Chương III Nghị định 53/2022/NĐ-CP: Trình tự, thủ tục áp dụng một số biện pháp bảo vệ an ninh mạng

Chapter III

ORDER AND PROCEDURES FOR APPLYING CERTAIN CYBERSECURITY PROTECTION MEASURES

Article 13. Order and procedures for cybersecurity appraisals of major national security information systems

1. Cybersecurity protection forces shall conduct cybersecurity appraisals of information systems in the List of major national security information systems as per regulation.

2. Order of the implementation of cybersecurity appraisals of major national security information systems

a) Governing bodies of major national security information systems shall submit applications for cybersecurity appraisals to competent cybersecurity protection forces;

b) Cybersecurity protection forces shall receive, inspect, and provide guidelines on the completion of applications for cybersecurity appraisals and issue receipt documents after adequately receiving the valid applications within 3 working days;

c) Cybersecurity protection forces shall conduct cybersecurity appraisals according to the contents prescribed in Clause 3 Article 11 of the Law on Cybersecurity and provide notifications on the results within 30 days from the receipt date of applications for governing bodies of major national security information systems.

3. An application for cybersecurity appraisal of a major national security information system includes:

a) A written request for cybersecurity appraisal (Form No. 6 of the Appendix); 

b) A pre-feasibility research report and a document on the design and construction of the project on investment in the development of the information system before its approval;

c) The scheme for the upgrade of the information system before its approval in case of upgrading the major national security information system.

4. In case of identifying the conformity between the current state of the major national security information and the application for appraisal, cybersecurity protection forces shall conduct surveys and assessments of the actual state of the major national security information system for comparison with the application for appraisal. The actual surveys and assessments shall not affect the normal operation of the governing body as well as the major national security information system. The actual survey and assessment time shall not exceed 7 working days.

5. Cybersecurity appraisal results shall be protected as prescribed by law.

Article 14. Order and procedures for assessing the criteria for cybersecurity of major national security information systems

1. Cybersecurity protection forces shall assess the criteria for cybersecurity of information systems in the List of major national security information systems as per regulation.

2. Order of the assessment of the criteria for cybersecurity of major national security information systems:

a) Governing bodies of major national security information systems shall submit applications for assessment of the criteria for cybersecurity of major national security information systems to cybersecurity protection forces competent to assess the criteria for cybersecurity according to regulations prescribed in Clause 3 Article 12 of the Law on Cybersecurity;

b) Cybersecurity protection forces shall receive, inspect, and provide guidelines on the completion of applications for assessment of the criteria for cybersecurity and issue receipt documents after receiving the valid applications;

c) After receiving the adequate and valid applications, cybersecurity protection forces shall assess the criteria for cybersecurity and provide notifications on the results within 30 days from the receipt date of such applications for governing bodies of major national security information systems;

d) In case of eligibility for cybersecurity, the Director of the cybersecurity criteria assessment agency shall issue certificates of eligibility for cybersecurity to major national security information systems within 3 working days from the end date of the cybersecurity criteria assessment.

3. An application for the certificate of eligibility for cybersecurity of a major national security information system includes:

a) A written request for certification of the criteria for cybersecurity (Form No. 7 of the Appendix); 

b) A pre-feasibility research report and a document on the design and construction of the project on investment in the development of the information system before its approval;

c) Documents on solutions to ensure cybersecurity of the major national security information system.

4. In case of failure to achieve cybersecurity eligibility, cybersecurity protection forces shall request the governing body of the major national security information system to supplement and upgrade its major national security information system to ensure eligibility.

Article 15. Order and procedures for cybersecurity supervision

1. The Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam and the Cyber Command of the Ministry of National Defense of Vietnam shall conduct the supervision of cybersecurity of the national cyberspace and national major security information systems according to their functions and assigned tasks. The Cipher Department of the Government of Vietnam shall conduct the supervision of cybersecurity of cipher information systems of the Cipher Department of the Government of Vietnam according to its functions and assigned tasks.

2. Order of the supervision of cybersecurity of cybersecurity protection forces:

a) Send written notifications to governing bodies of information systems to request the implementation of cybersecurity supervision measures which specify the reason, time, content, and the implementation scope of cybersecurity supervision;

b) Implement cybersecurity supervision measures;

c) Make periodic statistics and reports on cybersecurity supervision results.

3. Governing bodies of major national security information systems shall:

a) Develop and implement cybersecurity supervision systems and cooperate with cybersecurity protection forces in implementing cybersecurity supervision activities for information systems under their management;

b) Arrange premises and technical conditions and establish and connect systems and supervision devices of cybersecurity protection forces to information systems under their management for cybersecurity supervision;

c) Provide and update information on information systems under their management, technical plans for the implementation of supervision systems for cybersecurity protection forces periodically or irregularly at the request of competent cybersecurity protection forces;

d) Notify cybersecurity protection forces of their supervision activities once every 3 months;

dd) Protect the confidentiality of relevant information in the process of cooperating with cybersecurity protection forces.

4. Telecommunications enterprises and enterprises that provide services of information technology, telecommunications, and the internet shall cooperate with cybersecurity protection forces in conducting cybersecurity supervision according to their entitlements for cybersecurity protection.

5. Cybersecurity supervision results shall be protected as prescribed by law.

Article 16. Order and procedures for cybersecurity testing

1. Cybersecurity protection forces shall conduct cybersecurity testing for information systems according to regulations prescribed in Clause 5 Article 13 and Clause 1 Article 24 of the Law on Cybersecurity. Cybersecurity testing contents include the inspection of compliance with regulations of laws on cybersecurity assurance and protection of state confidentiality in cyberspace; inspection and assessment of the efficiency of plans and measures to ensure cybersecurity and plans for responding to and remedying cybersecurity incidents; inspection and assessment of detection of vulnerabilities, security weaknesses, and malicious codes and system intrusion test attacks; other testing and assessments prescribed by governing bodies.

2. Order and procedures for cybersecurity testing of cybersecurity protection forces:

a) Notify cybersecurity testing plans as per regulation;

b) Establish Testing Teams according to functions and assigned tasks;

c) Conduct cybersecurity testing and strictly cooperate with governing bodies of information systems during the testing process;

d) Make records of cybersecurity testing processes and results and preserve them as prescribed by law;

dd) Notify cybersecurity testing results within 3 working days from the completion date of the testing.

3. In case it is necessary to keep the current state of information systems to investigate and handle law violations, detect security weaknesses and vulnerabilities, provide guidelines, or participate in remedial activities as requested by governing bodies of information systems, cybersecurity protection forces shall request governing bodies of information systems to suspend cybersecurity testing in writing. The mentioned documents shall specify the reason, purpose, and time of the temporary suspension of cybersecurity testing.

Article 17. Order and procedures for responding to and remedying cybersecurity incidents of major national security information systems

1. Regarding major national security information systems, when facing cybersecurity incidents, shall comply with the following order and procedures for response and remedy as follows:

a) Cybersecurity protection forces shall provide written notifications and guidelines on temporary measures to prevent and handle cyber-attacks and remedy consequences of cyber-attacks and cybersecurity incidents for governing bodies of major national security information systems.

In case of emergencies, provide notifications by phone or other forms before providing written notifications;

b) Governing bodies of major national security information systems shall implement measures according to guidelines and implement other suitable measures to prevent, handle, and remedy consequences right after receiving notifications, excluding cases prescribed in Point c of this Clause.

In case of inability to handle, timely notify cybersecurity protection forces for coordination and response to cybersecurity incidents;

c) In case it is necessary to immediately respond to and prevent consequences that threaten national security, cybersecurity protection forces shall decide on the direct coordination and remedial response to cybersecurity incidents.

2. Coordination and remedial response to cybersecurity incidents of cybersecurity protection forces:

a) Assess and decide on schemes for response and remedy for cybersecurity incidents;

b) Operate the response and remedy for cybersecurity incidents;

c) Preside over the receipt, collection, handling, and sharing of information on response and remedy for cybersecurity incidents;

d) Mobilize and cooperate with organizations and individuals inside and outside of Vietnam related to the participation in responding to and remedying cybersecurity incidents in necessary cases;

dd) Appoint focal agencies to cooperate with relevant agencies of other countries or international organizations in responding to and handling international incidents based on international agreements or treaties that Vietnam is a signatory;

e) Inspect, supervise, and urge the implementation of units related to the response and remedy for cybersecurity incidents;

g) Make records of the process of responding to cybersecurity incidents.

3. Organizations and individuals participating in responding to and remedying cybersecurity incidents shall implement measures, responses, and remedies for incidents according to the coordination of cybersecurity protection forces.

4. In case of the protection of national security and social order and safety, telecommunications enterprises and enterprises that provide Internet services shall arrange premises, connectors, and necessary technical measures for the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam to carry out their tasks and ensure cybersecurity. Telecommunications enterprises and enterprises that provide Internet services shall cooperate with the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam in implementing the specific order and procedures.

Article 18. Order and procedures for implementing measures to use passcodes to protect cyber information

1. Cybersecurity protection forces shall use cryptographic measures of the cipher to protect cyber information when transmitting information and documents subject to state confidentiality in cyberspace. Cryptographic measures shall comply with regulations of laws on the cipher, state confidentiality protection, and cybersecurity.

2. In necessary cases, due to reasons of national security, social order and safety, and protection of legitimate rights and benefits of agencies, organizations, and individuals, cybersecurity protection forces shall request relevant agencies, organizations, and individuals to encrypt information not included in the scope of state confidentiality before storing or transmitting on the Internet in writing. The mentioned requesting documents shall specify the reason and content subject to encryption.

Article 19. Order and procedures for implementing measures to request the removal of illegal information or false information in cyberspace that infringes upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals

1. The above-mentioned measures shall be applicable:

a) When information in cyberspace is identified by competent agencies to have contents that infringe upon national security, disseminate information that sabotages the Socialist Republic of Vietnam, incite riots, and disrupt public security and order according to regulations of the law;

b) When there are legal bases to determine that information in cyberspace has humiliating and slanderous contents; infringes upon the order of the economic management; fabricates and falsifies information, causing confusion among the people and severe damage to socio-economic activities to the extent that such information must be removed;

c) When other information in cyberspace has contents prescribed in Points c, dd, e Clause 1 Article 8 of the Law on Cybersecurity.

2. The Director of the Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam and Directors of competent agencies of the Ministry of Information and Communications shall: 

a) Decide on the application of measures to request the removal of illegal information or false information in cyberspace that infringes upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals as prescribed in Clause 1 of this Article;

b) Send written requests to enterprises that provide services on the telecommunications network, services on the Internet, and value-added services in cyberspace and governing bodies of information systems for removal of illegal information or false information in cyberspace that infringes upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals as prescribed in Clause 1 of this Article;

c) Inspect the implementation of measures of relevant entities when requested;

d) Trade and share information on the implementation of the mentioned measures, excluding cases included in the scope of state confidentiality or professional requests of the Ministry of Public Security of Vietnam.

3. Cybersecurity protection forces of the Ministry of National Defense of Vietnam shall apply measures to request the removal of illegal information or false information in cyberspace that infringes upon national security and military security according to regulations prescribed in Clause 1 of this Clause to military information systems.

Article 20. Order and procedures for implementing measures to collect data related to acts of infringing upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals in cyberspace

1. Data is information in the form of symbols, letters, numbers, images, sounds, or equivalences.

2. The Director of the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall decide on the implementation of measures to collect data to investigate and handle acts of infringing upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals in cyberspace.

3. The collection of data related to acts of infringing upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals in cyberspace shall be implemented according to regulations of the law while satisfying the following requirements:

a) Maintenance of the status of digital devices and data;

b) The copying and recording of data shall be done according to correct procedures via recognized devices and software that are verifiable and can protect the integrity of data stored in such devices;

c) The process of restoring data or search data shall be recorded via minutes, images, and videos. The process may be repeated if it is necessary for presentation at a court;

d) Data collectors shall be specialized officials assigned to collect data.

4. Principles of copying and restoring data related to acts of infringing upon national security, social order and safety, and legitimate rights and benefits of organizations, organizations, and individuals in cyberspace:

a) If the data is considered necessary to be copied or restored or there is a request to copy and restore the data for the purpose of proving the commission of a crime, the assigned person shall be authorized to copy and restore such data and acquire a decision on approval of competent authority according to regulations of the law;

b) Compilation of records of activities of copying and restoring electronic evidence, and when it is necessary, an independent third party may be invited to witness and confirm such progress.

5. The confiscation of means that store, transmit, and process data related to acts of infringing upon national security, social order and safety, and legitimate rights and benefits of agencies, organizations, and individuals in cyberspace shall be implemented according to regulations of the law.

6. Cybersecurity protection forces of the Ministry of National Defense of Vietnam shall decide on the application of measures to collect data to investigate cases of violations, criminals that cause insecurity, information insecurity, infringement upon national security and military security in cyberspace.

Article 21. Order and procedures for implementing measures to suspend, temporarily suspend, or request the termination of operations of information systems and revoke domain names

1. The above-mentioned measures shall be applicable when:

a) There are documents proving the operation of the information system is violating laws on national security and cybersecurity;

b) The information system is currently used for purposes of infringing upon national security and social order and safety.

2. The Minister of Public Security of Vietnam shall directly decide on the suspension, temporary suspension, or termination of operations of information systems and the suspension or revocation of domain names that have activities that violate laws on cybersecurity.

3. The Director of the Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall implement decisions on the suspension, temporary suspension, or request for termination of operations information systems, and suspension or revocation of domain names.

4. Order and procedures for implementing the above-mention measures:

a) Report on the application of measures to suspend, temporarily suspend, or request the termination of operations of information systems and suspend or revoke domain names;

b) Decide on the suspension, temporary suspension, or request for termination of operations of information systems and suspension or revocation of domain names;

c) Send written requests to relevant agencies, organizations, and individuals for the implementation of the suspension, temporary suspension, or request for termination of operations of information systems or send written requests to the Vietnam Internet Network Information Center (VNNIC) for the suspension or revocation of domain names according to the order and procedures prescribed by law; requesting documents shall specify the reason, time, content, and complaints;

d) In case of emergencies, timely prevent operations of information systems to avoid endangering national security or prevent potentially harmful consequences. The Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall directly request or send written requests via fax or email to agencies, organizations, and individuals for the suspension, temporary suspension, or request for termination of operations of information systems;

Within 24 hours after receiving requests, the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall send documents on request for suspension, temporary suspension, or request for termination of operation of information systems.  In case there are no documents on decisions when the mentioned time limit is overdue, information systems may continue their operations. According to the nature, level, and consequences due to the delay in sending requesting documents, the assigned officials and relevant persons shall take responsibility according to regulations of the law;

dd) The suspension, temporary suspension, or request for termination of operations of information systems shall be made into records. The records shall specify the time, location, and bases and be made into 2 copies. Relevant competent agencies shall keep one copy, and agencies, organizations, and individuals that own and manage information systems shall keep the other one;

e) Regarding the suspension and revocation of national domain names in cases prescribed in Clause 1 of this Article, relevant competent authorities shall send written requests to the VNNIC for the suspension and revocation of domain names according to the order and procedures prescribed by law.

5. If the suspension, temporary suspension, or request for termination of operations of information systems does not comply with the bases prescribed in Clause 2 of this Article, Directors and Deputy Directors of relevant competent agencies and relevant officials shall take legal liability. If such suspension, temporary suspension, or request for termination of operations of information systems cause damage to relevant agencies, organizations, and individuals, compensate as prescribed by law.

Article 22. Responsibilities of agencies, organizations, and units in implementing cybersecurity protection measures

1. Cybersecurity protection forces shall provide specific guidelines to relevant agencies, organizations, and individuals in implementing regulations on order and procedures for applying certain cybersecurity protection measures.

2. Agencies, organizations, and individuals shall, within their scope of responsibilities and entitlements, timely support and cooperate with cybersecurity protection forces in implementing regulations on order and procedures for implementing certain cybersecurity protection measures.

3. In case cross-border supply enterprises are declared to violate Vietnamese laws by competent authorities, Vietnamese organizations and enterprises shall cooperate with relevant competent agencies in preventing and handling acts of violating laws of cross-border supply enterprises.

4. Any acts of exploiting or taking advantage of cybersecurity protection measures to violate laws shall be handled based on their nature and level of violation according to regulations of the law; In case of damage to legitimate rights and benefits of organizations and individuals, compensate as prescribed by law.

5. Regarding information systems not included in the List of major national security information systems, the Ministry of Public Security of Vietnam, the Ministry of National Defense of Vietnam, and the Ministry of Information and Communications of Vietnam shall synchronously cooperate in protecting cybersecurity and cyber information security according to their functions and assigned tasks:

a) The Ministry of Information and Communications of Vietnam shall act as the focal point in charge of civil activities, excluding regulations prescribed in Points b and c of this Clause;

b) The Ministry of Public Security of Vietnam shall be the focal point in charge of activities of protecting national security, social order and safety, and cybersecurity and preventing and combating cybercriminals, cyber-terrorists, and cyber-spies;

c) The Ministry of National Defense of Vietnam shall be the focal point in charge of activities of protecting the Fatherland in cyberspace.