VietnamCybersecurity Law, Information System Classification and Protection Measures
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Governance, Security
What it requires
- This duty binds now: Law No. 116/2025/QH15 took effect , and Decree No. 331/2026/ND-CP, which sets the classification criteria, has applied since .
- Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.NIST CSF 2.0ID.AM-05
- At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.NIST CSF 2.0GV.PO-01
- At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.NIST CSF 2.0GV.PO-01NIST CSF 2.0GV.OC-03NIST CSF 2.0DE.CM-09
- This duty does not describe a system the Prime Minister has placed on the list of information systems critical to national security: that class carries the full Article 10(1) and 10(2) obligation set plus its own appraisal, certification and annual self-inspection regime under Articles 9 and 11, gated on a government designation rather than a declared activity.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
- DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Private right of actionNo
Penalty structure
Decree No. 330/2026/ND-CP, art. 23 states two individual fine tiers, doubled for an organisation under art. 7(1): failing to promulgate cybersecurity design-and-operation rules, or, for a level 3 to level 5 system, failing to file a classification dossier, putting the system into operation without an approved level, or incompletely deploying the measures the approved level requires, draws VND 20,000,000 to 30,000,000 for an individual (VND 40,000,000 to 60,000,000 for an organisation); failing to inspect, supervise, log, or assess the effectiveness of the applied measures draws VND 30,000,000 to 50,000,000 for an individual (VND 60,000,000 to 100,000,000 for an organisation), the higher of the two tiers.
- Rule
- Fixed only
- As of
- Currency
- VND
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
The specialised cybersecurity protection force of the Ministry of Public Security, which the Law makes the focal agency for state administration of cybersecurity; the Ministry of National Defence for a military information system.
Settledness
- As of
- Open questions
- Does Article 10's classification duty reach a foreign enterprise's information system that serves users in Vietnam but keeps no branch, representative office, or physical infrastructure there?
What this law does
Article 8 sorts every information system into one of five levels by the damage a cybersecurity incident or violation could cause, and Article 10 grades a manager's protection duty to that level, reaching any manager, state or private, of a level 1 to level 4 system; a system on the Prime Minister's list of information systems critical to national security carries a fuller, separately gated regime under Articles 9 and 11.
Decree No. 331/2026/ND-CP, effective , sets the classification criteria and the approval procedure the Law's Article 8(2) delegates to the Government.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .