Chương II Thông tư 20/2017/TT-BTTTT: Mạng lưới ứng cứu sự cố

Chapter II

INCIDENT RESPONSE NETWORK

Article 5. Incident response network

1. Incident response network operates on a nation-wide scale and consists of members that are incident response specialists, relevant agencies, organizations, and enterprises specified under Article 7 of Decision No. 05/2017/QD-TTg.

2. Incident response network operates in accordance with Network Operating Regulations and relevant guidelines of National coordinating authority (Vietnam Cybersecurity Emergency Response Center). Network Operating Committee shall be established by the Ministry of Information and Communications under Article 7 of Decision No. 05/2017/QD-TTg

3. Network members shall declare using Form No. 1 attached hereto, update on a periodic basis, and submit to National coordinating authority. Organizations, enterprises, and individuals voluntarily apply for participation in the network shall submit applications using Form No. 2 to the National coordinating authority.

Article 6. Responsibilities and powers of network members

1. Network members have the responsibility and power to:

a) exercise responsibilities and powers under Decision No. 05/2017/QD-TTg;

b) assign competent, qualified liaisons with appropriate certifications and professional skills to implement cooperation in incident response; maintain throughout and around-the-clock communication; publicize incident report address on website/web portal; provide and update information on incident response liaisons, technicians for information security, incident response under their management to National coordinating authority; update information on incident response liaison within 24 hours from the time in which changes occur;

c) consolidate, develop, and submit 6-monthly report (before June 20), annual report (before December 15) using Form No. 5 to National coordinating authority; provide irregular report at request of National coordinating authority;

d) report to National coordinating authority upon receiving information or discovering incidents of information systems under their management;

dd) develop and implement incident response plans, guidelines on incident response operations; organize and coordinate operation of incident response teams under their management;

e) request network members to guide, assist in dealing with and responding to incidents when necessary; participate in seminars, conferences, meetings, trainings, advanced trainings, drills, and other activities in the network;

g) share information, experience, and warnings regarding incidents and cyber information security in Vietnam and in other countries;

h) network members that are agencies, authorities affiliated with the Ministry of Public Security, Ministry of National Defense shall not be required to implement Point c and Point d of this Clause.

2. National coordinating authority has the responsibility and power to:

a) exercise responsibilities and powers under Decision No. 05/2017/QD-TTg;

b) publicize their phone number, fax, email address, hotline on their website, ensure resources to maintain round-the-clock hotline, promptly receive and deal with incidents; consolidate contact information (address, phone number, fax, email address) and information on incident response liaisons, technicians for information security, incident response of network members and incident response teams of network members;

c) develop, implement, and operate network website, technical system assisting communication and information exchange within the network and other technical systems serving incident coordination, response, rectification;

d) provide guidelines on notifying and inquiring nation-wide cyber information safety incidents; coordinate network; study and propose solutions for improving resources to ensure effective implementation of the network;

dd) consolidate, receive, process, prepare, and send information and warnings to competent individuals and agencies, organizations, relevant entities regarding cyber information security incidents and prevention, deterrence, handling solutions;

e) organize seminars and meetings, publicize and exchange information, provide trainings, advanced trainings, drills regarding response to cyber information security incidents; organize general operations of the network.

Article 7. Primary operations of incident response network

Network Operating Committee shall organize and implement tasks of incident response network, including primary operations below:

1. Studying, collecting, receiving, analyzing, verifying, assessing, issuing warnings regarding cyber information security incidents, risks and malware.

2. Cooperating in responding to, dealing with, preventing, and rectifying incidents; inspecting and promoting development, implementation of plans for cyber information security incidents and implementation of responsibilities, obligations of network members;

3. Developing and improving capacity of network members and incident response teams, including:

a) providing training, advanced trainings to improve qualifications, skills, professional operations; organizing domestic and foreign business trips for the purpose of survey, experience learning, exchange, and cooperation;

b) organizing periodic meetings, conferences, seminars, and conversations to exchange information, experience regarding incident coordination and rescue, cyber information security assurance;

c) providing support in developing and adopting information system management, operation procedures in accordance with national standards, national technical regulations, and international standards regarding information security and incident response.

d) organizing specialized studies, developing reports, instruction manuals, statistical reports on information security and issues relating to sharing and communication in the network.

4. Participating in communication and popularization to raise awareness regarding incident prevention, response, and cyber information security assurance.

5. Organizing and maintaining operation of Network Operating Committee; implementing other operations related to incident coordination and response and cyber information security assurance.