Circular No. 12/2019/TT-BTTTT amending and supplementing certain Articles of Circular No. 27/2017/TT-BTTTT dated October 20, 2017 of the Minister of Information and Communications on management, operation, connection, use, and ensuring information security on dedicated data communication networks for Party and State agencies.

CIRCULAR

AMENDING AND SUPPLEMENTING CERTAIN PROVISIONS OF THE CIRCULAR NO. 27/2017/TT-BTTTT DATED OCTOBER 20, 2017 OF THE MINISTER OF INFORMATION AND COMMUNICATION REGARDING MANAGEMENT, OPERATION, CONNECTION, USE, AND SECURITY OF INFORMATION ON SPECIAL-PURPOSE DATA NETWORKS OF PARTY AND STATE ORGANIZATIONS

PURSUANTpursuant to the Law on Information Technology dated June 29ng 6 yearm 2006;

pursuant to the Law on Telecommunications dated November 23ng 11 year 2009;

ng 4 year 2007 of the Government on the Application of Information Technology in the Activities of State Agencies;pursuant to the Law on Cybersecurity dated November 19 month 11 Article 2. The receipt, handling of reflections and petitions from individuals and organizations concerning administrative regulations shall be carried out in accordance with Decree No. 20/2008/NĐ-CP dated February 14, 2008 of the Government on the receipt, handling of reflections and petitions from individuals and organizations concerning administrative regulations (amended and supplemented by Decree No. 48/2013/NĐ-CP dated May 14, 2013 on amending and supplementing certain articles of decrees related to administrative procedure control and Decree No. 92/2017/NĐ-CP dated August 7, 2017 on amending and supplementing certain articles of decrees related to administrative procedure control).5;

pursuant to the Decree No. 64/2007/NĐ-CP dated April 10, 2007 of the Government on the Application of Information Technology in State Administrative Activities;ng 4 year 2007 of the Government;6/ND-CP dated 01 month 7 year 2016 of the Government amending

Decree No. 25/2011/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications, Decree No. 81 6/NĐ-CP dated July 1, 2016 of the Government amending certain provisions of Decree No. 25/2011/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications and Decree No.49/2017/NĐ-CP dated April 24, 2017 of the Government amending and supplementing Decree No. 25/2011/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications and/201some provisions of Decree No. 25/2011/NĐ-CP dated 06 month 4 year 2011 of the Government detailing and guiding the implementation of certain articles of the Law on Telecommunications and Decree No.49/2017/NĐ-CP dated 24 month 4 year 2017 of the Government amending and supplementingProvincial public libraries perform tasks and powers as prescribed in Clause 2, Article 11, Article 38, and Article 39 of the Library Law and the following tasks and powers: sửa đổi một số Decree No. 25/2011/NĐ-CP dated 06 month 4 year 2011 of the Government detailing and guiding the implementation of certain articles of the Law on Telecommunications;13 month 11 year 2013 of the Government stipulating administrative penalties for violations in the fields of postal services, telecommunications, information technology, and radio frequencies; Article 15 of Decree No. 25/2011/NĐ-CP h) Other objects as required by Party and State agencies.” “5. Special-purpose Internet access service is an Internet service connecting through the Internet gateway of the TSLCD network to serve applications for guidance, management, and operation of Central-level Party and State agencies on the TSLCD network.”đ) Supplement Clause 6 as follows: “6. The TSLCD network gateway is a network device, security device, or other equivalent device providing an interface for connection between the agency or organization's network system and the TSLCD network.”“1. Telecommunication enterprises must ensure connectivity between points within the TSLCD Level II network based on the usage requirements of provincial and centrally-administered city Party and State agencies and ensure the implementation of connectivity requirements according to the demands of the Central Post Office. thực hiện một số and Decree No. Article 30 of Decree No. 174/2013/NĐ-CP 2. To ensure connectivity between the TSLCD Level I and Level II networks, telecommunication enterprises must establish trunk connections to the TSLCD Level I network. 3. Connection methods:a) Points connecting to the TSLCD Level II network are directly routed to the centralized equipment of the TSLCD Level I network or routed to the centralized equipment of the wide-area local network;b) Points connecting to the TSLCD Level II network must be routed through the centralized equipment of the TSLCD Level I network.

Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring cybersecurity according to levels; 7/NĐ-CP dated February 17, 2017 of the Government on ensuring cybersecurity for information systems according to levels;28/2018/QĐ-TTg dated July 12, 2018 of the Prime Minister on electronic document transmission between agencies in the state administrative system;

Based on Decree No. 17/201The Minister of Information and Communications promulgates this Circular to amend and supplement certain provisions of Circular No. 27/2017/TT-BTTTT dated October 20, 2017 of the Minister of Information and Communications regarding management, operation, connection, use, and security of information on special-purpose data networks of Party and State organizations.Article 1. Amending, supplementing, and abolishing certain provisions of Circular No. 27/2017/TT-BTTTT dated October 20, 2017 of the Minister of Information and Communications regarding management, operation, connection, use, and security of information on special-purpose data networks of Party and State organizations.Health inspection,u organ dated November 21, 2013 of the Prime Minister promulgating the National Radio Frequency Plan;

Pursuant to Decision No. "1. Special-purpose data networks of Party and State organizations are important national information systems used for transmitting special-purpose data of Party and State organizations (hereinafter referred to as special-purpose data networks, abbreviated as 'SPDN'). SPDN includes Level I SPDN and Level II SPDN." "2. Level I SPDN is directly managed, operated, and exploited by the Central Post Office, connecting to:a) The Central Party Office, central Party committees, central-affiliated Party organizations, and agencies under the Central Committee;b) The National Ethnic Council, committees of the National Assembly, the National Assembly Office, and agencies under the Standing Committee of the National Assembly;

At the request of the Director of the Central Postal Administration,

c) The Office of the President;d) The Government Office, ministries, ministerial-level agencies, and agencies under the Government; đ) The Vietnam Fatherland Front Central Committee and political-social organizations at the central level;" "3. Level II SPDN connects to:a) Departments under provincial Party committees, city Party committees, county Party committees, town Party committees, district Party committees, village Party organizations, community Party organizations, and town Party organizations;b) People's Councils at the provincial and communal levels; c) Specialized agencies under provincial People's Committees, municipal People's Committees, and People's Committees at the provincial and communal levels;

d) Provincial and county-level Vietnam Fatherland Front Committees and political-social organizations;

1. Amending and supplementing Article 3 as follows:

a) Amend Clause 1 as follows:

đ) High courts, provincial courts, and equivalent courts;

b) Amend Clause 2 as follows:

e) High People's Procuratorates, provincial People's Procuratorates, and county-level People's Procuratorates;

g) State Audit Office regional offices;

h) Other entities as required by Party and State agencies."

"5. Special-purpose Internet access service is an Internet service that connects through the Internet gateway of the SPDN to serve applications for guidance, management, and operation of central Party and State agencies on the SPDN."

đ) Supplement Clause 6 as follows:

"6. The network connection gateway to the SPDN is a network device, a security device, or another equivalent device providing an interface for connecting the agency or organization's network system with the SPDN."

"1. Telecommunication enterprises must ensure connectivity between points within Level II SPDN based on the usage needs of provincial and municipal Party and State agencies and comply with the connection requirements set by the Central Post Office.

2. To ensure connectivity between Level I and Level II SPDN, telecommunication enterprises must establish trunk connections to Level I SPDN.

c) Amend Clause 3 as follows:

3. Connection methods:

a) Points connecting to Level II SPDN are routed directly to the centralized equipment of Level I SPDN or to the wide-area network centralized equipment of the locality;

b) Points connecting to Level II SPDN must be routed through the centralized equipment of Level I SPDN.

4. IP address resources and routing parameters: ensure consistent IP address resources and routing parameters in accordance with the law and guidelines from the Ministry of Information and Communications (Central Post Office) for the SPDN."

"2. Connection method and interface: two optical fiber cables are directly connected in opposite directions between Level I SPDN and Level II SPDN to meet the cybersecurity requirements stipulated in Clauses 2 and 3 of Article 12 of this Circular."

"1. Telecommunication enterprises providing services on Level II SPDN must meet the following conditions:

a) Having a network in administrative units at the provincial, county, and commune levels of provinces and centrally-administered cities;

b) Possessing sufficient infrastructure capacity to connect to units within Level II SPDN;

4. IP address resources and routing parameters: ensure consistent IP address resources and routing parameters in accordance with the provisions of the law and the guidelines of the Ministry of Information and Communications (Central Post Office) for the TSLCD network.”

d) Amend clause 5 as follows:

“2. Connection method and interface: direct two optical fiber cables in different directions between the TSLCD Level I network and the TSLCD Level II network to meet the information security requirements specified in Clauses 2 and 3 of Article 12 of this Circular.”

“1. Telecommunication enterprises providing services on the TSLCD Level II network must meet the following conditions:

a) Having a network at the provincial, district, and commune levels of provinces and centrally-administered cities;

2. Amend , Clause 1, Clause 2 Article 7a of this Regulation. as follows:

b) Possessing sufficient infrastructure capacity to connect to units within the TSLCD Level II network;

month 11

m 2019

Requirements for Data Centers when Connecting to the TSLCD Network

1. Meeting physical safety level 3 requirements under National Standard TCVN 9250:2012 on Data Centers - Technical Infrastructure Requirements for Telecommunications.

2. Meeting physical safety level 4 requirements under National Standard TCVN 9250:2012 in cases where the Data Center provides services to customers with level 4 or 5 information systems.

3. Amendment Clause 2 of Article 8 as follows:

4. Existence and obstacles

4. Amending and supplementing Article 9 is as follows:

a) Amend Clause 1 as follows:

Nailing down current existence and obstacles of the locality including: operation, use, funding, management, direction and operation, application of information technology.

5. Proposals and recommendations

Stating general proposals and recommendations to effectively implement the work of applying IT on the TSLCD network platform in the activities of state agencies in the upcoming period.

c) Have a staff team ensuring supervision, operation, and direct support for handling incidents at connection points, with connections to the first-level TSLCD network;

d) Be selected by local Party and State agencies as the service provider unit.”

b) Supplement Clause 4 as follows:

“4. Telecommunications enterprises must use separate routing equipment for connecting to the first-level TSLCD network and centralized connection equipment for units using the second-level TSLCD network.”

5. Amend Article 12 as follows:

“1. The first-level TSLCD network must comply with the provisions of Clause 5, Article 9 of Circular No. 03/2017/TT-BTTTT dated April 24, 2017, issued by the Minister of Information and Communications, and the basic requirements for information systems at level 5 according to standard TCVN 11930:2017.

2. The second-level TSLCD network must comply with the provisions of Clause 3, Article 9 of Circular No. 03/2017/TT-BTTTT dated April 24, 2017, issued by the Minister of Information and Communications, and the basic requirements for information systems at level 3 or higher according to standard TCVN 11930:2017.

3. Provisions on Information Systems when Connecting to the TSLCD Network:

a) The user unit must separate the subsystem connecting to the TSLCD network from the subsystem connecting to the Internet;

b) The information system when connecting to the TSLCD network must meet the security requirements according to the regulations on ensuring the security of information systems by levels; The connection gateway of the system must meet the security requirements specified in Appendix 1 of this Circular;

c) Data centers when connecting to the TSLCD network must meet the security requirements according to the regulations on ensuring the security of information systems by levels and the security requirements specified in Appendix 2 of this Circular.”

6. Amend Article 15 is as follows:

“1. Responsibilities of the Telecommunications Administration: cooperate in reviewing IP address resources, routing parameters of the TSLCD network, technical solutions and plans, development plans for the TSLCD network proposed by service providers.

2. Responsibilities of the Cybersecurity Agency:

a) Cooperate with the Central Post Office Directorate in drafting, adjusting, and supplementing regulatory documents and guidelines on ensuring cybersecurity and implementing cybersecurity measures on the TSLCD network;

b) Cooperate with the Central Post Office Directorate to evaluate and provide opinions on cybersecurity assurance plans of user units and telecommunications enterprises providing infrastructure for the second-level TSLCD network when connecting to the first-level TSLCD network;

c) Cooperate and support user units and network management and operation units in coordinating, handling, and responding to cybersecurity incidents;

d) Cooperate in implementing monitoring and warning solutions for user units' information systems when connecting to the TSLCD network to prevent unauthorized access through the Internet.

3. Responsibilities of the Inspectorate: take the lead in inspecting and auditing the implementation of regulations and procedures on managing, operating, connecting, exploiting, using, and ensuring security and safety on the TSLCD network.

4. Responsibilities of the Science and Technology Department: take the lead and cooperate with the Central Post Office Directorate to submit to the Ministry of Information and Communications for promulgation of technical standards and regulations on managing, operating, connecting, using, and ensuring cybersecurity on the TSLCD network.”

7. Repeal Article 17.

8. Amend and Supplement Article 18 is as follows:

a) Supplement Clause 5a as follows:

“5a. When it is necessary to add or change connection points for the second-level TSLCD network, the Department of Information and Communications shall submit a written request to the Ministry of Information and Communications (Central Post Office Directorate).”

b) Amend Clause 6 as follows:

“6. Before December 15 each year, report to the Ministry of Information and Communications (Central Post Office Directorate) in accordance with the form prescribed in Appendix 3 of this Circular.”

9. Amend and supplement Article 19 is as follows:

a) Amend the name of Article 19 as follows:

"Article 19. Responsibilities of units using the TSLCD network"

b) Amend Clause 1 as follows:

"1. Managing, operating, and protecting the port connecting to the TSLCD network located at the unit in accordance with the provisions set out in Appendix 1 of this Circular."

c) Add Point e and Point g of Clause 5 as follows:

"e) Managing access, monitoring, and preventing information security risks from the system of the unit when connected to the TSLCD network and external networks;"

g) Developing contingency plans for information security incidents."

d) Add Clause 9a as follows:

"9a. Cooperating with the Central Post Office to develop plans and implement connections of the unit's information systems to the TSLCD network."

đ) Amend Clause 10 as follows:

"10. Before December 15 each year, specialized agencies responsible for information technology of central Party and State agencies shall report to the Ministry of Information and Communications (Central Post Office) according to the form prescribed in Appendix 3 of this Circular."

10. Supplement Appendix 1 - Information Security Requirements for Systems Connecting to the TSLCD Network.

11. Supplement Appendix 2 - Basic Safety Requirements for Data Centers Connecting to the TSLCD Network.

12. Supplement Appendix 3 - Report on the Use of Specialized Data Transmission Networks.

Article 2. Implementation clause

1. This Circular takes effect from December 24, 2019.

2. Within sixty days from the date this Circular takes effect, organizations and individuals participating in the management, operation, connection, and use of the TSLCD network shall develop implementation plans to meet the requirements of this Circular.

3. The Head of the Office, the Director of the Central Post Office, the Heads of agencies and units under the Ministry, telecommunications enterprises, and related organizations and individuals are responsible for implementing this Circular.

4. During the implementation process, if any difficulties arise, the relevant agencies, telecommunications enterprises, and organizations and individuals are requested to promptly reflect them to the Ministry of Information and Communications (Central Post Office) for guidance or review and amendment.

ANNEX 1

INFORMATION SECURITY REQUIREMENTS FOR SYSTEMS CONNECTING TO THE TSLCD NETWORK
(Annexed to Circular No. 12/2019/TT-BTTTT dated November 5,2019) of the Minister of Information and Communications

Requirements for systems connected to the TSLCD network are marked with "x" and for level 4 or 5 information systems are marked with "xx" in this Appendix.

ANNEX 2

Requirements for Data Centers when Connecting to the TSLCD Network
(Annexed to Circular No. 12/2011. Meeting physical safety requirements level 3 as per National Standard TCVN 9250:2012 on Data Centers - Technical Infrastructure Requirements.2. Meeting physical safety requirements level 4 as per National Standard TCVN 9250:2012 in cases where the Data Center provides services to customers with level 4 or 5 information systems. ..., day ..., month ..., year ...(Write full name, sign, stamp) year 2024List detailed names of services and applications deployed on the TSLCD network at the section "Services and Applications Deployed on the TSLCD Network" of the Minister of Information and Communications

I. Mark "X" in the corresponding box in the sections "Current Connectivity Status", "

" and "Internal Network (LAN) Connection to the TSLCD Network"

2. Comply with the physical safety requirements at level 4 as set out in the National Standard TCVN 9250:2012 when the Data Center provides services to customers with information systems at level 4 or level 5.

3. Comply with the basic safety requirements at Level 3 as stipulated in the National Standard TCVN 11930:2017 on "Basic Safety Requirements for Information Systems by Levels."

4. Comply with the basic safety requirements according to the information system level of customers at Level 4 or 5 as stipulated in the National Standard TCVN 11930:2017.

II. REQUIREMENTS FOR CUSTOMER INFORMATION SYSTEMS IN THE DATA CENTER WHEN CONNECTED TO THE TSLCD NETWORK

1. The information system when connected to the TSLCD Network must establish a Connection Port that meets the security requirements set forth in Clause 2, Article 12 of this Circular.

2. For information systems at Level 3, the design and establishment of customer information systems must meet the following requirements:

a) The system must be designed separately and independently from other systems logically (Layer 3) and have measures to manage access between systems;

b) The network zones within the system must be designed separately and independently from each other logically (Layer 3) and have measures to manage access between network zones;

c) There must be separate logical storage partitions;

d) Main network devices including: Connection Ports, central switching devices, firewalls, and edge routing devices (if applicable) must be separated independently logically.

3. For information systems at Level 4 or Level 5, the design and establishment of customer information systems must meet the following requirements:

a) The system must be designed separately and independently from other systems physically and have measures to manage access between systems;

b) The network zones within the system must be designed separately and independently from each other logically (Layer 3) and have measures to manage access between network zones;

c) There must be separate physical storage partitions;

d) Main network devices including: Connection Ports, central switching devices, firewalls, and edge routing devices (if applicable) must be separated independently physically.

ANNEX 3

REPORT ON THE USE OF THE SPECIALIZED DIGITAL NETWORK
(Annexed to Circular No. 12/2019/TT-BTTTT dated November 5,2020 of the National Assembly to pilot certain policies to remove obstacles and pending issues in year 2024List detailed names of services and applications deployed on the TSLCD network at the section "Services and Applications Deployed on the TSLCD Network" of the Minister of Information and Communications

Name of reporting entity:1. Services, applications deployed on the TSLCD NetworkEntity using

REPORT ON THE USE OF THE SPECIALIZED DIGITAL NETWORK

Services, applications deployed on the TSLCD Network

Meeting cybersecurity criteria in Appendix 1

Scope of deploymentenergy

Required speed

Expected deployment time

4. Existing issues and obstaclesDescribe existing issues and current obstacles of the locality including: operation, use, funding, management, directive control, and information technology application.

4. Existence and obstaclesencoutered

List the current existence and obstacles of the locality including: operation, use, funding, management, directive control, application of information technology.

5. Propose and re- Competent authority (for reporting);

Present general recommendations to effectively implement the work of applying ICT on the TSLCD network platform in the activities of state agencies in the upcoming period.

1 Detail the names of services and applications deployed on the TSLCD network under the section "Services and applications deployed on the TSLCD network"Mark "X" in the corresponding box in the section "Current status of connection", section " "and section "Internal network (LAN) connection to the TSLCD network"

2 Mark "X" in the corresponding box in the section "Current status of connection", section " "and section "Connection of internal network (LAN) to the TSLCD network"Does not meet criteria” và mục “Kết nối mạng nội bộ (LAN) vào mạng TSLCD”