Chương IV Nghị định 85/2016/NĐ-CP: Trách nhiệm bảo đảm an toàn hệ thống thông tin

Chapter IV

RESPONSIBILITIES FOR SECURING INFORMATION SYSTEMS

Article 19. Scheme for security of information systems by classification

1. Schemes for security of information systems must meet basic requirements as defined in technical standards and regulations on security of information systems by classification.

2. A scheme for security of an information system shall consist of:

a) Security of the information system during the phase of design and construction;

b) Securing of the information system during the process of operation;

c) Inspection and assessment of the information safety;

d) Management of information safety risks;

dd) Supervision of information safety;

e) Provisions, emergency response and disaster recovery;

g) Termination of operation, liquidation, disposal.

Article 20. Responsibilities of administrators of information systems

1. The head of an agency or organization administering an information system shall be responsible for:

a) Directing and undertaking the security of information in the activities of his agency or organization;

b) If there is no independent unit specialized in securing information:

- Designate the specialized information technology unit to specialize in information security;

- Establish or designate a specialized information security unit directly under the specialized information technology unit.

2. The administrator of an information system is responsible for:

a) Directing the operator of the information system to make classification proposal(s); verifying and validating classification proposal(s) as per this Decree;

b) Directing and organizing the implementation of scheme(s) for securing the information system under its management by classification as per Article 25, 26 and 27 of the Law on security of information over network, this Decree and relevant legal regulations;

c) Directing and organizing the inspection and assessment of information safety and the management of risks in information safety intra vires, as follows:

- Carry out the inspection and assessment of information safety and general information safety risk management in relation to the activities of the agency or organization on 2-year basis;

- Carry out the inspection and assessment of information safety and information safety risk management over information systems of class 3 and class 4 on annual basis;

- Carry out the inspection and assessment of information safety and information safety risk management over information systems of class 5 on 6-month basis (or when deemed necessary, requested or warned by a functional authority);

- The inspection and assessment of information safety and information safety risks over information systems of class 3 or higher shall be conducted by a professional organization licensed by competent authorities, a government agency given suitable functions and assignments or a specialist organization designated by competent authorities.

d) Directing and organizing the provision of short-term training and propagandas to propagate and heighten awareness and information security drills, as follows:

- Provide short-term training courses that enhance knowledge and skills of public officials and employees in securing information in their agency or organization;

- Propagandize and raise the awareness of public officials and employees in securing information in their agency or organization;

- Carry out information security drills during the activities of the agency or organization; participate in national and international drills that the Ministry of Information and Communications holds.

dd) Direct the operator of the information system(s) to cooperate with relevant functional agencies of the Ministry of Information and Communications in deploying the equipment, connecting technical processor systems, reducing network attacks, supporting the supervision of the information safety of the information system(s) providing online public services, and developing the electronic government.

Article 21. Responsibilities of specialized information security units under administrators of information systems

1. Provide counsels, organize, expedite, inspect and supervise the security of information.

2. Verify, validate or professionally remark on classification proposals within authority as per Section 1 and Section 2, Article 12 and Section 5, Article 15 of this Decree.

Article 22. Responsibilities of operators of information systems

The operator of an information system shall be responsible for:

1. Classifying the security class of the information system as per Article 14 of this Decree.

2. Securing information as per the law, guidelines, standards and regulations on information safety;

3. Assessing the efficiency of information security measures periodically and reporting to the administrator of the information system when necessary;

4. Reporting the security of the information system on periodic or ad hoc basis upon request(s) of the administrator of the information system or competent state management authorities;

5. Cooperating with other entities and actualize requests of functional agencies related to the Ministry of Information and Communications for the security of information.

Article 23. Responsibilities of state management authorities

1. Ministry of Information and Communications shall be responsible for:

a) Verifying the classification proposals intra vires as per Point a, Section 3, Article 12 of this Decree;

b) Drafting national standards and promulgating national technical regulations on security of information by classification;

c) Providing detailed guidelines on the classification of information systems as per Section 2, Article 6 of this Decree;

d) Promulgating regulations and guiding documents on the security of information systems by classification, on the evaluation and certification of compliance and conformity in relation to the security of information systems by classification;

dd) Guiding agencies and organizations providing short-term training and propagandas to propagate and heighten awareness and information security drills;

e) Regulating the inspection and assessment of information safety and information safety risk management within the operations of state agencies and governmental organizations, unless otherwise governed by Point d, Section 2 and Point d, Section 3 of this Article;

g) Deploying nation-wide centralized technical facilities to handle and reduce network attacks, support the supervision of the security of information systems providing online public services and to develop the electronic government.

2. Ministry of National Defense shall be responsible for:

a) Verifying information security schemes in the classification proposals intra vires as per Point b, Section 3, Article 12 of this Decree;

b) Drafting standards and promulgating technical regulations and guidelines for the security of information systems under its management;

c) Providing guidelines for criteria defined in Section 1 of Article 9, Section 1 of Article 10 and Section 1 of Article 11 in this Decree according to its functions and assignments;

d) Regulating the inspection and assessment of information safety and information safety risk management within the operations of the Ministry of National Defense.

3. Ministry of Public Security shall be responsible for:

a) Verifying information security schemes in the classification proposals intra vires as per Point c, Section 3, Article 12 of this Decree;

b) Drafting standards and promulgating technical regulations and guidelines for the security of information systems under its management;

c) Providing guidelines for criteria defined in Section 1 of Article 9, Section 1 of Article 10 and Section 1 of Article 11 in this Decree according to its functions and assignments;

d) Regulating the inspection and assessment of information safety and information safety risk management within the operations of the Ministry of Public Security.

Article 24. Expenditure for information security

1. State funds shall be allocated for the security of information by classification during activities of state agencies and government organizations.

2. Public fund(s) shall be invested in the security of information as per the Law on public investment. Public investment projects for construction or expansion and upgrade of information systems shall employ their investment capital to finance investments in the security of information by classification.

3. The annual budget estimate of state agencies and government organizations shall allot fund(s) for their supervision, assessment and management of information safety risks; provision of short-term training, propagandas, information safety drills and emergency response as per the Law on state budget.

4. Ministry of Finance shall provide guidelines for spending on the security of information from the budget estimate, for management and use of administrative expenditure for the security of information during the operations of state agencies and government organizations.

5. State agencies and government organizations shall base on their assignments to estimate the budget, manage, use and finalize the expenditure for the security of information as per the law on state budget.