Chương II Nghị định 53/2022/NĐ-CP: Xác lập danh mục, cơ chế phối hợp, điều kiện an ninh mạng bảo vệ hệ thống thông tin quan trọng về an ninh quốc gia

Chapter II

ESTABLISHMENT OF LISTS, COOPERATIVE MECHANISMS, AND CYBERSECURITY CRITERIA FOR THE PROTECTION OF MAJOR NATIONAL SECURITY INFORMATION SYSTEMS

Section 1. ESTABLISHMENT OF THE LIST OF MAJOR NATIONAL SECURITY INFORMATION SYSTEMS

Article 3. Bases for establishment of major national security information systems

Major national security information systems are information systems of state agencies and political organizations of the Socialist Republic of Vietnam, including:

1. Major national information systems according to regulations of the Law on Cybersecurity of Vietnam.

2. Information systems that serve the direction and operation of major works related to national security according to the law.

3. Information systems that serve the direction, operation, and control of activities of major telecommunications works related to national security according to the law.

4. Information systems of fields prescribed in Clause 2 Article 10 of the Law on Cybersecurity of Vietnam, when there is a breakdown, intrusion, hijacking, falsification, interruption, disruption, paralysis, attack, or sabotage, will cause one of the following consequences:

a) Direct impacts on the independence, sovereignty, unity, territorial integrity of the Vietnam Fatherland, and the existence of the regime and the State of the Socialist Republic of Vietnam;

b) Severe consequences to the national defense, security, and foreign affairs, weakening the capacity to defend and protect the Vietnam Fatherland;

c) Severe consequences to the national economy;

d) Severe disasters to the human life and ecological environment;

dd) Severe consequences to activities of construction works at special levels according to the decentralization of laws on construction;

e) Severe consequences to activities of the planning of guidelines and policies within the scope of state confidentiality;

g) Serious influence on the directive and direct operation of CPV agencies and agencies of the State at central levels.

Article 4. Application for inclusion of information systems in the List of major national security information systems

1. The governing body of an information system shall conduct the review and comparison with regulations prescribed in Clause 4 Article 3 of this Decree and apply for the inclusion of the information system under its management in the List of major national security information systems.

2. Regarding information systems included in the List of major national security information systems:

a) The Ministry of Information and Communications of Vietnam shall send the Ministry of Public Security of Vietnam documents on major national security information systems approved by the Prime Minister of Vietnam for the establishment of the List of major national security information systems;

b) In cases prescribed in Point a Clause 2 of this Article, the governing body of a major national security information system is not required to apply for the inclusion of such system in the List of major national security information systems;

c) The Ministry of Public Security of Vietnam shall include major national security information systems in the List of major national security information systems according to the prescribed order and procedures; notify governing bodies of such information systems of the information systems eligible for inclusion in the List of major national security information systems, and perform other equivalent responsibilities.

3. During the appraisal of information systems on their level of information safety, if such information systems are eligible for inclusion in the List of major national security information systems, the Ministry of Information and Communications of Vietnam shall transfer applications of such information systems for inclusion in the List of major national security information systems to the Ministry of Public Security for appraisal.

4. Cybersecurity protection forces shall, based on their functions and assigned tasks, review information systems with qualifications in accordance with regulations prescribed in Article 3 of this Decree and request governing bodies of such information systems to apply for inclusion of their information systems in the List of major national security information systems.

5. An application for inclusion of an information system in the List of major national security information systems includes:

a) A written request for inclusion of the information system in the List of major national security information systems (Form No. 1 of the Appendix);

b) A document on the provision of the list of the whole information system of the agency or organization (Form No. 2 of the Appendix);

c) Enclosed proving documents, including: documents describing and explaining the overview of the information system; construction design documents approved by competent authorities or equivalences; documents proving the suitability with the criteria for inclusion in the List of major national security information systems; documents explaining solutions to protect information systems (plans for assurance of network infrastructure safety; server security; application security; database security; management policies; organization, personnel; management of design, construction; management of operation; inspection, assessment, and management of risks).

6. The application for inclusion of the information system in the List of major national security information systems shall be made into 1 original copy and sent to:

a) The Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam, excluding cases prescribed in Point b and Point c of this Clause;

b) The Cyber Command of the Ministry of National Defense of Vietnam regarding military information systems.

c) The Cipher Department of the Government of Vietnam regarding cipher information systems of the Cipher Department of the Government of Vietnam.

7. Agencies that receive applications prescribed in Clause 6 of this Article shall respond to suggestions on the received applications in writing (Form No. 3 of the Appendix).

Article 5. Appraisal of applications for inclusion of information systems in the List of major national security information systems

1. The Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall appraise applications for inclusion of information systems in the List of major national security information systems as prescribed by regulations, excluding cases prescribed in Clause 2 and Clause 3 of this Article.

2. The Cyber Command of the Ministry of National Defense of Vietnam shall provide guidelines on the making, receipt, and appraisal of applications for inclusion of military information systems in the List of major national security information systems.

3. The Cipher Department of the Government of Vietnam shall appraise applications for inclusion of information systems of the Cipher Department of the Government of Vietnam in the List of major national security information systems.

4. An Appraisal Council of applications for inclusion of information systems in the List of major national security information systems:

a) The Appraisal Council is required for major national security information systems related to many fields or when the appraisal process needs suggestions from many Ministries and relevant authorities;

b) Members of an Appraisal Council shall work on a part-time basis and self-dissolve upon completion of tasks. According to the nature and role of the information system, members of the Appraisal Council may include the Ministry of Public Security of Vietnam, the Ministry of National Defense of Vietnam, the Ministry of Information and Communications of Vietnam, the Cipher Department of the Government of Vietnam, and relevant agencies and units.   Depending on each specific case, the Appraisal Council shall invite the governing body of the corresponding information system to participate in the appraisal meeting;

c) The Appraisal Council shall appraise the safety level of an information system and the application for inclusion of such information system in the List of major national security information systems.

5. Meeting results of the Appraisal Council shall be generally used for work of cybersecurity and cyber information security.

6. In case of requirement for verification of information in applications and the actual state of the information systems mentioned in such applications, appraisal agencies prescribed in Clauses 1, 2, and 3 of this Article shall organize actual surveys and testing to appraise applications for inclusion of information systems in the List of major national security information systems. The actual survey and testing time shall not exceed 20 days.

Survey results shall be recorded in writing and certified by appraisal agencies and governing bodies of such information systems.

7. Governing bodies shall cooperate and facilitate the appraisal, survey, testing, and supplement of applications at the request of appraisal agencies.

8. Time and procedures for appraisal of applications:

a) The appraisal time of applications is 30 days from the receipt date of valid applications for inclusion of information systems in the List of major national security information systems or from the end date of the survey process prescribed in Clause 6 of this Article;  

b) The time for confirmation of valid applications is 3 working days after receiving the adequate applications for inclusion of information system in the List of major national security information systems;

c) At the end of the appraisal time, appraisal agencies shall finalize documents and send them to the Minister of Public Security of Vietnam, Minister of National Defense of Vietnam for suggestions for presentation of such documents to the Prime Minister of Vietnam to request the promulgation and update of decisions according to their functions and assigned tasks. At the same time, notify the governing bodies of information systems of the appraisal results in writing (Form No. 4 of the Appendix); 

d) The Minister of the Ministry of Public Security of Vietnam and the Minister of National Defense of Vietnam shall decide on the extension of appraisal time. The extended time shall not exceed 20 days.

9. The Ministry of Public Security of Vietnam shall take charge and cooperate with the Ministry of National Defense of Vietnam and the Cipher Department of the Government of Vietnam in agreeing on the mechanism for requesting the Prime Minister of Vietnam to promulgate Decisions on the establishment and update of the List of major national security information systems.

Article 6. Exclusion of information systems from the List of major national security information systems

1. The governing body of a major national security information system shall apply for exclusion of such information system from the List of major national security information systems if the governing body detects that such information system fails to satisfy the bases prescribed in Article 3 of this Decree.

2. Annually, cybersecurity protection forces shall, based on their functions and tasks, review and detect information systems that fail to comply with regulations prescribed in Article 3 of this Decree and request the related governing bodies to apply for exclusion of such information systems from the List of major national security information systems.

3. An application for exclusion of an information system from the List of major national security information systems includes:

a) A written request for exclusion of the information system from the List of major national security information systems (Form No. 5 of the Appendix);

b) Other necessary documents directly related to the application for exclusion of the information system from the List of major national security information systems.

4. Order, procedures, and competency to consider and decide on the exclusion of information systems from the List of major national security information systems shall comply with regulations on the order, procedures, and competency to consider and decide on the inclusion of information systems in the List of major national security information systems.

Article 7. Cooperation in appraising, assessing, inspecting, supervising, responding to, and remedying incidents of major national security information system

1. The protection of cybersecurity and cyber information security of major national security information systems shall be performed according to regulations of laws on cybersecurity and cyber information security.

2. Principles of cooperation

a) Application of regulations of laws on cybersecurity and cyber information security to the appraisal, assessment, inspection, supervision, response, and remedy for incidents of major national information systems;

b) In case cooperation between many relevant parties is required, the Ministry of Public Security of Vietnam, the Ministry of National Defense of Vietnam, and the Cipher Department of the Government of Vietnam shall, based on the Law on Cybersecurity, take charge and cooperate with the Ministry of Information and Communications and Ministries and central authorities related to the organization of the appraisal, assessment, inspection, supervision, response, and remedy for incidents of major national security information systems according to their functions and assigned tasks;

c) The cooperation process shall ensure compliance with treaties and regulations of international organizations to which Vietnam is a signatory, the Law on Cybersecurity, and relevant laws in a proactive, regular, and timely manner that is in line with assigned functions, tasks, and entitlements.

3. Methods of cooperation

a) The Ministry of Public Security shall request relevant Ministries and central authorities to appoint their members to participate in the appraisal, assessment, inspection, supervision, response, and remedy for incidents of major national security information systems in writing;

b) Relevant Ministries and central authorities shall appoint their members to adequately participate in activities during the process of the appraisal, assessment, inspection, supervision, response, and remedy for incidents of major national security information systems according to the content of the request;

c) Records and documents that serve the appraisal, assessment, inspection, supervision, response, and remedy for incidents of major national security information systems shall be sent to participants by the Ministry of Public Security according to regulations.

4. Regarding the cooperation in supervising major national security information systems for cybersecurity and cyber information security:

a) Cybersecurity protection forces shall share the data on the testing of cybersecurity and cyber information security serving functions and assigned tasks with the Authority of Information Security and the Ministry of Information and Communications of Vietnam;

b) In case the supervision of cyber information security for major national security information systems has been performed, the supervision data shall be shared and generally used for cybersecurity and cyber information security;

c) Governing bodies of major national security information systems shall arrange premises, technical conditions and establish and connect systems and supervision devices of cybersecurity protection forces to information systems under their management for early detection and warning of cybersecurity risks. 

Section 2. CYBERSECURITY CRITERIA FOR MAJOR NATIONAL SECURITY INFORMATION SYSTEMS

Article 8. Criteria for regulations, procedures, and methods of ensuring cybersecurity for major national security information systems

1. Governing bodies of major national security information systems shall, based on regulations on cybersecurity, state confidentiality protection, confidential work, technical standards and regulations on cyber information security, and other relevant professional technical standards, develop regulations, procedures, and plans for the protection of cybersecurity of major national security information systems under their management.

2. Contents of regulations, procedures, and plans for the protection of cybersecurity shall elaborate on the major information system and major information prioritized for protection; management procedures, technical procedures, and professional procedures in using and protecting cybersecurity of the database and technical infrastructure; the criteria for personnel of cyber administration, system operation, assurance of cyber information security and safety, and activities of drafting, storing, and transmitting state confidentiality via information systems; responsibilities of each division and individual in managing, operating, and using; sanctions for violations.

Article 9. Criteria for personnel of system operation, administration, and cybersecurity protection

1. Divisions in charge of system operation and administration and cybersecurity protection are required.

2. Personnel in charge of system operation and administration and cybersecurity protection shall have professional qualifications in cybersecurity, cyber information security, and information technology; have commitments to protect the confidentiality of information on major national security information systems during the process of working and after leaving the job position.

3. Mechanisms of independent professional operations between divisions of operation, administration, and protection of cybersecurity for major national security information systems are required.

Article 10. Criteria for assurance of cybersecurity for devices, hardware, and software that are components of the system

1. Hardware devices that are components of the system shall be tested for cybersecurity to detect weaknesses and confidential vulnerabilities, malicious codes, transceivers, and malicious hardware for the assurance of compatibility with other components in the major national security information system. Administrative devices must be installed with operating systems and clean applications and have layers of firewall protection. Information systems that handle state confidentialities shall not be connected to the Internet.

2. Products that are warned or notified to have risks of cybersecurity disorder by cybersecurity protection forces shall not be put into use, or they shall have measures to handle and remedy weaknesses, confidential vulnerabilities, malicious codes, and malicious hardware before being put into use.

3. Digital data and information shall be handled and stored via information systems of state confidentiality shall be encrypted or have protection measures during the process of establishment, trade, and storage on the Internet according to regulations of laws on state confidentiality protection.

4. Information technology devices, communication means, data containers, and devices serving activities of information systems shall be managed, destroyed, or fixed according to laws on state confidentiality protection and working regulations of governing bodies of such information systems.

5. System software, feature software, middleware, database, application programs, source codes, and development tools shall be periodically reviewed and updated with patches.

6. Mobile devices and devices with information storage features when connecting to the internal network of a major national security information system shall be tested and controlled for safety assurance and may only be used in such information systems.

7. Devices and means that store information when connecting, transporting, and storing shall:

a) Test the confidentiality before connecting to major national security information systems;

b) Control the connection and disconnection of devices of major national security information systems;

c) Implement measures to ensure safety during transport and storage and protection measures regarding the stored information of state confidentiality.

Article 11. Criteria for technical measures to supervise and protect cybersecurity

1. The operational environment of a major national security information system shall:

a) Be separated from environments of development, testing, and experiment;

b) Apply measures to ensure information safety;

c) Not install tools and means for application development;

d) Eliminate or turn off unused or unnecessary features and feature software on the information system.

2. Data of the major national security information system shall have automatic backup plans suitable for external storage with data change frequency and ensure that arising data must be backed up within 24 hours. Backup data must be tested to ensure the restoration ability every 6 months.

3. A network system shall:

a) Be divided into different network zones according to users and using purposes and must at least have a separate network zone for the server of the information system; have a demilitarized zone (DMZ) to provide services on the Internet; have a separate network zone to provide wireless network services; have a separate network zone for the database server;

b) Have devices and software to control connections and access to major network zones;

c) Have measures to timely control, detect, and prevent unauthorized connections, access, and intrusion;

d) Have plans to respond to distributed denial-of-service attacks (DDoS) and other forms of attacks suitable with the scale and nature of the major national security information system.

4. Adoption of measures and solutions to find and timely detect technical weaknesses and vulnerabilities of the network system, illegal connections, and devices and software illegally installed in the network.

5. Logs of the information system and users’ activities, arising errors, and information safety incidents must be recorded and stored for at least 3 months in a centralized form and backed up at least once a year.

6. Regarding the control of access of users and groups of users using devices and tools:

a) Register, allocate, renew, and revoke access rights of devices and users;

b) Ensure that each account with access to the system is only associated with one user; in case of sharing the account for general access to the major national security information system, there must be approval from competent authorities and identification of the responsibility of each individual at each time of use;

c) Limit and control access to accounts with administrative rights: (i) establish mechanisms to control the creation of accounts with administrative rights to ensure that such accounts may only be used with the approval of competent authorities; (ii) adopt measures to supervise the use of accounts with administrative rights; (iii) ensure that there is only 1 access at a time to an account with administrative rights, and such account shall automatically log out if it is idle for a certain time;

d) Manage and allocate confidential passwords to access the information system;

dd) Review, inspect, and re-consider the approval of access rights of users;

e) Impose requirements and criteria for information safety for devices and tools used for access.

Article 12. Criteria for physical security

1. Major national security information systems shall be arranged and installed at safe locations and protected to reduce risks of threats and hazards from the environment and intrusion.

2. Major national security information systems shall be ensured regarding power sources and support systems when the main power source is disrupted; have measures to prevent overload, voltage drop, and lightning transmission; have grounding systems; have backup power generators and uninterruptible power supply systems (USP) to ensure the continuous operation of devices.

3. Major national security information systems shall have plans and measures to protect and combat intrusion for information collection of unmanned aerial devices.

4. Data centers of major national security information systems shall have their access controlled 24/7.