VietnamCybersecurity Law, Information Systems Critical to National Security, Appraisal, Inspection and Incident Duties
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 9 and 11
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This binds the manager of an information system that the Prime Minister has placed on the list of information systems critical to national security (reached by declaring that you operate an essential service); the sectors named include energy, finance, banking, telecommunications, transport and healthcare (article 9).
- Have the system appraised for cybersecurity and certified as meeting cybersecurity conditions before it is put into operation, and keep it regularly inspected and monitored during operation (article 9(3)).
- When you establish, expand or upgrade the system, conduct a cybersecurity inspection before putting it into operation, and each year carry out cybersecurity self-inspections, assess cybersecurity conditions and notify the results in writing to the competent specialised cybersecurity protection forces before October (article 11(1)(b)).
- Develop plans for responding to and remedying cybersecurity incidents, implement them when incidents occur, and promptly report the incident to the competent specialised cybersecurity protection forces; the Law states no fixed number of hours (article 11(1)(d)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministry of Public Security, which appraises, certifies and inspects information systems critical to national security (the Ministry of National Defence and the Government Cipher Committee for the systems under their management).
Settledness
- As of
- Open questions
- Which information systems has the Prime Minister placed on the list of information systems critical to national security, since article 9(1) leaves the list to the Prime Minister's decision?
- Does the duty in article 11(1)(d) to report an incident promptly acquire a fixed number of hours once an implementing text addresses it?
What this law does
Article 9(1) of the Law on Cybersecurity defines information systems critical to national security as those with a strategic and especially important role whose incidents or violations of the law on cybersecurity may cause damage to national security or serious damage to social order and safety, that are on the list issued by the Prime Minister.
Article 9(2)(g) includes national information systems in the energy, finance, banking, telecommunications, transport, agriculture, natural resources and environment, chemicals, healthcare and culture sectors among them. Article 9(3) requires these systems to undergo cybersecurity appraisal and be certified as meeting cybersecurity conditions before being put into operation, to be regularly inspected and monitored during operation, and to respond to and remedy cybersecurity incidents promptly.
Article 11(1)(b) requires the manager of such a system to conduct a cybersecurity inspection before putting a new or upgraded system into operation and to notify the results of its annual cybersecurity self-inspection in writing to the competent specialised cybersecurity protection forces before October every year.
Article 11(1)(d) requires the manager to develop plans for responding to and remedying cybersecurity incidents, to implement them when incidents occur, and to report promptly to the competent specialised cybersecurity protection forces, with no fixed number of hours stated. Article 11(2) gives the Ministry of Public Security the tasks of appraising, certifying and inspecting these systems, other than military and cryptographic information systems. The Law takes effect on .
When LexLint raises it
When your app profile says your app runs an essential service.