Duty LXD-7193
Runs an essential service, in Vietnam
Cybersecurity Law, Incident Response and Reporting Dutiessince 4 lines
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page
- As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
- As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
- When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
- Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
- This duty binds now: Law No. 116/2025/QH15 took effect .
Cybersecurity Law, Information Systems Critical to National Security, Appraisal, Inspection and Incident Dutiessince 4 lines
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 9 and 11 · Read the law's page
- This binds the manager of an information system that the Prime Minister has placed on the list of information systems critical to national security (reached by declaring that you operate an essential service); the sectors named include energy, finance, banking, telecommunications, transport and healthcare (article 9).
- Have the system appraised for cybersecurity and certified as meeting cybersecurity conditions before it is put into operation, and keep it regularly inspected and monitored during operation (article 9(3)).
- When you establish, expand or upgrade the system, conduct a cybersecurity inspection before putting it into operation, and each year carry out cybersecurity self-inspections, assess cybersecurity conditions and notify the results in writing to the competent specialised cybersecurity protection forces before October (article 11(1)(b)).
- Develop plans for responding to and remedying cybersecurity incidents, implement them when incidents occur, and promptly report the incident to the competent specialised cybersecurity protection forces; the Law states no fixed number of hours (article 11(1)(d)).