What are bases for establishment of major national security information systems in Vietnam?

What are bases for establishment of major national security information systems in Vietnam?

Pursuant to Article 3 of the Decree 53/2022/NĐ-CP stipulating bases for establishment of major national security information systems in Vietnam as follows:

Major national security information systems are information systems of state agencies and political organizations of the Socialist Republic of Vietnam, including:

1. Major national information systems according to regulations of the Law on Cybersecurity of Vietnam.

2. Information systems that serve the direction and operation of major works related to national security according to the law.

3. Information systems that serve the direction, operation, and control of activities of major telecommunications works related to national security according to the law.

4. Information systems of fields prescribed in Clause 2 Article 10 of the Law on Cybersecurity of Vietnam, when there is a breakdown, intrusion, hijacking, falsification, interruption, disruption, paralysis, attack, or sabotage, will cause one of the following consequences:

a) Direct impacts on the independence, sovereignty, unity, territorial integrity of the Vietnam Fatherland, and the existence of the regime and the State of the Socialist Republic of Vietnam;

b) Severe consequences to the national defense, security, and foreign affairs, weakening the capacity to defend and protect the Vietnam Fatherland;

c) Severe consequences to the national economy;

d) Severe disasters to the human life and ecological environment;

dd) Severe consequences to activities of construction works at special levels according to the decentralization of laws on construction;

e) Severe consequences to activities of the planning of guidelines and policies within the scope of state confidentiality;

g) Serious influence on the directive and direct operation of CPV agencies and agencies of the State at central levels.

What are regulations on application for inclusion of information systems in the List of major national security information systems in Vietnam?

Pursuant to Article 4 of the Decree 53/2022/NĐ-CP stipulating application for inclusion of information systems in the List of major national security information systems in Vietnam as follows:

1. The governing body of an information system shall conduct the review and comparison with regulations prescribed in Clause 4 Article 3 of this Decree and apply for the inclusion of the information system under its management in the List of major national security information systems.

2. Regarding information systems included in the List of major national security information systems:

a) The Ministry of Information and Communications of Vietnam shall send the Ministry of Public Security of Vietnam documents on major national security information systems approved by the Prime Minister of Vietnam for the establishment of the List of major national security information systems;

b) In cases prescribed in Point a Clause 2 of this Article, the governing body of a major national security information system is not required to apply for the inclusion of such system in the List of major national security information systems;

c) The Ministry of Public Security of Vietnam shall include major national security information systems in the List of major national security information systems according to the prescribed order and procedures; notify governing bodies of such information systems of the information systems eligible for inclusion in the List of major national security information systems, and perform other equivalent responsibilities.

3. During the appraisal of information systems on their level of information safety, if such information systems are eligible for inclusion in the List of major national security information systems, the Ministry of Information and Communications of Vietnam shall transfer applications of such information systems for inclusion in the List of major national security information systems to the Ministry of Public Security for appraisal.

4. Cybersecurity protection forces shall, based on their functions and assigned tasks, review information systems with qualifications in accordance with regulations prescribed in Article 3 of this Decree and request governing bodies of such information systems to apply for inclusion of their information systems in the List of major national security information systems.

5. An application for inclusion of an information system in the List of major national security information systems includes:

a) A written request for inclusion of the information system in the List of major national security information systems (Form No. 1 of the Appendix);

b) A document on the provision of the list of the whole information system of the agency or organization (Form No. 2 of the Appendix);

c) Enclosed proving documents, including: documents describing and explaining the overview of the information system; construction design documents approved by competent authorities or equivalences; documents proving the suitability with the criteria for inclusion in the List of major national security information systems; documents explaining solutions to protect information systems (plans for assurance of network infrastructure safety; server security; application security; database security; management policies; organization, personnel; management of design, construction; management of operation; inspection, assessment, and management of risks).

6. The application for inclusion of the information system in the List of major national security information systems shall be made into 1 original copy and sent to:

a) The Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam, excluding cases prescribed in Point b and Point c of this Clause;

b) The Cyber Command of the Ministry of National Defense of Vietnam regarding military information systems.

c) The Cipher Department of the Government of Vietnam regarding cipher information systems of the Cipher Department of the Government of Vietnam.

7. Agencies that receive applications prescribed in Clause 6 of this Article shall respond to suggestions on the received applications in writing (Form No. 3 of the Appendix).

What are regulations on appraisal of applications for inclusion of information systems in the List of major national security information systems in Vietnam?

Pursuant to Article 5 of the Decree 53/2022/NĐ-CP stipulating appraisal of applications for inclusion of information systems in the List of major national security information systems in Vietnam as follows:

1. The Department of Cyber ​​Security and Hi-tech Crime Prevention of the Ministry of Public Security of Vietnam shall appraise applications for inclusion of information systems in the List of major national security information systems as prescribed by regulations, excluding cases prescribed in Clause 2 and Clause 3 of this Article.

2. The Cyber Command of the Ministry of National Defense of Vietnam shall provide guidelines on the making, receipt, and appraisal of applications for inclusion of military information systems in the List of major national security information systems.

3. The Cipher Department of the Government of Vietnam shall appraise applications for inclusion of information systems of the Cipher Department of the Government of Vietnam in the List of major national security information systems.

4. An Appraisal Council of applications for inclusion of information systems in the List of major national security information systems:

a) The Appraisal Council is required for major national security information systems related to many fields or when the appraisal process needs suggestions from many Ministries and relevant authorities;

b) Members of an Appraisal Council shall work on a part-time basis and self-dissolve upon completion of tasks. According to the nature and role of the information system, members of the Appraisal Council may include the Ministry of Public Security of Vietnam, the Ministry of National Defense of Vietnam, the Ministry of Information and Communications of Vietnam, the Cipher Department of the Government of Vietnam, and relevant agencies and units. Depending on each specific case, the Appraisal Council shall invite the governing body of the corresponding information system to participate in the appraisal meeting;

c) The Appraisal Council shall appraise the safety level of an information system and the application for inclusion of such information system in the List of major national security information systems.

5. Meeting results of the Appraisal Council shall be generally used for work of cybersecurity and cyber information security.

6. In case of requirement for verification of information in applications and the actual state of the information systems mentioned in such applications, appraisal agencies prescribed in Clauses 1, 2, and 3 of this Article shall organize actual surveys and testing to appraise applications for inclusion of information systems in the List of major national security information systems. The actual survey and testing time shall not exceed 20 days.

Survey results shall be recorded in writing and certified by appraisal agencies and governing bodies of such information systems.

7. Governing bodies shall cooperate and facilitate the appraisal, survey, testing, and supplement of applications at the request of appraisal agencies.

8. Time and procedures for appraisal of applications:

a) The appraisal time of applications is 30 days from the receipt date of valid applications for inclusion of information systems in the List of major national security information systems or from the end date of the survey process prescribed in Clause 6 of this Article;

b) The time for confirmation of valid applications is 3 working days after receiving the adequate applications for inclusion of information system in the List of major national security information systems;

c) At the end of the appraisal time, appraisal agencies shall finalize documents and send them to the Minister of Public Security of Vietnam, Minister of National Defense of Vietnam for suggestions for presentation of such documents to the Prime Minister of Vietnam to request the promulgation and update of decisions according to their functions and assigned tasks. At the same time, notify the governing bodies of information systems of the appraisal results in writing (Form No. 4 of the Appendix);

d) The Minister of the Ministry of Public Security of Vietnam and the Minister of National Defense of Vietnam shall decide on the extension of appraisal time. The extended time shall not exceed 20 days.

9. The Ministry of Public Security of Vietnam shall take charge and cooperate with the Ministry of National Defense of Vietnam and the Cipher Department of the Government of Vietnam in agreeing on the mechanism for requesting the Prime Minister of Vietnam to promulgate Decisions on the establishment and update of the List of major national security information systems.

Best regards!