Chapter II
GUIDELINE FOR THE DETERMINATION AND CLASSIFICATION OF INFORMATION SYSTEM
Article 4. Determination of specific information system
1. The determination of information system for classification is subject to the principles specified in Clause 1 Article 5 of Decree No. 85/2016/ND-CP.
2. The information system is established through one or several of the following forms: New construction investment; upgrading, expansion and integration with existing systems; rental or transfer of systems.
3. An information system that services internal activities solely contributes to the internal management and operation of an agency or organization, including:
a) Email system;
b) Document management and administration system;
c) Live conference and meeting system;
d) Specific information management system (personnel, finance, asset or other specific professional areas) or general information management system (integrated management of many different functions and operations);
dd) Internal information processing system.
4. An information system that is of use to the people and enterprises provide directly or support the provision of online services, e.g. online public services and other online services regarding telecommunications, information technology, commerce, finance, banking, health, education and other specialties, including:
a) Email system;
b) Document management and administration system;
c) Electronic single window system;
d) Website system;
dd) Directly or indirectly providing online service system;
e) Customer service system.
5. A system of information infrastructure is comprised of equipment and transmission lines that serve the operations of organizations and agencies, including:
a) Intranet, Wide area network, special data transmission network;
b) Database, data center and cloud computing network;
c) Electronic verification, electronic authentication and digital signature system;
c) Interconnection system, enterprise service bus.
6. An industrial maneuver information system has the functional role in supervising and collecting data, managing and controlling vital sections for maneuvering and operating ordinary activities of buildings, including:
a) Programmable logic controller (PLCs);
b) Distributed control system (DCS);
c) Supervisory control and data acquisition (SCADA).
7. Other information systems that do not belong to the abovementioned forms are used to directly serve or support professional operations, production and business of specific agencies or organizations in specialized operations.
Article 5. Administrators of information systems
1. Regarding state authorities and organizations, the administrator of the information system is one of the following cases:
a) Ministries, ministerial agencies, Governmental agencies;
b) Provincial People’s Committees;
c) Competent authorities given discretion in investment projects for the construction, configuration, upgrade and expansion of information systems
2. Regarding other businesses and organizations, administrators of information systems are competent authorities given discretion in investment projects for the construction, configuration, upgrade and expansion of information systems.
3. The information system administrator may authorize an organization to exercise direct management over the information system and be responsible for ensuring the security of the information system on its behalf as specified in Clause 2 Article 20 of Decree No. 85/2016/ND-CP.
The authorization must be made in writing, clearly identifying the authorization scope and time limit. The authorized organization must directly exercise the rights and obligations of the information system administrator without re-authorizing a third party.
Article 6. Operators of information systems
1. Operators of an information system refer to agencies and organizations that the administrators of the information system designate to operate such system.
2. If the information system consists of multiple components or distributed systems, or there is more than one operator, the information system administrator shall assign a unit to be the focal point in order to exercise the rights and obligations of operators of the information system in accordance with the provisions of law.
3. If the administrators of an information system outsource information technology services, the operators of the information system shall be providers of such services.
Article 7. Guideline for the determination and explanation of information system
The determination and explanation of information system consist of:
1. Determine and classify the information system; determine the information system administrator and operators in accordance with Article 5, 6 of Decree No. 85/2016/ND-CP and Article 4, 5 and 6 hereof.
2. Determine the information processed by an information system in accordance with Clause 1 Article 6 of Decree No. 85/2016/ND-CP.
3. The classification of information system level is subject to the principles specified in Article 7 to 11 of Decree No. 85/2016/ND-CP. If the information system is given class 4 or 5, the explanation of classification proposal shall specify the following contents:
a) The classification of other information systems that are related or have a connection to or have significant impact on the normal operation of the proposed information system; clearly determine the extent to which the proposing information systems are affected when these systems lose information security.
d) The list of proposal of important network components, equipment and important information processed in the system (if any);
c) The explanation on the importance of network components, equipment and the information, data processed or saved in the system (if any);
d) Explanation on the risks of network attacks, the loss of information security in the system, system components and network devices; the impact of such risks of network attacks and loss of information security on the criteria of classification according to Article 10 and 11 of Decree No. 85/2016/ND-CP;
dd) The assessment of the scope and scale of influence to public interest, social order or national defense and security when a network attack causes loss of information security or interruption in the operation of each classified system.
For information systems to be given class 4, the explanation must require them to function on round-the-clock basis and does not halt without prior schedule;
e) Other explanations (if any) based on practical operation of the information system.
Tìm kiếm
Thông tư số 03/2017/TT-BTTTT (Bản Word)
Thông tư số 03/2017/TT-BTTTT (Bản Pdf)