Conditions for granting a license for trading in civil cryptographic products and services in Vietnam

Conditions for granting a license for trading in civil cryptographic products and services in Vietnam (Internet image)

Regarding this issue, LawNet would like to answer as follows:

1. What are civil cryptographic products and services?

According to Article 30 of the Law on Cyberinformation Security 2015, civil cryptographic products and services are as follows:

- Civil cryptographic products include cryptographic documents and technical and professional equipment used to protect information not classified as state secret.

- Civil cryptographic services include services of protection of information using civil cryptographic products; inspection and assessment of civil cryptographic products; and counseling on cyberinformation confidentiality and security using civil cryptographic products.

2. Conditions for granting a license for trading in civil cryptographic products and services in Vietnam

Specifically, in Clause 2, Article 31 of the Law on Cyberinformation Security 2015, an enterprise shall be granted a license for trading in civil cryptographic products and services when fully meeting the following conditions:

- Having managerial, administration and technical staff members who meet professional requirements on information confidentiality and security;

The enterprise has to employ at least 02 technicians who possess university-level or higher qualifications in electronics - telecommunications, information technology, mathematics or information security. Moreover, the managerial personnel of the enterprise have graduated in electronics - telecommunications, information technology, mathematics, information security or other discipline with a training certificate in information security.

(Clause 2, Article 4 of Decree 58/2016/ND-CP)

- Having equipment and physical foundations suitable to the scale of provision of civil cryptographic products and services;

- Having a technical plan conformable with standards and technical regulations;

- Having a cyberinformation confidentiality and security plan in the course of management and provision of civil cryptographic products and services;

- Having an appropriate business plan.

3. Dossier of application for a license for trading in civil cryptographic products and services in Vietnam

A dossier of application for a license for trading in civil cryptographic products and services shall be made in two sets, each comprising:

- An application for a license for trading in civil cryptographic products and services;

- A copy of the enterprise registration certificate, investment registration certificate or another paper of equivalent validity;

- Copies of information confidentiality and security diplomas or certificates of managerial, administration and technical staff members;

- A technical plan, consisting of papers on technical characteristics and specifications of products; standards or technical regulations of products; standards and quality of services; technical measures and solutions; and product waưanty and maintenance plan;

- A cyberinformation confidentiality and security plan in the course of management and provision of civil cryptographic products and services;

- A business plan, indicating the scope of provision and recipients of products and services, scale and quantity of products and services, customer service networks, and technical assurance.

(Clause 2, Article 32 of the Law on Cyberinformation Security 2015)

4. Responsibilities of enterprises trading in civil cryptographic products and services in Vietnam

According to Article 35 of the Law on Cyberinformation Security, responsibilities of enterprises trading in civil cryptographic products and services include:

- To manage dossiers and documents on technical solutions and technologies of the products.

- To establish, store and secure customer information, and names, types, quantities and use purposes of civil cryptographic products and services.

- To report to the Government Cipher Committee on the trading in and export and import of civil cryptographic products and services and summarize customer information before December 31 every year.

- To take measures to ensure secure and safe transportation and preservation of civil cryptographic products.

- To refuse to provide civil cryptographic products and services when detecting their users’ violations of the law on use of civil cryptographic products and services or violations of agreed commitments on use of the products and services provided by the enterprises.

- To suspend or stop providing civil cryptographic products and services in order to ensure national defense and security and social order and safety at the request of competent state agencies.

- To coordinate with and create conditions for competent state agencies to take professional measures upon request.

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE