Circular No. 121/2018/TT-BTC on the preparation of budgets, management, use, and settlement of funds for implementing emergency response and ensuring cybersecurity

3. The National Steering Committee for Emergency Response to Ensure Cybersecurity (hereinafter referred to as the National Steering Committee) and the Emergency Response Steering Committees for Information Security Incidents of ministries, government agencies, and provincial people's committees (hereinafter referred to as the Ministry-level and Provincial Steering Committees); the National Coordination Center for Emergency Response to Ensure Cybersecurity; the National Standing Office for Emergency Response to Ensure Cybersecurity; the National Coordination Center for Incident Response.

4. Members of the national network for incident response to ensure cybersecurity; units specialized in incident response and cybersecurity; operational teams for emergency response to ensure cybersecurity; cybersecurity incident response teams.

2. People's Committees of provinces and centrally governed cities.

5. Enterprises, organizations, and individuals related to incident response activities and ensuring cybersecurity.

2. Enterprise funds; contributions, sponsorships, and other lawful sources of funding as prescribed.

1. For state budget funds:

1. State budget.

Funds for implementing emergency response activities and ensuring cybersecurity shall be allocated within the state budget estimates of ministries, central agencies, and localities according to the current budget decentralization. The allocation of funds shall follow the principle that activities and forces under the budget of a certain level shall be guaranteed by that level's budget and incorporated into the annual budget estimate of the agency or unit in accordance with the provisions of the Law on State Budget and other relevant laws, specifically:

a) Central budget:

- Ensuring funds for implementing tasks to ensure information security as stipulated in Clause 1 and Clause 3, Article 24 of Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring the security of information systems according to levels (hereinafter referred to as Decree No. 85/2016/NĐ-CP), including:

+ Funds for implementing requirements for information security at different levels in the operations of state agencies and organizations funded by the state budget;

+ Funds for monitoring, evaluating, managing information security risks; short-term training, propaganda, raising awareness, conducting cybersecurity exercises and incident response of state agencies and organizations allocated in their annual budget estimates according to the decentralization of the Law on State Budget.

- Ensuring funds for implementing tasks as stipulated in Point a, Clause 2, Article 17 of Decision No. 05/2017/QĐ-TTg dated March 16, 2017 of the Prime Minister promulgating regulations on the system of emergency response plans for ensuring national cybersecurity (hereinafter referred to as Decision No. 05/2017/QĐ-TTg), including:

+ Activities of directing, managing, inspecting, and supervising incident response by the National Steering Committee, the National Coordination Center, and the National Standing Office for Incident Response;

+ Activities of the National Coordination Center;

+ Activities and tasks of ministries and central agencies.

b) Local budget:

- Ensuring funds for implementing tasks to ensure information security as stipulated in Clause 1 and Clause 3, Article 24 of Decree No. 85/2016/NĐ-CP.

- Ensuring the activities of the Steering Committee, specialized units for incident response, incident response teams at the local level, and tasks assigned to localities as stipulated in Point b, Clause 2, Article 17 of Decision No. 05/2017/QĐ-TTg.

2. For incident response and cybersecurity tasks under the responsibility of enterprises, enterprises shall self-fund these activities.

3. Funds supporting the implementation of incident response and cybersecurity tasks must be managed and used for their intended purposes, in accordance with regulations, and as stipulated in this Circular.

2. For emergency response tasks and ensuring cybersecurity that fall under the responsibility of businesses, such businesses shall ensure their own funding for implementation.

3. The funding for supporting the implementation of emergency response tasks and ensuring cybersecurity must be managed and used for the intended purpose, in accordance with regulations, and in compliance with this Circular.

The content of expenditure for the central budget, local budgets, and enterprises as stipulated in Clause 2 of Article 17 of Decision No. 05/2017/QĐ-TTg; Clause 1 and Clause 3 of Article 24 of Decree No. 85/2016/NĐ-CP.

Ministries, central agencies, localities, agencies, and units using state budget funds for emergency response work and ensuring cybersecurity must comply with the current financial expenditure standards and regulations issued by competent state authorities.

This Circular specifies detailed expenditure levels for certain specific tasks and responsibilities related to emergency response and ensuring cybersecurity as follows:

1. Expenditure for organizing mid-term and final review meetings, specialized conferences, seminars on emergency response work and ensuring cybersecurity; expenditure for verification teams, inspections, supervision, evaluation of implementation results, and domestic study tours on monitoring, coordination, emergency response, and ensuring cybersecurity: Implemented according to Circular No. 40/2017/TT-BTC dated April 28, 2017, issued by the Ministry of Finance, which stipulates travel expense allowances and conference expenditure regulations.

2. Expenditure for organizing international seminars in Vietnam: Implemented according to Circular No. 71/2018/TT-BTC dated August 10, 2018, which stipulates foreign guest reception regulations when working in Vietnam, conference and seminar expenditure regulations for international events held in Vietnam, and domestic reception regulations.

3. Expenditure for overseas study tours and participation in international seminars on monitoring, coordination, emergency response, and ensuring cybersecurity: Implemented according to Circular No. 102/2012/TT-BTC dated June 21, 2012, issued by the Ministry of Finance, which stipulates travel expense allowances for civil servants and public officials on short-term missions abroad funded by the state budget.

4. Expenditure for maintaining hotlines at the national coordination agency: Expenditure for maintaining hotlines according to contracts, invoices, and valid documents; support for individuals directly receiving information from hotlines (receiving information 24 hours a day, 7 days a week): VND 1,300,000 per person per month per hotline. Individuals receiving this support shall not be paid overtime wages for hotline duty according to regulations.

5. Expenditure for training, instruction, and upgrading skills, expertise, and professional knowledge in coordination, emergency response, and ensuring cybersecurity: Implemented according to Circular No. 166/2015/TT-BTC dated November 5, 2015, issued by the Ministry of Finance, which stipulates the management and use of funds for short-term domestic training projects on information security and cybersecurity under the Human Resource Development Program for Information Security and Cybersecurity until 2020.

6. Expenditure for organizing cybersecurity drills and emergency response exercises:

Implemented according to approved plans and budgets in accordance with expenditure content and levels specified in Circular No. 166/2015/TT-BTC dated November 5, 2015, issued by the Ministry of Finance, which stipulates the management and use of funds for short-term domestic training projects on information security and cybersecurity under the Human Resource Development Program for Information Security and Cybersecurity until 2020.

7. Expenditure for leasing technical services, purchasing, upgrading, extending software licenses, equipment, and maintenance of tools to serve emergency response work and ensuring cybersecurity:

a) Expenditure for leasing information technology services: Technical services, software license extensions, support services, maintenance, and other services serving emergency response work and ensuring cybersecurity: Implemented according to the Public Procurement Law and its implementing regulations. Leasing of information technology services must align with the emergency response plan, cybersecurity assurance plan, and approved information technology service leasing plans of ministries, sectors, and localities.

b) Expenditure for purchasing and upgrading equipment, applying information technology to serve emergency response work and ensuring cybersecurity: Implemented according to the Public Procurement Law and its implementing regulations. Purchasing and upgrading of equipment and applying information technology must align with the emergency response plan and cybersecurity assurance plan approved by ministries, sectors, and localities.

8. Expenditure for establishing, maintaining, and operating databases on cyber threats and incidents, websites of the national coordination agency, the national emergency response network, and information sharing systems to serve coordination and cybersecurity assurance work: Implemented according to Circular No. 194/2012/TT-BTC dated November 15, 2012, issued by the Ministry of Finance, which provides guidelines on expenditure levels for establishing electronic information to maintain the regular operations of agencies and units using state budget funds.

9. Expenditure for supporting the development and application of ISO 27xxx standards as stipulated in Decision No. 05/2017/QĐ-TTg and international standards on cybersecurity: Implemented according to Circular No. 116/2015/TT-BTC dated August 11, 2015, issued by the Ministry of Finance, which stipulates financial management regulations for consulting, developing, applying, maintaining, and improving quality management systems according to the national standard TCVN ISO 9001: 2008 in the activities of administrative state agencies and organizations.

10. Expenditure for promotional activities serving emergency response work and ensuring cybersecurity: Implemented according to Joint Circular No. 14/2014/TTLT-BTC-BTP dated January 27, 2014, issued by the Ministry of Finance and the Ministry of Justice, which stipulates the preparation of budgets, management, use, and settlement of state budget funds to ensure legal education and access to justice for citizens at the grassroots level.

11. Expenditure for hiring consultants for emergency response and ensuring cybersecurity:

a) For hiring domestic consultants: Applied according to Circular No. 02/2015/TT-BLDTBXH dated January 12, 2015, issued by the Ministry of Labor, Invalids, and Social Affairs, which stipulates the salary levels for domestic consultants as the basis for tendering packages for consulting services under time-based contracts using state funds.

b) For hiring foreign consulting experts: Based on the necessity level and implementation of activities and approved budget estimates, the Minister, head of central agencies, Chairman of provincial People's Committees under the Central Government shall decide on hiring foreign consulting experts and bear responsibility for their decisions. The actual expenditure shall be carried out according to the real contract agreed with the expert based on quality requirements, quantity, and time of work performance.

12. For expenditure items subject to cost standards, unit prices, working days, based on scale, degree, technical requirements, technological needs, tasks ensuring information security, emergency response, and actual conditions to determine. In cases where tasks are performed by civil servants, public officials, employees within the agency or unit, only night shift and overtime pay (if applicable) shall be settled according to regulations. For external service rental or purchase contents, payment shall be made according to contracts with suppliers, ensuring compliance with invoice and receipt regulations and bidding and procurement rules, including the following expenditure items:

a) Costs for coordinating emergency response to information security incidents, including: Receiving, analyzing, and preliminarily classifying incidents and affected systems; checking, verifying, and evaluating incident information; researching, investigating, and analyzing incidents and proposing coordination and emergency response methods and solutions; directing, coordinating, organizing units to participate in emergency response and handling; monitoring, inspecting, and urging the implementation of coordination orders;

b) Costs for organizing support for emergency response and handling cyber attacks, including: Receiving, checking, verifying, evaluating, and classifying incidents; researching, investigating, and analyzing incidents; proposing and selecting emergency response deployment plans and forms; renting technical services, equipment, and devices for incident handling; implementing emergency response, preventing, and handling incidents; preparing emergency response and handling reports;

c) Costs for direct monitoring aimed at tracking, analyzing, and early detection of risks and incidents for information systems, including: Surveying and developing monitoring plans and strategies; renting, purchasing, installing technical equipment, and researching adjustments, supplements, and updates to monitoring; tracking, analyzing, and preparing regular monitoring reports;

d) Costs for indirect monitoring by the national coordination agency and competent authorities for information technology systems and services serving electronic government, including: Surveying and developing monitoring plans and strategies; renting, purchasing, and installing, deploying technical equipment; collecting, summarizing, and consolidating incident, risk, cyber attack, and information security vulnerability situations; synthesizing and analyzing information and data about incidents from various sources; tracking, analyzing, and detecting signs affecting system availability, integrity, and security;

đ) Building scenarios for potential incidents and cyber attacks and preparing emergency response plans for information systems, including: Surveying and determining the scope and scale of information systems; researching and analyzing possible incidents; determining emergency response plans according to scenarios and specific systems; guiding and agreeing on emergency response procedures and cooperation methods during the response process;

e) Costs for in-depth research, analysis, data backup, and guidance on handling harmful software (malware), including: Surveying incident sites and sampling malware; preparing tools, equipment, software, means, and environments for analysis; analyzing basic information, assessing, and testing to verify malware information; researching and proposing malware classification; detailing malware analysis; researching and analyzing infection mechanisms, attacks, operations, and impacts; researching and analyzing damage caused by malware;

g) Costs for scanning, detecting, and removing dangerous malware from servers, workstations, and terminal devices; surveying, researching, and building plans; conducting malware scans and restoring server data; removing, processing malware, restoring encrypted data, and establishing security measures to prevent malware;

h) Costs for inspecting, evaluating, and detecting information security risks and vulnerabilities for web portals, systems, software, applications, and IT services supporting electronic government, including: Surveying and collecting information about systems, developing inspection and evaluation plans, setting up simulation and risk support systems, inspecting, evaluating, and analyzing information security weaknesses; analyzing evaluation results and proposing remediation solutions; transferring and supporting guidance on remediation of weaknesses and vulnerabilities;

i) Inspecting, analyzing, and evaluating information security for infrastructure, servers, workstations, and network devices, including: Surveying systems and developing plans; deploying risk prevention support systems; inspecting and evaluating design and network system weaknesses; inspecting and evaluating weaknesses for each device, server, workstation, and system software, platform applications; guiding remediation of security risks and vulnerabilities;

13. Costs for investigating, surveying, compiling, and statistically analyzing information and data on information security, coordination, and emergency response: Implemented according to Circular No. 109/2016/TT-BTC dated June 30, 2016 of the Ministry of Finance on the preparation, management, use, and settlement of funds for statistical surveys and national comprehensive statistical surveys.

14. Other costs directly serving coordination, emergency response, and ensuring information security: The expenditure levels are based on legitimate and valid invoices and receipts and within the approved budget; the heads of agencies and units decide on other expenditure levels and bear responsibility for their decisions under the law.

The establishment of budgets, management, use and settlement of funds for emergency response to incidents and ensuring cybersecurity shall be carried out in accordance with the provisions of the State Budget Law, the Accounting Law, and guiding documents. In addition, this Circular provides guidance on the following specific matters:

1. Establishment of budget projections:

Each year, based on assigned tasks related to emergency response to incidents and ensuring cybersecurity under Decree No. 85/2016/NĐ-CP, Decision No. 05/2017/QĐ-TTg, and guidelines from the Ministry of Information and Communications on emergency response to incidents and ensuring cybersecurity nationwide, along with the provisions of this Circular, agencies and units shall develop plans and establish budgets for coordination, emergency response to incidents, and ensuring cybersecurity as follows:

a) For funds from the central government budget:

- The National Coordination Agency for Emergency Response to Incidents, the National Standing Agency for Ensuring Cybersecurity, and the National Emergency Coordination Board for Ensuring Cybersecurity shall establish budgets for emergency response to incidents and ensuring cybersecurity, which they will submit to the Ministry of Information and Communications for consolidation into the Ministry's budget proposal sent to the Ministry of Finance for consolidation and submission to the competent authority for decision-making according to regulations.

- For funds allocated for cybersecurity assurance and incident response responsibilities of ministries and central agencies: Each year, ministries and central agencies shall establish budgets and consolidate them into the state budget proposal of their respective ministries or agencies, which they will send to the Ministry of Finance for consolidation and submission to the competent authority for decision-making according to regulations.

- For expenditures on projects: Ministries and central agencies tasked with leading the implementation of projects approved by the Prime Minister shall base their budget proposals (funds guaranteed by the central budget) on the objectives and tasks of each project, consolidate these into their own budget proposals, and submit them to the Ministry of Finance for approval by the competent authority.

b) For funds from local government budgets:

Agencies responsible for ensuring cybersecurity, agencies assigned to serve as standing members of the Steering Committee, specialized units for incident response, local incident response teams, and agencies and units tasked with leading the implementation of work related to cybersecurity assurance and incident response shall establish budgets and submit them to higher-level budgetary units for consolidation into the local government budget, which will be reported to the People's Council at the provincial level for consideration and decision.

Article 16. Settlement of State Budget Funds for Support

Ministries, central agencies, and localities shall allocate funds to agencies and units, noting specifically the funds allocated for emergency response to incidents and ensuring cybersecurity according to Decision No. 05/2017/QĐ-TTg and the funds for implementing projects on emergency response to incidents and ensuring cybersecurity approved by the Prime Minister.

3. Using, accounting, and settling accounts for funds:

a) The use of funds for emergency response to incidents and ensuring cybersecurity shall be carried out in accordance with the State Budget Law, guiding documents, and the provisions of this Circular;

b) The accounting of funds spent on emergency response to incidents and ensuring cybersecurity shall be conducted in accordance with the accounting system for administrative and public institutions and the national budget classification system;

c) The settlement of accounts for funds spent on emergency response to incidents and ensuring cybersecurity shall be carried out in accordance with the Accounting Law and guiding documents, including Circular No. 137/2017/TT-BTC dated December 25, 2017, issued by the Ministry of Finance regarding the examination, review, notification, and consolidation of annual settlements.

Article 8. Implementation clause

1. This Circular takes effect from February 1, 2019.

2. During its implementation, if the regulatory documents cited for application in this Circular are amended, supplemented, or replaced by new documents, then the new documents shall apply.

3. The allowance system for cadres, civil servants, public officials, and workers at agencies and units specified in this Circular shall be implemented until the end of 2020. From 2021 onwards, it shall be implemented according to the general salary system as stipulated in Resolution No. 27-NQ/TW dated May 21, 2018, of the Seventh Plenary Session of the Central Committee of the Communist Party of Vietnam's Twelfth Congress on reforming salary policies for cadres, civil servants, public officials, armed forces, and workers in enterprises.

4. During its implementation, if there are difficulties, ministries and localities are requested to report to the Ministry of Finance for research and resolution.