Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Following Data Classification Levels, Vietnam has released draft circular for comments, proposing security requirements for different levels of data, per their data classification framework. These security requirements exclude data from the Ministry of Defence and the Ministry of Public Security.

This regulation proposes baseline (a) technical requirements, including network infrastructure safety; server security; application security and data security, as well as (b) management requirements such as general policy; organization and personnel; design and construction management; operational management; testing, assessment and risk management.

The Circular proposes the following requirements:

1. Information Security Assurance Plans

  • For information Levels 1, 2, 3, information security levels must be sufficient but should also consider the possibility of sharing between information systems for solutions to protect and share resources, so as to optimize performance and avoid system redundancies and duplicate investments.
  • For Levels 4 and 5, the information security assurance plans need to be designed to ensure availability, segregation and limit the impact on the entire system when one component in the system is affected.

2. Information Security Audits and Compliance

  • These will be required for information Levels 3, 4, and 5, with compliance and reporting requirements detailed in Articles 8 and 9 of the Circular. This include any newly-built and expanded/upgraded systems.

3. Cloud Computing

  • If Cloud Computing is deployed, specific requirements for logical and physical separation are detailed in the Circular, with stricter separation for network and storage requirements for Level 4 and 5 (see Article 8, Clause 6).

4. Information Security Risk Management Plan required

  • An Information Security Risk Management plan is now required for all information Levels, with higher requirements for Level 3 and above.

5. System termination/ exit strategy required

  • System termination/exit plans are now required for all information Levels, with higher requirements for Level 3 and above.

The MIC Public Consultation closes on 11 May 2022, and submissions can be put through via their website.

Data Classification Framework for Vietnam

The data classification framework for Vietnam has been established in Decree 85/2016/ND-CP on the security of information systems by classification, involving five Levels.

Related Articles

Brazil and the Future of Democracy in the Age of Disinformation

Brazil and the Future of Democracy in the Age of Disinformation

Fake news is far from new. That said, digital tools such as social media and online bots have changed the...

25 Jan 2023 Opinion
GDPR: Is it still fit for purpose? 

GDPR: Is it still fit for purpose? 

The EU’s landmark General Data Protection Regulation (GDPR) has fundamentally changed how personal privacy is respected and protected. However, cracks...

25 Jan 2023 Opinion
Access Alert | Environmental Footprint and Data Collection by ARCEP

Access Alert | Environmental Footprint and Data Collection by ARCEP

The impact of the deployment of electronic communications networks, mass production of terminals, operation of data centres, and ever-expanding data...

23 Jan 2023 Opinion
Access Alert | The International Telecommunication Union Focuses on Metaverse 

Access Alert | The International Telecommunication Union Focuses on Metaverse 

The International Telecommunication Union’s Standardization Sector (ITU-T) has established a new Focus Group that will take the first steps towards...

20 Jan 2023 Metaverse Policy Lab