Directive No. 04/2006/CT-NHNN on Strengthening Information Security Work within the State Bank System

DIRECTIVE

Regarding Strengthening Information Security Work

In the System of the State Bank of Vietnam

In recent times, a relatively complete and detailed set of legal documents regulating the protection of state secrets in the banking sector has been issued; within the State Bank of Vietnam, this work has shown positive progress and gradually become institutionalized. In general, all Departments, Bureaus, and units under the State Bank have fully and specifically disseminated and implemented these regulations to their staff to ensure they understand and strictly adhere to the rules on protecting state secrets in the banking sector.

However, alongside the achievements made, there are still some shortcomings and limitations in implementing regulations on protecting state secrets in the banking sector, such as: Leaders of some units have not fully recognized the importance of information management and security work; they have not paid sufficient attention to this work; the awareness and compliance with regulations on protecting state secrets in the banking sector among a portion of the staff of the State Bank are not high; archival work still faces some difficulties and has not been carried out according to regulations. Some staff members have not fully understood and grasped the regulations on information security of the State and the Sector. Supervision, urging, reminding, detecting, and handling violations have not been adequately focused on and resolved firmly.

To rectify the above situation and ensure strict adherence to regulations on protecting state secrets in the banking sector, the Governor of the State Bank of Vietnam requests the Heads of Departments, Bureaus, and units under the State Bank to implement the following specific contents:

1. The Heads of units under the State Bank shall organize the dissemination and implementation again so that all staff in the unit fully understand and strictly comply with the following documents:

- Ordinance on Protecting State Secrets No. 03/2000/PL-UBTVQH10 dated December 28, 2000 of the Standing Committee of the National Assembly;

- Decree No. 33/2002/NĐ-CP dated March 28, 2002 of the Government detailing the implementation of the Ordinance on Protecting State Secrets;

- Circular No. 12/2002/TT-BCA (A11) dated September 13, 2002 of the Ministry of Public Security guiding the implementation of Decree No. 33/2002/NĐ-CP;

- Decision No. 15/2003/QĐ-TTg dated January 20, 2003 of the Prime Minister on the list of state secrets classified as Top Secret and Confidential in the banking sector;

- Decision No. 151/2003/QĐ-BCA (A11) dated March 11, 2003 of the Minister of Public Security on the list of state secrets classified as Secret in the banking sector;

- Decision No. 1087/2003/QĐ-NHNN dated September 17, 2003 of the Governor of the State Bank of Vietnam promulgating the Regulation on Protecting State Secrets in the Banking Sector and Decision No. 316/2004/QĐ-NHNN dated March 31, 2004 of the Governor of the State Bank of Vietnam amending and supplementing certain articles of the Regulation on Protecting State Secrets in the Banking Sector.

2. Strengthen the organization and implementation of work and compliance with regulations on protecting state secrets in the banking sector at units. Pay particular attention to the following aspects:

- Promote education, remind staff to enhance their sense of responsibility and vigilance in adhering to regulations on protecting state secrets in the banking sector; strictly and comprehensively implement regulations on drafting, printing, copying, photographing, transporting, receiving, storing, preserving, and using documents and objects carrying state secrets in the banking sector; when providing information, ensure it is for the correct purpose and recipient, without leaking or losing confidential documents to unauthorized parties.

- Strictly prohibit any acts of collecting, processing, disclosing, losing, appropriating, buying, selling, or illegally destroying information belonging to state secrets in the banking sector.

- Seriously implement the identification and stamping of classification levels for secret documents and objects carrying state secrets: documents must be identified and stamped with their classification level immediately upon drafting and signing; after typing, printing, or photocopying, units must stamp the classification level, page numbering, quantity printed, circulation range, recipient, name of typist, printer, or photocopier.

- Strictly prohibit the circulation and transfer of secret documents and letters that have been opened. The archives and consolidation departments of the Office of the State Bank and other units, when receiving secret documents and letters, must transfer them to responsible persons for handling in a secure manner. If secret documents need to be copied and sent, they must be done according to the confidentiality regime and placed in sealed envelopes with the appropriate confidentiality stamp before sending; secret documents and letters must not be openly transmitted via internal mail.

Staff of the State Bank of Vietnam may not provide information within the scope of state secrets in the banking sector to publishing agencies or mass media organizations in any form. Providing information within the scope of state secrets in the banking sector to agencies, organizations, or individuals must be approved by authorized bodies and carried out in accordance with regulations. Announcing and providing non-disclosed banking information (not included in the list of state secrets in the banking sector) must be strictly implemented according to Decision No. 736/2003/QĐ-NHNN dated July 9, 2003 of the Governor of the State Bank of Vietnam on Internal Regulations on Announcing and Providing Banking Information of the State Bank of Vietnam.

3. Based on the list of classified documents under the banking sector as prescribed by the Prime Minister and the Ministry of Public Security, the Office shall coordinate with relevant units to draft regulations specifically detailing the classification levels and sealing procedures for each type of document and object containing state secrets within the banking sector, to be submitted to the Governor for issuance as a basis for consistent implementation. Functional units under the State Bank, within their respective functions and responsibilities, shall review and submit to the Governor of the State Bank for amendment or supplementation of related legal normative documents; proactively propose information to be included in the list of state secrets, changes in classification levels, and declassification of state secrets within their units, to be submitted to the Governor for consideration and submission to the Prime Minister and the Ministry of Public Security for decision.

Relevant units shall review, revise, and complete internal procedures, including documentation work, concerning management, use, circulation, and preservation of contents listed in the state secret directory within their units. The Office of the State Bank shall compile information and reports from units and propose solutions to be submitted to the Governor for handling.

4. Review, select, and train staff members to ensure they possess good qualities, a sense of responsibility, professional ethics, organizational discipline awareness, vigilance in safeguarding state secrets, professional expertise, and the ability to fulfill assigned tasks for deployment in activities directly related to state secrets; firmly refrain from assigning individuals who lack suitable qualities and capabilities.

5. Strictly implement the regulation prohibiting the use of computers connected to the Internet or other external networks for typing and drafting classified and sensitive documents; strictly prohibit accessing, providing, and disseminating illegal information through computer networks. Allocate necessary resources to implement deployment, management, inspection, and supervision to ensure that information technology systems operate safely and securely.

The Banking Information Technology Department shall establish and install security measures for the entire State Bank network system; regularly monitor and inspect the operation of the State Bank's network system; take preventive, detection, and timely response measures against security breaches and violations of information confidentiality, ensuring the system operates in a safe and secure environment.

Functional units shall review and promptly issue specific guidance documents on ensuring information confidentiality in certain areas of State Bank operations, such as payments, accounting, electronic fund transfers, state foreign exchange reserve management, issuance management, vaults, etc. Confidential information in these areas, particularly encryption keys and secret symbols, must be strictly controlled and managed, with periodic changes implemented to ensure absolute safety of state assets and prevent exploitation of vulnerabilities for embezzlement.

6. Heads of units under the State Bank shall strengthen regular inspections and self-inspections of the implementation of the regulations on protecting state secrets within the banking sector for each staff member and department within their units. The Internal Audit Department shall enhance inspection, control, and internal audit of the implementation of regulations on protecting state secrets within the banking sector for units in the State Bank system to identify and promptly correct deficiencies and shortcomings in compliance with legal provisions, propose remedial measures, and prevent risks during operations. For violations, heads of units must have a clear and resolute attitude, without shielding or tolerating them, and must handle them according to the law.

This Directive shall take effect fifteen days after its publication in the Official Gazette. Heads of units under the State Bank are responsible for thoroughly implementing this Directive.