Circular No. 11/2012/TT-NHNN on the management and use of computer networks of the State Bank of Vietnam

CIRCULAR

Regulations on the management and use of computer networks of the State Bank of Vietnam

_______________________

Pursuant to the Law on Electronic Transactions No. 51/2005/QH11 dated November 29, 2005;

Pursuant to the Law on Information Technology No. 67/2006/QH11 dated June 29, 2006;

Pursuant to the Law on Telecommunications No. 41/2009/QH12 dated November 23, 2009;

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12 dated June 16, 2010;

Pursuant to the Government Decree No. 64/2007/NĐ-CP dated April 10, 2007 on the application of Information Technology in the activities of state agencies;

Pursuant to the Government Decree No. 96/2008/NĐ-CP dated August 26, 2008 on the management, provision, and use of Internet services and electronic information on the Internet;

Pursuant to the Government Decree No. 97/2008/NĐ-CP dated August 28, 2008 on the management, provision, and use of Internet services and electronic information on the Internet;

Considering the proposal of the Director of the Department of Information Technology;

The Governor of the State Bank of Vietnam promulgates this Circular stipulating the regulations on the management and use of computer networks of the State Bank of Vietnam,

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation and Applicability

Article 1. This Circular stipulates the management and use of the State Bank of Vietnam's computer network (hereinafter referred to as the State Bank Network).

2. This Circular applies to individuals and units under the State Bank of Vietnam (hereinafter referred to as the State Bank); organizations outside and third parties permitted to use the State Bank's network.

Article 2. Interpretation of Terms

In this Circular, the following terms shall be understood as follows:

1. Users are individuals and units under the State Bank and external organizations permitted to use the State Bank's network.

2. Data center is the data center of the State Bank, including the main data center at the Department of Information Technology and the backup data center in Son Tay.

3. Regional connection center is the place where information technology equipment is installed to serve as intermediaries connecting the data center with provincial branches of the State Bank directly under the central government. Regional connection centers are located in the State Bank branches in Hanoi, Haiphong, Da Nang, Ho Chi Minh City, and Can Tho.

4. The State Bank's local area network is a system of networks connecting terminal devices within a geographic area under the State Bank.

5. Local area network transmission infrastructure includes internal cable systems and network connection ports.

6. Network equipment includes switching devices, routing devices, security devices, system software, and network management software.

7. Wireless network is a system of networks connecting terminal devices through radio waves or shortwaves.

8. The State Bank's wide area network is a system of networks connecting the data center, regional connection centers, and the State Bank's local area networks.

9. Wide area network transmission infrastructure includes dedicated transmission systems of the State Bank and communication service provider channels leased by the State Bank.

10. Core network layer is the core layer of the network system responsible for connecting other layers of the network.

11. Distribution network layer acts as an interface between access network layers and the core network layer.

12. Access network layer serves to connect users to systems.

13. IP address is a unique address assigned to network-connected devices for identification and communication using the Internet Protocol.

14. IP telephony service is a technology for transmitting voice over information networks using the TCP/IP protocol suite.

15. Video conferencing service is a technology for transmitting video and audio over information networks using the TCP/IP protocol suite.

16. Domain name is a unique name assigned to network-connected terminal devices.

17. Technical staff are personnel trained in information technology working in units under the State Bank.

18. Asset management unit is a unit under the State Bank entrusted by the Governor with asset management tasks.

19. Asset usage unit is a unit under the State Bank entrusted by the Governor with the right to use assets.

20. Third party permitted to use the State Bank's network (hereinafter referred to as third party) are organizations and individuals with expertise hired or cooperating with the State Bank to provide goods and technical services for the information technology system.

21. Organizations outside the State Bank (hereinafter referred to as external organizations) include credit institutions and other organizations that are not third parties permitted to use the State Bank's network.

Article 3. Network Architecture of the State Bank of Vietnam

1. The State Bank's network consists of the State Bank's local area network and the State Bank's wide area network.

2. Logical architecture of the State Bank's network:

a) The logical architecture of the State Bank's local area network includes the following main layers: core network layer, distribution network layer, and access network layer.

b) The logical architecture of the State Bank's wide area network includes connections between the data center and regional connection centers; connections between regional connection centers and provincial branches of the State Bank directly under the central government; communication gateways connecting the State Bank with external organizations.

3. Physical architecture of the State Bank's network includes: network equipment, local area network transmission infrastructure, and wide area network transmission infrastructure.

Article 4. Principles for Building, Managing, and Using the State Bank of Vietnam's Network

1. The State Bank's network must be designed and constructed with high availability, ensuring safety, security, and meeting the operational and business needs of the State Bank.

2. The State Bank's network is centrally managed and unified at the Department of Information Technology, with responsibilities delegated to asset management units.

3. Users may only use the State Bank's network and the Internet for professional and business purposes.

4. The use and sharing of information on the State Bank's network must comply with the State Bank's information security regulations and relevant laws.

5. Users who fail to comply with Article 24 of this Circular will have their services suspended temporarily.

Article 5. Network Resources and Services of the State Bank of Vietnam

1. Network resources include:

a) Transmission infrastructure, network equipment, network management software, and system configuration;

b) IP address system, domain name system, device identifier names.

2. Network services: data transmission services, voice services, video conferencing services, network monitoring and management services, and other value-added services.

Article 6. Provisions on safety and information security

1. The State Bank's network must be equipped with technical systems for network management and control to detect and prevent unauthorized access and ensure the safety of data exchanged over the network environment.

2. Connections between external organizations and the State Bank's network must be controlled by network security systems.

3. Computers connecting to and using resources and services of the State Bank's network must be authenticated by the network access control security system, install anti-virus and malware software, and update versions and security patch updates at least every three months.

4. Electronic data classified as "Confidential" or higher exchanged on the State Bank's network must apply security measures according to the specific regulations of the State Bank.

Chapter II

SPECIFIC PROVISIONS

Section 1

THE NETWORK OF THE STATE BANK OF VIETNAM'S DEPARTMENTS AND BRANCHES

Article 7. Provisions on new installation, upgrade, and repair

1. For new installation and upgrading of local network transmission infrastructure: Asset management units prepare design documentation for the transmission infrastructure and submit it to the Information Technology Bureau for technical review before submitting to the competent authority for approval.

2. For new installation and upgrading of network equipment, asset management units shall follow the following procedures when needed:

a) Submit a request letter to the Information Technology Bureau.

b) Within ten working days from the date of receipt of the request letter, the Information Technology Bureau conducts an assessment of the current status and usage needs of the unit and prepares a consolidated report.

c) Within the subsequent twenty working days, the Information Technology Bureau completes the budget estimate and plan for submission to the Governor of the State Bank for approval.

d) The Information Technology Bureau implements the equipment installation procedures after receiving approval.

3. Local network maintenance is a regular repair activity aimed at ensuring the operation of the local network without changing its technical configuration or design. Maintenance costs are implemented according to the State Bank's regulations on regular maintenance costs.

4. For maintenance of local network transmission infrastructure:

a) Units using assets but not being asset management units, when there is a need for maintenance, shall notify the asset management unit.

b) The asset management unit proactively organizes maintenance in accordance with the financial management regulations of the State Bank and notifies the Information Technology Bureau for technical coordination.

5. For maintenance of network equipment when faults occur, the asset management unit shall notify the Information Technology Bureau for technical coordination to determine the condition of the equipment and handle it as follows:

a) For faulty equipment still within warranty period or covered by maintenance contracts, the Information Technology Bureau will coordinate the repair and replacement of the equipment.

b) For equipment outside the warranty period and without maintenance contracts, the asset management unit shall organize maintenance in accordance with the financial management regulations of the State Bank and notify the Information Technology Bureau for technical coordination.

Article 8. Provisions on maintenance and handling of incidents

1. Provisions on maintenance:

a) The local network must undergo regular maintenance at least once every three months to ensure stable and secure operation.

b) Maintenance activities must not disrupt or affect the operational activities of the State Bank.

c) The maintenance process must be recorded in logs regarding the operational status before and after maintenance.

d) The Information Technology Bureau establishes maintenance procedures for local networks for units under the State Bank and is responsible for maintaining network equipment.

e) Asset management units are responsible for maintaining the transmission infrastructure and coordinating with the Information Technology Bureau to maintain network equipment at their units.

2. Provisions on incident handling:

a) The Information Technology Bureau establishes procedures and guidelines for incident handling.

b) Upon occurrence of an incident, technical staff at the unit must record the incident and handle it according to the guidelines provided by the Information Technology Bureau. Incidents not covered in the guidelines or unable to be resolved must be reported to the Information Technology Bureau for joint handling.

Article 9. Provisions on management and use

1. Activities involving new installation, upgrade, or repair of the State Bank's local network must comply with the network architecture requirements stipulated in Article 3 of this Circular.

2. Asset management units must establish, update, and store design documents and completion drawings for the local network upon new installation, upgrade, or repair.

3. Terminal devices such as workstations, printers, and IP telephones are only permitted to connect to user-accessible network areas.

4. The Information Technology Bureau specifies the unified allocation and use of IP addresses, device identifiers, and controls connections of devices to the State Bank's local network.

Section 2

THE STATE BANK WIDE AREA NETWORK

Article 10. Installation and renovation of wide area networks

1. Annually, based on the needs for using and exploiting data on the system network, the Information Technology Department shall prepare plans for new installation and renovation of wide area networks to be submitted to the Governor for approval.

2. After the plan has been approved, the Information Technology Department shall carry out procedures for equipping according to current regulations.

Article 11. Provisions on repairing wide area networks

1. Repairing wide area networks includes regular repairs to ensure continuous operation, safety, and efficiency of the network system.

2. The Information Technology Department is the main unit organizing the implementation of repairs for wide area network equipment of the State Bank.

Article 12. Provisions on management and control activities

The Information Technology Department shall be responsible for:

1. Centralized management and control of the State Bank's wide area network;

2. Building, updating, and storing design documents and completion drawings of the wide area network when installing new, upgrading, or repairing;

3. Recording daily operations and preparing periodic reports evaluating the overall system network every three months.

Article 13. Provisions on maintenance and handling incidents

1. Provisions on maintenance:

a) Wide area networks must be maintained regularly at least once every three months to ensure stable and safe operation.

b) Maintenance activities must not disrupt or affect the operational activities of the State Bank.

c) The maintenance process must be carried out according to the correct script, recording the operational status before and after maintenance.

d) The Information Technology Department shall develop maintenance plans and notify relevant units to cooperate in their implementation.

đ) Relevant units shall be responsible for cooperating with the Information Technology Department and recording the results of maintenance.

2. Provisions on incident handling:

a) The Information Technology Department shall implement the establishment of procedures and guidelines for incident handling.

b) When incidents occur, technical staff must record them and handle them according to the procedures and guidelines of the Information Technology Department.

Section 3

PROVISIONS ON CONNECTION BETWEEN THE STATE BANK AND OUTSIDE ORGANIZATIONS

AND OTHER ENTITIES

Article 14. Provisions on connecting to the State Bank's network

1. The State Bank (Information Technology Department) shall uniformly stipulate and manage the connection methods and IP address ranges for external organizations' terminal devices when connecting to the State Bank's network.

2. External organizations wishing to connect to the State Bank's network must obtain the State Bank's consent. Network connection procedures with the State Bank shall be carried out according to Article 16 of this Circular.

3. In cases where additional equipment is added or transmission routes are changed, external organizations must submit letters, design documents, configurations, and implementation plans to the Information Technology Department for review and approval before deployment.

Article 15. Conditions for connecting to the State Bank's network

1. Having sufficient technical equipment to connect to the network and ensuring information security on the transmission line according to the current regulations of the State Bank.

2. Having a team of technical staff with the ability to manage connected terminal devices and network equipment of the organization.

Article 16. Procedures for new connections or changes to network connections

1. For head offices of credit institutions and other non-credit institutions wishing to establish new connections or change network connections with the State Bank, they must submit Registration Forms according to Form No. 01 to the Information Technology Department. Within ten working days from the date of receiving complete and valid registration forms, the Information Technology Department shall notify the result of processing the registration form.

2. For branches of credit institutions and people's credit funds wishing to establish new connections or change network connections with provincial or municipal central branch of the State Bank, they must submit Registration Forms according to Form No. 01 to the provincial or municipal central branch of the State Bank in the same locality.

a) Within three working days from the date of receiving complete and valid registration forms, the provincial or municipal central branch of the State Bank shall examine the rationality of the registration form and connection requirements, and if approved, shall forward the registration form to the Information Technology Department for coordination in processing.

b) Within ten working days from the date of receiving complete and valid registration forms, the Information Technology Department shall examine and notify the result of processing the registration form to the provincial or municipal central branch of the State Bank.

c) Within three working days from the date of receiving the notification result from the Information Technology Department, the provincial or municipal central branch of the State Bank shall notify the result of processing the registration form to the registering entity.

3. For third parties wishing to connect to the State Bank's network, they must submit Registration Forms according to Form No. 03 to the Information Technology Department. Within ten working days from the date of receiving complete and valid registration forms, the Information Technology Department shall notify the result of processing the registration form.

4. Registration forms for network connections shall be sent through postal service or directly submitted to the headquarters of the State Bank as stipulated in Clause 1, 2, and 3 of this Article.

5. Within thirty working days following the receipt of the approval notice for connection from the State Bank, external organizations shall proactively complete all procedures and technical processes to finalize the network connection with the State Bank.

Article 17. Procedures for Network Disconnection

1. For headquarters of credit organizations and non-credit organizations that no longer have a need to connect to the State Bank of Vietnam, they must submit the Network Disconnection Application Form according to Model No. 02 to the Information Technology Department. Within five working days from the date of receiving complete and valid applications, the Information Technology Department will notify the results of the application processing.

2. For branches of credit organizations and people's credit funds that no longer have a need to connect to the State Bank branch at provincial or centrally-administered city level, they must submit the Network Disconnection Application Form according to Model No. 02 to the State Bank branch at provincial or centrally-administered city level within their jurisdiction.

a) Within five working days from the date of receiving complete and valid applications, the State Bank branch at provincial or centrally-administered city level will forward the application to the Information Technology Department for coordination in processing.

b) Within five working days from the date of receiving complete and valid applications, the Information Technology Department will carry out the network disconnection procedures and notify the results of the application processing back to the State Bank branch at provincial or centrally-administered city level.

c) Within three working days from the date of receiving the notification result from the Information Technology Department, the State Bank branch at provincial or centrally-administered city level will notify the results of the application processing to the entity.

3. For third parties that no longer have a need to connect to the network, they must notify the Information Technology Department to cancel the connection. Within three working days from the date of receiving complete and valid applications, the Information Technology Department will carry out the network disconnection procedures and notify the results of the application processing.

4. The application for network disconnection shall be sent through postal service or submitted directly to the State Bank's headquarters as stipulated in Clause 1, 2, and 3 of this Article.

Section 4

INTERNET CONNECTION

Article 18. Management of Internet Connection

1. Computers belonging to the State Bank's local area network connecting to the Internet must go through the connection ports established and managed by the Information Technology Department.

2. Computers not belonging to the State Bank's local area network connecting to the Internet shall be decided by the head of the unit using the assets and must comply with the State Bank's regulations on information security and other relevant laws.

3. In cases where units having computers belonging to the State Bank's local area network require direct Internet connection without going through the connection ports established and managed by the Information Technology Department, such requests must be approved by the Governor of the State Bank. The unit must implement protective measures and bear responsibility for ensuring the safety of the State Bank's network.

Article 19. Conditions for Internet Connection

1. Terminal devices connecting to the Internet must install anti-virus software and security software.

2. Users connecting through the Internet port managed by the Information Technology Department must use the access account issued by the Information Technology Department.

Article 20. Provisions on Supervision and Control of Internet Connection

1. Between the State Bank's network and the Internet, there must be a cybersecurity system to ensure the security and confidentiality of the State Bank's network. It is strictly prohibited to use Internet connection devices to directly connect to the State Bank's network.

2. The Information Technology Department is responsible for managing and controlling devices belonging to the State Bank's network connecting to the Internet.

3. The Information Technology Department manages and issues Internet access accounts to users. In necessary cases, to ensure the safety of the State Bank's network system, the Information Technology Department has the right to proactively suspend or revoke Internet access accounts.

Article 21. Provisions on wireless network connection and mobile devices

1. The Information Technology Department shall manage the activities of network devices providing wireless connection services and control access to the wireless network from devices connecting to the State Bank of Vietnam's network.

2. When there is a need for a wireless network connection to the State Bank of Vietnam, users must register using Form No. 04.

3. Upon expiration of the registration period for the wireless network connection, the system will automatically cease service provision.

Section 5

RESPONSIBILITIES IN MANAGEMENT AND USE OF THE STATE BANK OF VIETNAM NETWORK

NETWORK OF THE STATE BANK

Article 22. Responsibilities of the Information Technology Department

1. Shall be responsible for technical management of the State Bank of Vietnam's network system.

2. Advise the Governor of the State Bank of Vietnam on strategies, planning, and development plans for the State Bank of Vietnam's network and organize implementation after approval.

3. Manage the allocation and use of resources within the scope of delegated management for the State Bank of Vietnam's network.

4. Monitor and supervise the operation of the State Bank of Vietnam's network system to ensure continuous, stable, and secure operation.

5. Warn and guide units of the State Bank of Vietnam about security vulnerabilities and risks that may affect the operation of the State Bank of Vietnam's network.

6. Notify the asset management unit three working days prior to temporarily suspending network service for maintenance, upgrades, or repairs.

7. Guide, accept, and process new connection registration forms, changes to connections, and disconnection requests for main offices of credit organizations (excluding people's credit funds), other non-credit organizations, and third parties.

8. Organize inspections of network connections between external organizations and third parties with the State Bank of Vietnam's network.

Article 23. Responsibilities of the Asset Management Unit

1. Organize guidance and inspection of local network usage at the unit.

2. Guide, accept, and process new connection registration forms, changes to connections, and disconnection requests for people's credit funds and branches of credit organizations within the area.

3. Organize inspections of network connections between external organizations and the State Bank of Vietnam's network through the unit's connection portal.

4. Coordinate with the Information Technology Department in managing network connections of external organizations within the area.

5. Assign technical staff to manage network equipment and coordinate in handling incidents arising at the unit.

6. Ensure necessary conditions for network equipment at the unit to operate safely and stably.

Article 24. Responsibilities of Users

1. Utilize resources and exploit information on the State Bank of Vietnam's network and the Internet within permitted limits and under the supervision and control of the Information Technology Department.

2. Comply with regulations of the State Bank of Vietnam and laws regarding information security, network management, and usage.

3. Comply with the State Bank of Vietnam’s and relevant laws’ provisions regarding network connection, use, and exploitation of the Internet.

4. Strictly prohibit the use of tools or software that harm the operation of the State Bank of Vietnam's network system.

5. In case of incidents, report to technical staff at the asset management unit for guidance and support in resolving the issue.

6. Cooperate with technical departments in handling and confirming the resolution of incidents.

Article 25. Responsibilities of External Organizations and Third Parties

1. Comply with regulations on connecting to the State Bank of Vietnam Network.

2. Ensure security for terminal devices, network devices, and connection pathways to the State Bank of Vietnam's network.

3. Select service providers for transmission bandwidth, pay installation costs, subscription fees, and repair and maintenance costs for pathways to the State Bank of Vietnam.

Chapter III

IMPLEMENTATION

Article 26. Effective date

1. This Circular takes effect from June 11, 2012.

2. This Circular replaces Decision No. 39/2006/QD-NHNN dated August 8, 2006, issued by the Governor of the State Bank of Vietnam on the Regulations for Managing and Using Internal Computer Networks of the State Bank of Vietnam.

Article 27. Implementation Provisions

1. The Information Technology Department shall be responsible for guiding, supervising, and inspecting the implementation of this Circular.

2. The Internal Audit Department shall be responsible for internal auditing the implementation of this Circular by units under the State Bank of Vietnam.

3. Banking Inspection and Supervision Authorities shall be responsible for coordinating with the Information Technology Department to inspect the implementation of this Circular by external organizations participating in network connections and exploitation of the State Bank of Vietnam's network.

4. Heads of units under the State Bank of Vietnam, State Bank of Vietnam provincial and municipal branches, external organizations connected to the State Bank of Vietnam's network, and third parties within their functions and duties shall be responsible for implementing this Circular./.