Chương III Nghị định 85/2016/NĐ-CP: Thẩm quyền, trình tự, thủ tục xác định cấp độ

Chapter III

AUTHORITY, PROCEDURE AND FORMALITIES OF CLASSIFICATION

Article 12. Authority to verify and validate classifications

1. For an information system to be given class 1 or class 2:

The specialized information security unit of the administrator of the information system shall verify and validate the proposal for the classification of the information system at class 1 or class 2.

2. For an information system to be given class 3:

a) The specialized information security unit of the administrator of the information system shall verify the classification proposal;

b) The administrator of the information system shall validate the classification proposal.

3. For an information system to be given class 4 or class 5:

a) Ministry of Information and Communications shall lead and cooperate with the Ministry of National Defense and Ministry of Public Security in verifying the classification proposal, unless otherwise governed by Point b and Point c, Section 3 of this Article;

b) Ministry of National Defense shall lead and cooperate with the Ministry of Information and Communications, relevant ministries and bodies in verifying the proposal for classification of information systems under the management of the Ministry of National Defense;

c) Ministry of Public Security shall lead and cooperate with the Ministry of Information and Communications, relevant ministries and bodies in verifying the proposal for classification of information systems under the management of the Ministry of Public Security;

d) The administrator of such information systems shall validate the proposal for classification of the information systems at class 4 and validate the information security proposal of the information systems classified at class 5;

dd) Prime Minister shall validate the list of information systems classified at class 5 (List of national vital information systems).

Article 13. Procedure and formalities for classification upon new investment projects or expansion and upgrade of information systems

1. The investor shall provide and include explanations of the classification proposal in the feasibility study report, the scheme of the information technology application feasibility project or the investment report of the project. Such report shall be sent to functional agencies for verification and to the authorities competent to validate the feasibility study report, the scheme of the information technology application feasibility project or the investment report in accordance with the laws on investment and this Decree.

2. If outsourcing information technology services, the leading outsourcer shall formulate and include explanations of the classification in the plan and/or the scheme of the outsourcing project, which shall be delivered to functional agencies for verification and to competent authorities for validation as per the laws on outsourcing of information technology services and in accordance with this Decree.

3. Documents that explain the classification are defined in Article 15 of this Decree.

Article 14. Procedure and formalities for classification of information systems in operation

1. Proposal of classification:

a) The operator of the information system shall prepare the classification proposal as defined in Article 15 of this Decree;

b) For an information system to be given class 1 or class 2:

The operator of the information system shall submit the classification proposal to the verification body according to Section 1, Article 12 of this Decree;

c) For an information system to be given class 3:

The operator of the information system shall submit the classification proposal to the verification body according to Point a, Section 2, Article 12 of this Decree;

d) For an information system to be given class 4 or class 5:

- The operator of the information system shall submit the classification proposal to the specialized information security unit of the administrator of such system for professional advice on the pertinence of the proposal and on the solutions for securing the information system as classified;

- The operator of the information system shall provide the administrator of the information system with the classification proposal that is sent to the verification body as stated in Point a, Point b or Point c, Section 3, Article 12 of this Decree.

2. Verification of classification proposals:

The authorities competent to verify classification proposals are defined in Article 16 of this Decree.

3. Validation of classification proposals:

a) For an information system to be given class 1 or class 2:

The specialized information security unit of the administrator of the information system shall validate the classification proposal and report to the administrator;

b) For an information system to be given class 3 or class 4:

The operator of the information system shall present the classification proposal to the administrator of such system for validation;

c) For an information system to be given class 5:

- Ministry of Information and Communications shall base on the result of verification of the classification proposal to lead and cooperate with the Ministry of National Defense, Ministry of Public Security, relevant ministries and bodies in presenting the list of information systems classified at class 5 to the Prime Minister for validation;

- The operator of the information system shall present the information security scheme to the administrator of such system for validation;

Article 15. Documents in the classification proposal

A classification proposal includes:

1. Documents that describe and explain the information system in general.

2. Design documents comprised of:

a) For new investment projects or expansion and upgrade of information systems: The preliminary design or equivalent documents;

b) For information systems in operation: The construction design validated by a competent authority or equivalent documents.

3. Documents that explain the criteria-based classification in conformity to the law.

4. Documents that explain the scheme of information security by classification.

5. Professional opinion(s) of the specialized information security unit of the administrator of the information system to be classified at class 4 or class 5.

Article 16. Verification of classification proposals

1. The following details in the classification proposal shall be verified:

a) The compatibility of the classification;

b) The compatibility of the scheme for securing the information system by classification as indicated in the preliminary design, construction design or equivalent documents;

c) The pertinence of the scheme for securing the information system to the operation of the system by classification.

2. Time limit for verification of classification proposals:

a) A valid proposal for classification of an information system at class 3, when received in full, shall be verified in at most 15 days.

b) A valid proposal for classification of an information system at class 4 or class 5, when received in full, shall be verified in at most 30 days.

Article 17. Validation of classification proposals

1. The validation of a classification proposal shall include:

a) The classification proposal;

b) Opinion(s) of verification of the verification body for information systems classified at class 3 or higher.

2. Time limit for validation of classification proposals:

Valid documents, when received in full, shall be processed in at most 07 working days.

Article 18. Procedure and formalities for re-classification of information systems with a validated class

The re-classification of information systems with a validated class, if required according to actual circumstances, shall adhere to the procedure and formalities for initial classification.