Duty LXD-7515
Is a bank, in Vietnam
Circular on Information System Security in Banking Operations, Incident Reporting to the State Banksince 3 lines
Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), art. 54(1) · Read the law's page
- This binds a credit institution, a branch of a foreign bank, an intermediary payment service provider, a credit information company, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam that has established and uses an information system (reached by declaring that you provide financial services) (article 1(2)).
- Send the State Bank (Information Technology Authority) a report on each cyber security incident, on the form in Appendix 01 to the Circular, within 24 hours starting from the detection of the incident (article 54(1)).
- Send the State Bank a further report within 5 working days after the incident has been handled, following the instructions in the Appendix (article 54(1)).
Circular on Information System Security in Banking Operations, Classification and Security Assessmentsince 5 lines
Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), arts. 3 and 42 · Read the law's page
- This binds a credit institution, a branch of a foreign bank, an intermediary payment service provider, a credit information company, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam that has established and uses an information system (reached by declaring that you provide financial services) (article 1(2)).
- Classify each information system by level under article 5 and apply the information security policy suited to that level (article 3(2)).
- Assess the security of each Level 3 and above information system, and of any other system holding client personal information, before it is used (article 42(2)).
- During operation, assess the security of a Level 5 system every six months, and of a Level 4 or Level 3 system and any device directly interacting with the Internet, clients or third parties every year, and evaluate information security and its risk management across the institution's whole activities every two years (article 42(3)).
- Report the assessment results in writing to the institution's legal representative and the competent authority (article 42(4)).
Cybersecurity Law, Incident Response and Reporting Dutiessince 4 lines
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page
- As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
- As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
- When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
- Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
- This duty binds now: Law No. 116/2025/QH15 took effect .