Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Access Alert | Vietnam’s Ministry of Information and Communication Releases Draft Circular proposing Security Requirements for their Information System

Following Data Classification Levels, Vietnam has released draft circular for comments, proposing security requirements for different levels of data, per their data classification framework. These security requirements exclude data from the Ministry of Defence and the Ministry of Public Security.

This regulation proposes baseline (a) technical requirements, including network infrastructure safety; server security; application security and data security, as well as (b) management requirements such as general policy; organization and personnel; design and construction management; operational management; testing, assessment and risk management.

The Circular proposes the following requirements:

1. Information Security Assurance Plans

  • For information Levels 1, 2, 3, information security levels must be sufficient but should also consider the possibility of sharing between information systems for solutions to protect and share resources, so as to optimize performance and avoid system redundancies and duplicate investments.
  • For Levels 4 and 5, the information security assurance plans need to be designed to ensure availability, segregation and limit the impact on the entire system when one component in the system is affected.

2. Information Security Audits and Compliance

  • These will be required for information Levels 3, 4, and 5, with compliance and reporting requirements detailed in Articles 8 and 9 of the Circular. This include any newly-built and expanded/upgraded systems.

3. Cloud Computing

  • If Cloud Computing is deployed, specific requirements for logical and physical separation are detailed in the Circular, with stricter separation for network and storage requirements for Level 4 and 5 (see Article 8, Clause 6).

4. Information Security Risk Management Plan required

  • An Information Security Risk Management plan is now required for all information Levels, with higher requirements for Level 3 and above.

5. System termination/ exit strategy required

  • System termination/exit plans are now required for all information Levels, with higher requirements for Level 3 and above.

The MIC Public Consultation closes on 11 May 2022, and submissions can be put through via their website.

Data Classification Framework for Vietnam

The data classification framework for Vietnam has been established in Decree 85/2016/ND-CP on the security of information systems by classification, involving five Levels.

Related Articles

Propelling Indonesia’s digital economy: How Google Play helped Indonesian app developers generate over Rp 1.5 trillion in 2022

Propelling Indonesia’s digital economy: How Google Play helped Indonesian app developers generate over Rp 1.5 trillion in 2022

With over 212 million internet users,[1] Indonesia’s digital economy has seen vigorous growth in the past decade. The country’s digital...

29 May 2023 Opinion
Access Alert | South African communications regulator frees up lower 6GHz band for Wi-Fi services

Access Alert | South African communications regulator frees up lower 6GHz band for Wi-Fi services

On 23 May, the Independent Communications Authority of South Africa (ICASA) published an amendment to Annexure B of the 2015...

26 May 2023 Opinion
Building secure online environments for young users

Building secure online environments for young users

On 24 May, Access Partnership hosted a webinar on how to design immersive online platforms that balance the freedom to...

25 May 2023 Metaverse Policy Lab
Shaping the regulatory environment for AI-generated content 

Shaping the regulatory environment for AI-generated content 

On 23 May, Access Partnership hosted a webinar on the far-reaching implications of AI-generated content and the platforms that facilitate...

24 May 2023 AI Policy Lab