VietnamCircular on Information System Security in Banking Operations, Classification and Security Assessment
Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), arts. 3 and 42
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a credit institution, a branch of a foreign bank, an intermediary payment service provider, a credit information company, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam that has established and uses an information system (reached by declaring that you provide financial services) (article 1(2)).
- Classify each information system by level under article 5 and apply the information security policy suited to that level (article 3(2)).
- Assess the security of each Level 3 and above information system, and of any other system holding client personal information, before it is used (article 42(2)).
- During operation, assess the security of a Level 5 system every six months, and of a Level 4 or Level 3 system and any device directly interacting with the Internet, clients or third parties every year, and evaluate information security and its risk management across the institution's whole activities every two years (article 42(3)).
- Report the assessment results in writing to the institution's legal representative and the competent authority (article 42(4)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The banking investigation and supervision agencies of the State Bank of Vietnam, which handle administrative violations of the Circular under article 55(3).
Settledness
- As of
- Open questions
- Do later State Bank issuances amend the assessment intervals in article 42(3) of Circular No. 09/2020/TT-NHNN?
What this law does
Article 3(2) requires an institution to categorize its information systems in the order prescribed at article 5 and to apply the suitable information security policy. Article 42(2) requires an institution to assess the security of Level 3 and above information systems and other information systems holding client personal information before use.
Article 42(3) sets the assessment interval at six months for Level 5 systems, one year for Level 4 and 3 systems and devices connecting to the Internet, clients or third parties, and two years for the whole institution. Article 42(4) requires assessment results to be reported in writing to the legal representative of the institution and the competent authority.
Article 1(2) applies the Circular to credit institutions, branches of foreign banks, intermediary payment service providers, credit information companies, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam. Article 55(3) makes the banking investigation and supervision agencies responsible for handling administrative violations of the Circular as per legal regulations. The Circular takes effect on .
When LexLint raises it
When your app profile says your app provides financial services.