Chương I Nghị định 108/2016/NĐ-CP quy định chi tiết điều kiện kinh doanh sản phẩm, dịch vụ an toàn thông tin mạng: Những quy định chung

Chapter I

GENERAL PROVISIONS

Article 1. Scope

1. This Decree stipulates regulations on:

a) Requirements, procedures and application for the Business License to provide cyber information security services and products (hereinafter referred to as “Business License”);

b) Cyber information security services and products;

c) Cyber information security imports under the Import License.

2. This Decree does not affect the trading and provision of civil cryptographic services and products and digital signature certification services.

Article 2. Regulated entities

This Decree applies to organizations and enterprises directly participating or involving in the production and importation of cyber information security products and services in Vietnam.

Article 3. Cyber information security services and products

1. Cyber information security products include:

a) Information security risk evaluation products which are hardware or software applications designed to scan, monitor and analyze the configuration, status and log data, detect and identify vulnerabilities and make information security risk assessments.

b) Information security monitoring products which are hardware or software applications designed to monitor and analyze electronic data; collect and analyze real-time data logging; detect and give warning of potential risks or events that may threaten the information security;

c) Instruction detection and prevention products which are hardware or software applications designed to help save the system from cyber-attacks.

2. Cyber information security services include:

a) Information security monitoring services provided to monitor and analyze electronic information, collect and analyze real-time data log, detect and give warning of potential risks or events that may threaten information security;

b) Intrusion detection and prevention services provided to monitor, collect and analyze real-time activities on the system or network in order to detect and prevent malicious activities targeted into the network or system;

c) Information security consulting services aiming to give advices, testing, assessment, offer, design and execution of information security solutions;

d) Incident response services provided to response or adopt appropriate measures to promptly remedy information security incidents;

dd) Data recovery services provided to salvage data that has been damaged or deleted;

e) Information security risk evaluation services provided to scan, monitor and analyze the configuration, status and log data, detect and identify vulnerabilities and make information security risk assessments.

g) Information confidentiality without civil cryptography provided to ensure user's information confidentiality without the backup of civil cryptography.

Article 4. Lists of licensed cyber information security imports

1. Licensed cyber information security imports include:

a) Information security risk evaluation products;

b) Information security monitoring products;

c) Instruction detection and prevention products.

2. The Ministry of Information and Communications shall compile the List of licensed information security imports under clause 1 of this Article.

3. For importers wishing to import information security products other than those specified in clause 1 of this Article, the Import License is not required.