Chương III Thông tư số 03/2017/TT-BTTTT: Yêu cầu bảo đảm an toàn hệ thống thông tin theo cấp độ

Chapter III

REQUIREMENTS FOR SECURITY OF INFORMATION SYSTEMS BY CLASSIFICATION

Article 8. General requirements

1. The security of information system by classification must comply with basic requirements as specified hereof; technical regulations and standards on information security and other related professional technical regulations and standards.

2. Basic requirements by classification as specified hereof are minimum requirements for information security excluding physical security requirements.

3. Basic requirements shall consist of:

a) Technical requirements: network infrastructure security; server security; application security and data security;

b) Management requirements: General Policy; organization, personnel; design and construction management; operational management; inspection, assessment and risk management.

4. The preparation of information security proposal according to basic requirements for each class shall comply with Clause 2 Article 4 of Decree No. 85/2016/ND-CP, specifically as follows:

a) For information system class 1, 2, 3: The information security proposal shall consider the ability to share resources and secure information between information systems to optimize performance and preclude redundant and overlapping investments. In cases of newly invested system, there must be an explanation that the existing solution does not meet the basic requirements;

b) For information system class 4, 5: Information security proposal shall be designed to ensure availability, segregation, and impact mitigation of the entire system when a component of the system or system-related information is insecure.

Article 9. Basic requirements for each class

1. Information system class 1 security proposal shall comply with the specific requirements specified in Annex 1 enclosed herewith.

2. Information system class 2 security proposals shall comply with the specific requirements for class 1 and supplemented requirements specified in Annex 2 enclosed herewith.

3. Information system class 3 security proposals shall comply with the specific requirements for class 2 and supplemented requirements specified in Annex 3 enclosed herewith.

4. Information system class 4 security proposals shall comply with the specific requirements for class 3 and supplemented requirements specified in Annex 4 enclosed herewith.

5. Information system class 5 security proposals shall comply with the specific requirements for class 4 and supplemented requirements specified in Annex 5 enclosed herewith.