Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Following Data Classification Levels, Vietnam has released draft circular for comments, proposing security requirements for different levels of data, per their data classification framework. These security requirements exclude data from the Ministry of Defence and the Ministry of Public Security.

This regulation proposes baseline (a) technical requirements, including network infrastructure safety; server security; application security and data security, as well as (b) management requirements such as general policy; organization and personnel; design and construction management; operational management; testing, assessment and risk management.

The Circular proposes the following requirements:

1. Information Security Assurance Plans

  • For information Levels 1, 2, 3, information security levels must be sufficient but should also consider the possibility of sharing between information systems for solutions to protect and share resources, so as to optimize performance and avoid system redundancies and duplicate investments.
  • For Levels 4 and 5, the information security assurance plans need to be designed to ensure availability, segregation and limit the impact on the entire system when one component in the system is affected.

2. Information Security Audits and Compliance

  • These will be required for information Levels 3, 4, and 5, with compliance and reporting requirements detailed in Articles 8 and 9 of the Circular. This include any newly-built and expanded/upgraded systems.

3. Cloud Computing

  • If Cloud Computing is deployed, specific requirements for logical and physical separation are detailed in the Circular, with stricter separation for network and storage requirements for Level 4 and 5 (see Article 8, Clause 6).

4. Information Security Risk Management Plan required

  • An Information Security Risk Management plan is now required for all information Levels, with higher requirements for Level 3 and above.

5. System termination/ exit strategy required

  • System termination/exit plans are now required for all information Levels, with higher requirements for Level 3 and above.

The MIC Public Consultation closes on 11 May 2022, and submissions can be put through via their website.

Data Classification Framework for Vietnam

The data classification framework for Vietnam has been established in Decree 85/2016/ND-CP on the security of information systems by classification, involving five Levels.

Related Articles

Access Alert: UK Prime Minister Sunak announces snap election on 4 July 2024

Access Alert: UK Prime Minister Sunak announces snap election on 4 July 2024

The UK general election campaign is officially in full swing, with election day set for 4 July 2024. Polling suggests...

23 May 2024 Opinion
Key Takeaways from the AI Seoul Summit 2024

Key Takeaways from the AI Seoul Summit 2024

The second AI Safety Summit in Seoul, South Korea, concluded with advancements in AI governance and international cooperation. Over two...

22 May 2024 AI Policy Lab
Key Takeaways from the APEC Ministers Responsible for Trade and Second Senior Officials Meeting

Key Takeaways from the APEC Ministers Responsible for Trade and Second Senior Officials Meeting

Member economies from the 21 Asia-Pacific Economic Cooperation (APEC) countries convened in Arequipa, Peru, from May 4-18. Several working groups...

20 May 2024 Opinion
Catalysing Change in Latin America’s Tech and Eco Spheres

Catalysing Change in Latin America’s Tech and Eco Spheres

In this episode of LATAM Digital from Access Partnership, join host Geusseppe and special guest Juan David Aristizabal for a...

17 May 2024 Opinion