VietnamCircular on Information System Security in Banking Operations, Incident Reporting to the State Bank
Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), art. 54(1)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a credit institution, a branch of a foreign bank, an intermediary payment service provider, a credit information company, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam that has established and uses an information system (reached by declaring that you provide financial services) (article 1(2)).
- Send the State Bank (Information Technology Authority) a report on each cyber security incident, on the form in Appendix 01 to the Circular, within 24 hours starting from the detection of the incident (article 54(1)).
- Send the State Bank a further report within 5 working days after the incident has been handled, following the instructions in the Appendix (article 54(1)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The banking investigation and supervision agencies of the State Bank of Vietnam, which handle administrative violations of the Circular under article 55(3).
Settledness
- As of
- Open questions
- Has a State Bank issuance after Circular No. 09/2020/TT-NHNN changed the 24-hour clock in article 54(1), given that Circular No. 50/2024/TT-NHNN repealed article 25 of the Circular with effect from ?
What this law does
Article 54(1) requires an institution to report a cyber security incident to the State Bank (Information Technology Authority) within 24 hours starting from the detection of the incident and within 5 working days after incident handling. Article 2(2) defines an information security incident as an incident in which digital information and an information system are attacked or harmed, resulting in negative effects on their confidentiality, integrity and availability.
Article 1(2) applies the Circular to credit institutions, branches of foreign banks, intermediary payment service providers, credit information companies, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam. Article 55(3) makes the banking investigation and supervision agencies responsible for handling administrative violations of the Circular as per legal regulations. The Circular takes effect on .
When LexLint raises it
When your app profile says your app provides financial services.