Chapter IV
INSPECTION AND ASSESSMENT OF INFORMATION SECURITY
Article 10. Contents and forms of inspection and assessment
1. Contents of inspection and assessment:
a) Inspect the compliance with the laws on security of information systems by classification;
b) Assess the efficiency of information system security measures;
c) Assess the detection of malicious code, security holes and vulnerabilities, test the intrusion detection system;
d) Other inspection and assessment as regulated by the information system administrator.
2. Forms of inspection and assessment:
a) Inspect and assess periodically according to the plan of the information system administrator;
b) Inspect and assess irregularly at the request of competent authorities.
3. Competent authorities requesting the assessment and inspection:
a) Minister of Information and Communications;
b) Administrator of information system under the management;
c) Specialized information security units under administrators of information systems which classification proposals approved by such units.
4. Units in charge of inspection and assessment shall be assigned or selected by competent authorities.
5. The subject of inspection and assessment is the administrator of the information system or the operators of the information system and related information systems.
Article 11. Inspection of the compliance with the laws on security of information systems by classification
1. Inspection of the compliance with the laws on security of information systems by classification shall include:
a) Inspect the compliance with the laws on classification of security of information systems;
b) Inspect the compliance with the laws on the implementation of the proposal on security of information systems by classification;
2. The unit in charge of inspection is one of the following units:
a) The Authority of Information Security;
b) Specialized information security units.
3. Periodic inspection plans include the following contents:
a) A list of units, information systems (if any) being inspected;
b) Scope and contents of inspection;
c) Inspection duration;
d) Cooperating units (if any).
4. Decision on inspection shall be made after the plan on periodic inspection is approved by the competent authority or upon irregular inspection of the competent authority.
5. Regarding periodic inspection:
a) The unit in charge of inspection shall prepare the periodical inspection plan for the subsequent year and submit it to the competent authority for approval to serve as a basis for implementation;
b) In case of change compared to the approved periodic inspection plan, the unit in charge of inspection shall prepare the periodical inspection plan amendments and submit it to the competent authority for approval;
c) The periodic inspection plan shall be sent to the inspected subjects and superior agencies of the inspected subjects within 10 days from the approved date but at least 10 days before the inspection day.
6. Regarding irregular inspection:
Depend on the request for irregular inspection and decision on inspection, the head of the inspection unit shall prescribe the contents of the inspection where appropriate.
7. After the direct inspection at the establishment, the inspection unit shall notify the inspected subjects and hand over documents and equipment (if any) used in the inspection process.
The inspection team shall draft an inspection report and send it to the inspected subjects for comments. Within 5 working days after receiving the draft inspection report, the inspected subjects shall comment on the draft contents.
8. Based on the draft inspection report, opinions and explanations of inspected subjects, within 30 days from the inspection date at the establishment, the inspection unit shall complete the inspection report, draft inspection conclusion and send them to the competent authority for considering approval.
Inspection conclusion must be sent to the inspected subjects and superior agencies of such subjects (if any) and relevant units (if necessary).
Article 12. Assessment of the efficiency of information security measures
1. The assessment of the efficiency of information security measures refers to the overall review and verification of the efficiency of information security measures in accordance with each criterion and basic requirement.
The assessment of the efficiency of applied information security measures is the basis for adjusting the plan to ensure information security in accordance with practical requirements.
2. The unit in charge of assessment is one of the following units:
a) The Authority of Information Security;
b) Specialized information security units;
c) Government agencies given suitable functions and assignments;
d) Enterprises possessing licenses for provision of inspection and assessment of network information security;
3. The operators of the information system shall prepare the periodical assessment plan for the subsequent year and submit it to the competent authority for approval to serve as a basis for implementation. The assessment plan includes:
a) A list of units, information systems (if any) being assessed;
b) Assessment duration;
c) Operating unit: Self-operate or operated by a specialized information security unit or outsourced in accordance with the law.
4. b) In case of change compared to the approved assessment plan, the operators of the information system shall prepare the amendment of the assessment plan and submit it to the competent authority for approval;
5. After the direct inspection at the establishment, the assessment unit shall notify the operators of the information system and hand over documents and equipment (if any) used in the inspection process.
The assessment team shall draft an assessment report and send it to the operators of the information system for comments. Within 5 working days after receiving the draft assessment report, the operators of the information system shall comment on the draft contents.
6. Based on the draft assessment report, opinions and explanations of operators of the information system, the assessment unit shall complete the assessment report and send it to the operators and administrator of the information system.
Article 13. Assessment of the detection of malicious code, security holes and vulnerabilities, testing of the intrusion detection system
1. Assessment of the detection of malicious code, security holes and vulnerabilities, testing of the intrusion detection system refers to the detection of vulnerabilities and holes in the system and testing of intrusion detection systems, and assessment of risks and damages of information systems which may exists when the system is attacked by intruders.
2. The unit in charge of assessment is one of the following units:
a) The Authority of Information Security;
b) Specialized information security units;
c) Government agencies given suitable functions and assignments;
d) Enterprises possessing licenses for provision of inspection and assessment of network information security or other organizations allowed by the information system administrator to assess the detection of malicious code, security holes and vulnerabilities, testing of the intrusion detection system .
3. The unit in charge of assessing the detection of malicious code, security holes and vulnerabilities, test the intrusion detection system shall:
a) Inform the system administrator of discovered information security vulnerabilities to overcome and prevent information security incidents.
b) Ensure the data security related to the assessed system, do not release relevant data without the consent of the information system administrator;
c) Ensure that the assessment of the detection of malicious code, security holes and vulnerabilities, testing of the intrusion detection system do not affect normal operation of the system.
Tìm kiếm
Thông tư số 03/2017/TT-BTTTT (Bản Word)
Thông tư số 03/2017/TT-BTTTT (Bản Pdf)