearly stating the reason.

2. A license for trading in cyberinformation security products and services must have the following principal contents:

a/ Name of the enterprise and its transaction name in Vietnamese and a foreign language (if any); and its head office address in Vietnam;

b/ Name of the enterprise’s at-law representative;

c/ Serial number, date of grant and expiry date of the license;

d/ Cyberinformation security products and services licensed for trading.

3. An enterprise that is granted a license for trading in cyberinformation security products and services shall pay a fee in accordance with the law on charges and fees.

Article 45. Modification, supplementation, extension, suspension, revocation and re-grant of licenses for trading in cyberinformation security products and services

1. A license for trading in cyberinformation security products and services shall be modified and supplemented in case the enterprise possessing this license is renamed or replaces its at-law representative, or changes or adds cyberinformation security products and services it provides.

The enterprise shall submit a dossier for license modification and supplementation at the Ministry of Information and Communications. Such dossier shall be made in two sets, each comprising a written request for license modification and supplementation, a detailed description of contents to be modified and supplemented, and other relevant papers.

Within 10 working days after receiving a complete dossier, the Ministry of Information and Communications shall appraise it, modify and supplement the license, and re-grant a license to the enterprise; if refusing to re-grant a license, it shall issue a written notice clearly stating the reason.

2. If its license for trading in cyberinformation security products and services is lost or damaged, an enterprise shall send a written request for re-grant, clearly stating the reason, to the Ministry of Information and Communications. Within 5 working days after receiving the request, the Ministry of Information and Communications shall consider it and re-grant a license to the enterprise.

3. An enterprise that does not violate the law on trading in cyberinformation security products and services may have its license for trading in cyberinformation security products and services extended once for no more than one year. A dossier for license extension shall be sent to the Ministry of Information and Communications at least 60 days before the license expires, and made in two sets, each comprising:

a/ A written request for license extension;

b/ The license for trading in cyberinformation security products and services which remains valid;

c/ A report on the enterprise’s operation over the latest 2 years.

Within 20 days after receiving a complete dossier, the Ministry of Information and Communications shall appraise it, decide on license extension, and re-grant a license to the enterprise; if refusing to re-grant the license, it shall issue a written notice clearly stating the reason.

4. An enterprise shall be suspended from trading in cyberinformation security products and services for up to 6 months in the following cases:

a/ It provides services not stated in the license;

b/ It fails to satisfy one of the conditions mentioned in Article 42 of this Law;

c/ Other cases prescribed by law.

5. An enterprise will have its license for trading in cyberinformation security products and services revoked in the following cases:

a/ It fails to provide services within one year after being granted the license without a plausible reason;

b/ The license expires;

c/ It fails to remedy the problems mentioned in Clause 4 of this Article after the suspension period expires.

Article 46. Responsibilities of enterprises trading in cyberinformation security products and services

1. To manage dossiers and documents on technical solutions and technologies of products.

2. To establish, store and secure customer information.

3. To report to the Ministry of Information and Communications on the trading in and export and import of cyberinformation security products and services before December 31 every year.

4. To refuse to provide cyberinformation security products and services when detecting organizations’ or individuals’ violations of the law on use of cyberinformation security products and services or violations of agreed commitments on use of products and services provided by the enterprises.

5. To suspend or stop providing cyberinformation security products and services in order to ensure national defense and security and social order and safety at the request of competent state agencies.

6. To coordinate with and create conditions for competent state agencies to take professional measures upon request.

Section 2. MANAGEMENT OF IMPORT OF CYBERINFORMATION SECURITY PRODUCTS

Article 47. Principles of management of import of cyberinformation security products

1. The import of cyber information security products shall be managed in accordance with this Law and other relevant laws.

2. The import of cyberinformation security products by agencies, organizations and individuals entitled to diplomatic privileges and immunities must comply with the customs law and the law on privileges and immunities for diplomatic representative missions, foreign consular offices and representative missions of inter-governmental international organizations in Vietnam.

3. In case Vietnam has no relevant technical regulations on cyberinformation security for imported cyberinformation security products, international agreements or treaties to which the Socialist Republic of Vietnam is a contracting party shall apply.

Article 48. Cyberinformation security products subject to import permit

1. To import cyberinformation security products on the Government-prescribed list of cyberinformation security products subject to import permit, an enterprise shall obtain a permit for import of cyberinformation security products from a competent state agency.

2. Before importing cyberinformation security products, organizations and enterprises must have them certified and announced as conformable with regulations under Article 39 of this Law.

3. An organization or enterprise shall be grantèd a permit for import of cyberinformation security products when fully meeting the following conditions:

a/ Possessing a license for trading in cyberinformation security products;

b/ Having cyberinformation security products certified and announced as confonnable with regulations under Article 39 of this Law;

c/ Ensuring that users and use purposes of cyberinformation security products do not harm national defense and security or social order and safety.

4. The Ministry of Information and Communications shall prescribe in detail the order, procedures and dossier for grant of a permit for import of cyberinformation security products.