VietnamCybersecurity Law, Incident Response and Reporting Duties
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security, Governance
What it requires
- This duty binds now: Law No. 116/2025/QH15 took effect .
- As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.NIST CSF 2.0DE.CM-09NIST CSF 2.0RS.CO-02
- As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.NIST CSF 2.0RS.CO-02NIST CSF 2.0ID.IM-04
- When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.NIST CSF 2.0RS.MA-01NIST CSF 2.0RS.CO-02
- Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.NIST CSF 2.0PR.DS-01
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- RS.MA-01The incident response plan is executed in coordination with relevant third parties once an incident is declared
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Private right of actionNo
Penalty structure
Decree No. 330/2026/ND-CP, art. 21 sets four individual fine tiers, doubled for an organisation under art. 7(1): VND 10,000,000 to 20,000,000 for a contact-point or dossier failure (art. 21(1)); VND 20,000,000 to 30,000,000 for failing to report a detected incident or failing to deploy and report incident response (art. 21(2)); VND 30,000,000 to 50,000,000 for failing to consolidate and report incident developments, failing to designate an incident-response unit or team, failing to develop an incident-response plan, or incompletely implementing an Article 41 coordination request (art. 21(3)); and VND 50,000,000 to 70,000,000 for a further set of coordination, staffing and log-preservation failures (art. 21(4)), the highest of the four tiers.
- Rule
- Fixed only
- As of
- Currency
- VND
- Fixed cap
- 140,000,000
Who enforces it
Enforcement body
The specialised cybersecurity protection force of the Ministry of Public Security, or of the Ministry of National Defence for a military information system.
Settledness
- As of
- Open questions
- Does Article 41(3)'s undated, "immediately" reporting clock acquire a fixed number of hours once a further implementing decree or circular addresses it, the way Decree No. 331/2026/ND-CP fixed the classification criteria Article 8(2) left to the Government?
What this law does
Article 40(1)(c) requires any information system manager, at any level, to report a cybersecurity incident to the specialised cybersecurity protection force.
Article 41 layers a parallel duty on any domestic or foreign enterprise providing a telecommunications, Internet, or other value-added cyberspace service in Vietnam: keep an emergency response plan for cybersecurity weaknesses, risks and incidents, implement it and report an incident the moment it occurs, and apply technical measures to secure data processing, including personal-data processing.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .