Circular No. 08/2008/TT-BNV guiding the procedures and formalities for issuing production and business licenses for civil cryptographic products and certificates of conformity and compliance for such products.

CIRCULAR

Guidelines on the procedures and formalities for issuing production and business licenses for civil cryptographic products and certificates of conformity and compliance for civil cryptographic products

--------------------------------

Pursuant to Decree No. 48/2008/NĐ-CP dated April 17, 2008 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Home Affairs;

Pursuant to Decree No. 73/2007/NĐ-CP dated May 8, 2007 of the Government on research, production, business, and use of cryptography for protecting information not within the scope of state secrets;
After consultation and agreement with the Ministry of Planning and Investment, the Ministry of Science and Technology, and the Ministry of Home Affairs, the guidelines on the procedures and formalities for issuing production and business licenses for civil cryptographic products and certificates of conformity and compliance for civil cryptographic products are as follows:

I. SCOPE OF REGULATION AND APPLICABLE SUBJECTS

1. Scope of regulation This Circular guides the procedures and formalities for issuing production and business licenses for civil cryptographic products and certificates of conformity and compliance for civil cryptographic products; responsibilities of organizations and individuals participating in the production, business, and use of civil cryptographic products; responsibilities of state management agencies regarding civil cryptography.

2. Applicable subjects This Circular applies to organizations and individuals participating in the production, business, and use of civil cryptographic products.

II. PROCEDURES AND FORMALITIES FOR ISSUING PRODUCTION AND BUSINESS LICENSES FOR CIVIL CRYPTOGRAPHIC PRODUCTS

1. Conditions for issuing production and business licenses for civil cryptographic products

a) Subject conditions: It must be a business established under the Law on Enterprises.

b) Human resource conditions:

- The head of the enterprise producing and trading in civil cryptographic products must have a clear record, possess legal knowledge, graduate from a university majoring in electronics-telecommunications, information technology, computer science, or information security, or if graduating from another major, must hold a short-term training certificate in information security; have at least five years of experience working in the field of information technology and telecommunications;

- Technical staff members must have a clear record and graduate from a university majoring in electronics-telecommunications, information technology, computer science, or information security;

- The technical staff, management staff, operational staff, security staff, and customer service staff must have labor contracts and possess the appropriate professional qualifications for their assigned tasks.

c) Other guarantee conditions:

- Ensuring security, safety, fire prevention, and protection of natural resources and the environment;

- Having feasible technical and business plans that comply with technical regulations and quality standards for civil cryptographic products.

2. The application dossier for issuing production and business licenses for civil cryptographic products shall be prepared in two sets. Each set includes:

a) Application form for issuing production and business licenses for civil cryptographic products according to Model 01 - Appendix I issued together with this Circular;

b) List of civil cryptographic products and services applying for production and business licenses according to Model 02 - Appendix I issued together with this Circular;

c) A certified true copy of the Business Registration Certificate or Investment Certificate of the enterprise;

d) A list of all leading cadres, technical staff members, technical staff, management staff, operational staff, security staff, and customer service staff including: full name, date of birth, citizen identification number, place of permanent residence registration, professional qualifications, job position;

đ) Dossier of the enterprise head and technical staff members, including: - A detailed curriculum vitae confirmed by the People's Committee of the commune or ward where they reside or confirmed by the competent authority; - A certified true copy of the bachelor's degree in one of the majors: electronics-telecommunications, information technology, computer science, or information security. (For the enterprise head, if none of the above degrees are held, submit a certified true copy of the bachelor's degree and a certified true copy of the short-term training certificate in information security).

e) Dossier on technical plans, including: - Documentation on technical characteristics and parameters of the product (cryptographic technical standards and regulations for each product; operating environment and conditions in the information technology and telecommunications system...); - Technical measures, solutions, maintenance and warranty plans to ensure the safety and security of civil cryptographic products and services.

g) Dossier on production and business plans, including: - The scope and target customers for providing civil cryptographic products and services; - Scale and quantity of civil cryptographic products expected to be produced and traded; - Customer service systems and technical support; - Forms of investment.

3. The application dossier for issuing production and business licenses for civil cryptographic products shall be submitted directly or sent via postal mail to the address:

Information Security Center for Economic and Social Affairs - Administrative Technical Department of the Government - Ministry of Home Affairs. Address: 62 Nguyen Chi Thanh Street - Dong Da District - Hanoi. Telephone/Fax: 04-3775.6896 Email: [email protected]

4. Review of the application dossier

Upon receipt of the application dossier for issuing production and business licenses for civil cryptographic products, the receiving agency is responsible for reviewing the dossier (for direct submissions) and reviewing within three working days from the date of receipt (for mailed submissions). In cases where the dossier is incomplete or invalid, the receiving agency must notify the enterprise to supplement it.

5. Examination of the dossier and issuance of the license

Within ten working days from the date of receiving the valid file of the enterprise, the General Office for Official Communications of the Government shall conduct an examination of the file. In case necessary information provided by the enterprise is incomplete or unclear, the General Office for Official Communications of the Government may conduct an on-site verification of actual conditions at the enterprise. When the enterprise meets the conditions stipulated in Clause 1, Section II of this Circular, the General Office for Official Communications of the Government shall issue a Civil Cryptographic Product Manufacturing and Trading License according to Form 05 - Appendix I issued together with this Circular. In case the conditions for issuing the license are not met, the General Office for Official Communications of the Government shall notify in writing and specify the reasons.

6. The Civil Cryptographic Product Manufacturing and Trading License is valid for five years. In case the Enterprise Registration Certificate or Investment Certificate of the enterprise ceases to be effective, the Civil Cryptographic Product Manufacturing and Trading License shall automatically become invalid.

7. Issuing a new license after the expiration of the old license

a) Thirty days before the expiration of the Civil Cryptographic Product Manufacturing and Trading License, if the enterprise wishes to continue manufacturing and trading in civil cryptographic products and services, it shall submit a file requesting issuance of a new license.

b) The application file for a new license shall be prepared in two sets.

Each set of the file includes:

- An application form for a Civil Cryptographic Product Manufacturing and Trading License according to Form 01 - Appendix I issued together with this Circular;

- Any changes or supplements (if applicable);

- A report on production and trading results over five years;

- A copy of the currently valid license and other related documents (if applicable).

c) Within seven working days from the date of receiving the valid file of the enterprise, the General Office for Official Communications of the Government shall conduct an examination of the file. In case necessary information provided by the enterprise is incomplete or unclear, the General Office for Official Communications of the Government may conduct an on-site verification of actual conditions at the enterprise. When the enterprise meets the conditions stipulated in Clause 1, Section II of this Circular, the General Office for Official Communications of the Government shall issue a Civil Cryptographic Product Manufacturing and Trading License according to Form 05 - Appendix I issued together with this Circular. In case the conditions for issuing the license are not met, the General Office for Official Communications of the Government shall notify in writing and specify the reasons.

8. Changing or supplementing the content of the approved product and service list

a) After being granted permission, if there are changes or supplements to the list of permitted civil cryptographic products and services, the enterprise shall request the General Office for Official Communications of the Government to make such changes or supplements.

b) The application file for changing or supplementing shall be prepared in two sets.

Each set of the file includes:

- An application form for changing or supplementing the content of the approved list of civil cryptographic products and services according to Form 03

- Appendix I issued together with this Circular;

- The list of civil cryptographic products and services requested for approval (with changes or supplements) according to Form 02 - Appendix I issued together with this Circular;

- Documentation on technical plans suitable for the supplementary production and trading content;

- Documentation on production and trading plans according to the supplementary production and trading content.

c) Within seven working days from the date of receiving complete and valid files, the General Office for Official Communications of the Government shall issue a Decision on changing or supplementing the content of the approved list for the enterprise according to Form 06 - Appendix I issued together with this Circular. In case the conditions for issuing the Decision are not met, the General Office for Official Communications of the Government shall notify in writing and specify the reasons.

9. Reissuing the license in cases of loss, damage, or change of the Enterprise Registration Certificate

a) Reissuing the license in case of loss

In case of loss of the license, the enterprise must report to the nearest police authority, send a written notification to the General Office for Official Communications of the Government, and simultaneously submit one set of the file requesting reissue of the license. The file includes:

- An application form for reissuing the license according to Form 04 - Appendix I issued together with this Circular;

- Confirmation from the police authority regarding the report of lost license.

b) Reissuing the license in case of damage

In case the license is damaged, the enterprise shall submit one set of the file requesting the General Office for Official Communications of the Government to reissue the license. The file includes:

- An application form for reissuing the license according to Form 04 - Appendix I issued together with this Circular;

- The original damaged license.

c) Reissuing the license in case of change of the Enterprise Registration Certificate

In case the enterprise changes its Enterprise Registration Certificate, the enterprise must submit one set of the file requesting the General Office for Official Communications of the Government to reissue the Civil Cryptographic Product Manufacturing and Trading License. The file includes:

- An application form for reissuing the license according to Form 04 - Appendix I issued together with this Circular;

- A certified copy of the newly issued Enterprise Registration Certificate;

- The original license currently in use.

In case of change of the head of the enterprise (the legal representative of the enterprise), in addition to the above-mentioned application file, the enterprise must also submit one set of documentation for the new head of the enterprise, including:

- A curriculum vitae with confirmation from the People's Committee of the commune or ward where the person resides or confirmation from the competent authority;

- A certified copy of a bachelor's degree in one of the following majors: electronics-telecommunications, information technology, computer science, information security. (If none of the aforementioned degrees are available, a certified copy of a bachelor's degree and a certified copy of a short-term training certificate in information security should be submitted).

d) Within seven working days from the date of receiving the valid file, the General Office for Official Communications of the Government shall review and reissue the license for the enterprise according to Form 05 - Appendix I issued together with this Circular. In case of reissuing due to damage, the number of the reissued license will be the same as that of the damaged license; in case of reissuing due to loss, the number of the reissued license will be a new number. On the reissued license, the reissue number and the reissue date shall be clearly stated.

10. Revoking the license

The General Office for Official Communications of the Government shall issue a decision to revoke the issued license in cases stipulated in Clause 1, Article 14 of Decree 73/2007/NĐ-CP according to Form 07 - Appendix I issued together with this Circular.

From the date the decision revoking the license becomes effective, the enterprise must cease signing contracts with customers. Within thirty days from the date the decision revoking the license becomes effective, the enterprise must settle the liquidation of all contracts for providing civil cryptographic products and services that have been agreed upon with customers and compensate for any losses (if any) in accordance with the provisions of the law.

After three months from the date the production and business license for civil cryptographic products is revoked, if the enterprise meets the conditions stipulated in Article 10 of Decree 73/2007/NĐ-CP, it has the right to request reissuance of the production and business license for civil cryptographic products. The procedures shall be the same as when applying for a new license.

11. Enterprises may submit applications for issuance or reissuance of production and business licenses for civil cryptographic products, and applications for changes or additions to the licensed product catalog through the electronic network at the website: http://www.bis.gov.vn. In this case, after reviewing the application, the Government Cryptographic Agency will notify the legal representative of the enterprise of the contents that need to be amended or supplemented in the application (if any). The enterprise must submit one original set of paper documents in accordance with this Circular for the Government Cryptographic Agency to compare and retain the file.

12. Fees and charges for licensing shall be implemented in accordance with the regulations of the Ministry of Finance.

III. PROCEDURES FOR ISSUING CERTIFICATES OF COMPLIANCE AND CERTIFICATES OF CONFORMANCE FOR CIVIL CRYPTOGRAPHIC PRODUCTS.

The Government Cryptographic Agency shall inspect, evaluate, and issue certificates of conformance for civil cryptographic products that are required to be certified before being circulated on the market. Certificates of compliance for civil cryptographic products shall be issued by the Government Cryptographic Agency upon request of organizations or individuals. The procedures for issuing certificates of compliance and certificates of conformance for civil cryptographic products shall be carried out as follows:

1. The application for issuance of a certificate of compliance for civil cryptographic products and a certificate of conformance for civil cryptographic products shall be prepared in three sets. Each set of application includes:

a) An application form for a certificate of compliance for civil cryptographic products according to Form 01 - Appendix III promulgated together with this Circular, or an application form for a certificate of conformance for civil cryptographic products according to Form 02 - Appendix III promulgated together with this Circular;

b) A valid copy of the identity card or passport for individuals; a valid copy of the business registration certificate for enterprises or establishment decisions for organizations;

c) A valid copy and a Vietnamese translation of the technical documentation of the product, including: origin documentation of the product, technical characteristics, technical parameters of the product, applicable standards/technical regulations, testing methods (if any), operational solutions, technical descriptions, user manuals, photographs of the exterior of the product, software, and installation, usage guides, and other related documents.

For civil cryptographic products that have already undergone inspection and evaluation by domestic or foreign organizations, a valid copy and a Vietnamese translation of the inspection and evaluation results of the product shall be submitted.

d) Sample product

(After the assessment and certification process, the sample product will be retained at the certifying agency. If the sample product is hardware and the organization or individual requesting certification requests its return, the certifying agency will return it to the organization or individual; the returned sample product must be sealed and a handover record established by the certifying agency.)

2. Applications for issuance of certificates of compliance and certificates of conformance for civil cryptographic products shall be submitted directly or sent by post to the address:

Information Security Center for Economic and Social Affairs - Administrative Technical Department of the Government - Ministry of Home Affairs. Address: 62 Nguyen Chi Thanh Street - Dong Da District - Hanoi. Telephone/Fax: 04-3775.6896 Email: [email protected]

3. Reviewing the application

After receiving the application for issuance of a certificate of compliance and a certificate of conformance for civil cryptographic products from organizations or individuals, the certifying agency shall be responsible for reviewing the application within three working days. If the application is incomplete or invalid, the certifying agency shall send a written notice requiring the organization or individual to supplement the application.

4. Time limit for testing, evaluating conformity with standards and technical regulations, and issuing certificates of compliance and certificates of conformance for civil cryptographic products

Within three working days from the date of receipt of a valid application, the certifying agency shall transfer the application to the testing organization. The testing organization shall be responsible for testing and evaluating the product and submitting a report of the results to the certifying agency within twenty working days from the date of receipt of a valid application. Within seven working days from the date of receipt of the testing organization's report, the certifying agency shall review and issue or refuse to issue a certificate of compliance or a certificate of conformance for civil cryptographic products to the organization or individual. In case of refusal, the certifying agency shall notify in writing and specify the reasons for refusal.

In special cases, the time for testing, evaluating, issuing or refusing to issue certificates of compliance and certificates of conformance for civil cryptographic products may be extended but not exceeding six months. The certifying agency shall be responsible for notifying the reasons in writing to the organization or individual requesting certification.

5. When necessary, the certifying agency may require organizations or individuals to provide additional technical documentation, solutions, equipment, and environment for product testing as required by the testing organization.

6. Fees and charges for evaluation, testing, certification of compliance, and certification of conformance for civil cryptographic products and issuance of certificates of compliance and certificates of conformance for civil cryptographic products shall be implemented in accordance with the regulations of the Ministry of Finance.

7. Certificates of compliance for civil cryptographic products, certificates of conformance for civil cryptographic products, and the Seal of Compliance for Civil Cryptographic Products shall be issued according to Forms 03, 04, and 05 - Appendix III promulgated together with this Circular; the Seal of Conformance shall be issued according to the guidelines and regulations of the Ministry of Science and Technology as stipulated in Decision No. 24/2007/QĐ-BKHCN dated September 28, 2007 of the Minister of Science and Technology.

IV. RESPONSIBILITIES OF ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN THE ACTIVITIES OF PRODUCTION, BUSINESS AND USE OF CIVIL ENCRYPTION PRODUCTS

1. Enterprises producing and trading civil encryption products shall be responsible for:

a) Managing files and documents related to technical solutions and production technology;

b) Applying security and safety measures during the production, business operation, and storage of civil encryption products;

c) Bearing legal responsibility for the quality of civil encryption products and services; complying with the regulations of state management agencies regarding certification of conformity and compliance, and announcement of conformity and compliance of civil encryption products produced and traded by the enterprise;

d) Temporarily suspending or ceasing to provide civil encryption products and services in emergency situations at the request of authorized state agencies to ensure national security;

đ) Cooperating and facilitating state agencies with the implementation of operational measures when required by law;

e) Signing contracts according to Model 01 - Appendix II issued together with this Circular;

g) Not providing the same encryption product with the same system key to different customers;

h) For encryption products that require electronic authentication systems, enterprises must comply with and advise customers to comply with the regulations of electronic authentication service providers as stipulated by law;

i) Maintaining, repairing, and providing warranty for civil encryption products supplied to customers;

k) Storing and securing customer information and encryption keys provided by the enterprise to each customer or batch of products according to the signed contract between both parties; the retention period is five years, except in cases where customers have other requirements;

l) Submitting periodic written reports every six months and annually on the situation of production and business operations of civil encryption products and consolidated customer information according to Model 02 - Appendix II issued together with this Circular to the General Office for Official Communications before June 30 for semi-annual reports, and before December 31 for annual reports;

m) Fulfilling other obligations as prescribed by law.

2. Organizations and individuals using civil encryption products shall be responsible for:

a) Adhering to the regulations agreed upon with the enterprise supplying civil encryption products concerning: management and use of encryption keys, transfer, repair, maintenance of civil encryption products, and other relevant agreements;

b) Cooperating and facilitating state agencies with the implementation of measures to ensure encryption security, information security, prevent crimes involving theft of information and encryption, and the illegal use of civil encryption products;

c) When purchasing civil encryption products and services, organizations and individuals must sign contracts according to Model 01 - Appendix II issued together with this Circular;

d) Bearing legal responsibility for their own violations or allowing others to exploit civil encryption products and services to violate laws on the use of civil encryption products.

đ) Fulfilling other obligations as stipulated by the law;

V. RESPONSIBILITIES OF LICENSED AUTHORITIES AND CERTIFICATION AUTHORITIES IN LICENSE AND CERTIFICATION MANAGEMENT FOR CIVIL ENCRYPTION PRODUCTS

1. Responsibilities of the Licensing Authority in managing licensing for the production and business of civil encryption products

a) Receiving and reviewing applications for new issuance, reissuance, and revocation of licenses for the production and business of civil encryption products for enterprises as guided in Section II of this Circular;

b) Securing information in applications for licenses for the production and business of civil encryption products and other information provided by enterprises;

c) Inspecting production and business establishments of civil encryption products, handling violations, and resolving complaints and denunciations regarding the activities of production and business of civil encryption products.

2. Responsibilities of the Certification Authority in managing certification of conformity and compliance for civil encryption products

a) Receiving and reviewing applications, evaluating, and issuing certificates of conformity for civil encryption products, certificates of compliance for civil encryption products with a validity period not exceeding three years for products requested for evaluation by organizations and individuals as guided in Section III of this Circular;

b) Granting and guiding the use of conformity marks for organizations and individuals whose civil encryption products have been certified for conformity according to Model 05 - Appendix III issued together with this Circular;

Granting and guiding the use of compliance marks for organizations and individuals whose civil encryption products have been certified for compliance. The compliance certification mark is granted according to the model specified by the Ministry of Science and Technology in Decision No. 24/2007/QĐ-BKHCN dated September 28, 2007, of the Minister of Science and Technology;

c) Revoking certificates of conformity, certificates of compliance, rights to use conformity marks, and rights to use compliance certification marks when organizations and individuals whose civil encryption products have been certified seriously violate regulations on certification of conformity and compliance;

d) Ensuring objectivity and fairness in conformity and compliance certification activities; they shall not provide consulting services to organizations and individuals requesting certification of conformity and compliance;

đ) Monitoring civil encryption products that have been certified for conformity and compliance to ensure the continued compliance of civil encryption products with corresponding standards and technical regulations;

e) Securing information collected during the certification of conformity and compliance for civil encryption products;

g) Publicly announcing on appropriate media about the issuance and revocation of certificates of conformity for civil encryption products, certificates of compliance for civil encryption products, and rights to use conformity marks and compliance marks for civil encryption products;

h) Establishing and guiding national standards and national technical regulations on the quality of civil encryption products for competent authorities to promulgate.

VI. IMPLEMENTATION

1. The General Office for Official Communications shall take the lead in coordinating with relevant ministries, sectors, and localities to implement this Circular

2. This Circular shall take effect fifteen days from the date of publication in the Official Gazette.

3. In the course of implementation, if there are difficulties, they should be promptly reported to the Ministry of Home Affairs for consideration and resolution.