Vietnam: What should credit institutions do to control and mitigate incidents?

According to the Circular No. 09/2020/TT-NHNN of the State Bank of Vietnam, each institution shall control and mitigate incidents as follows:

1. Make a list of information security incidents and incident handling plan in respect of information systems of level 3 or higher and information systems that process clients’ personal information; review and update such list and plan at least once every six months.

2. Promptly report information security incidents to the competent authority and other related persons to have them resolved as soon as possible.

3. Collect, record, protect and retain proofs and evidence at the institution during the process of inspection, handling and mitigation of such incidents.

4. Evaluate and determine reasons for such incidents and implement preventive measures to prevent it from recurring in the future.

5. In information security incidents relating to any breach of laws and regulations, the institution shall be responsible for collecting and providing proofs and evidence for competent regulatory authorities in accordance with prevailing laws.

6. Organize the annual drill for the plan for handling information security incidents for at least one of the information systems of level 3 or higher. If there are 02 or more information systems of level 3 or higher, such drills shall be organized for all systems in turns.

View more details at the Circular No. 09/2020/TT-NHNN of the State Bank of Vietnam, effective from January 01, 2021.

Thuy Tram

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE