Chương I Nghị định 85/2016/NĐ-CP: Những quy định chung

Chapter I

GENERAL

Article 1. Scope

This Decree defines criteria, authority, procedures and formalities to classify the safety of information systems and responsibilities for securing information systems by classification.

Article 2. Regulated entities

This Decree applies to organizations and individuals participating or being involved in the construction, configuration, administration, operation, upgrade and expansion of Vietnam-based information systems that service the application of information technology in the activities of government bodies and agencies and in the provision of online services to the people and enterprises.

Relevant entities are encouraged to adopt this Decree for protecting their information systems.

Article 3. Terminology

In this Decree, the following words and phrases are construed as follows:

1. Administrators of an information system refer to authorities, organizations and individuals given authority to manage the information system directly. In government bodies and agencies, administrators of information systems refer to ministers, ministerial-level bodies, government agencies, provincial People's Committees or entities given discretion in investment projects for the construction, configuration, upgrade and expansion of such information systems.

2. Processing of information refers to the action(s) of generating, providing, collecting, editing, using, storing, transmitting, sharing and exchanging information online.

3. Operators of an information system refer to agencies and organizations that the administrators of the information system designate to operate such system. If the administrators of an information system outsource information technology services, the operators of the information system shall be providers of such services.

4. Specialized information technology units have a functional role in information technology in ministries, ministerial-level bodies, government agencies, provincial Departments of Information and Communications and in the administrators of information systems, which are designated by such administrators.

5. Specialized information security units bear functions and missions to secure the data for administrators of information systems.

6. Information security divisions are formed or designated by administrators of information systems to carry out missions of securing data and responding to network-related information issues.

7. Online services are provided by enterprises or government agencies over a network to organizations and individuals.

Article 4. Principles of security of information systems by classification

1. Information systems concerning operations of agencies and organizations shall be secured by classification into a routine and on the basis of continuity in design, construction, operation and termination in accordance with standards and technical regulations.

2. Information systems concerning operations of agencies and organizations shall be secured comprehensively, synchronously and centrally with regard to investing in protective solutions and sharing resources to optimize performance and preclude redundant and overlapping investments.

3. Resources to secure information systems shall be allocated in descending order of priority.

Article 5. Principles of classification

1. The identification of an information system for later classification is subject to these principles:

a) The information system is solely subjected to an administrator;

b) The information system can operate independently and takes shape to service or facilitate professional operations and specific business activities of organizations and agencies, as defined in Section 2, Article 6 of this Decree.

2. If an information system is comprised of various constituent systems classified differently, the entire system shall adopt the highest among classifications of constituent systems.