Circular No. 17/2014/TT-BTTTT on the reporting regime for digital signature certification activities

CIRCULAR

Article 24Prescribes the reporting regime for digital signature certification activities

_________________

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Law on Electronic Transactions regarding digital signatures and digital signature certification services, Decree No. 106/2011/NĐ-CP dated November 23, 2011, and Decree No. 170/2013/NĐ-CP dated November 13, 2013;

Based on Decree No. 132/2013/ND-CP dated October 16, 2013 of the Government on the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications;

Considering the proposal of the Director of the National Information Security Center and the Director of the National Electronic Certification Center,

The Minister of Information and Communications issues this Circular prescribing the reporting regime for digital signature certification activities.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular prescribes the reporting regime for digital signature certification activities.

Article 2. Applicability

This Circular applies to organizations providing public digital signature certification services, organizations providing specialized digital signature certification services, foreign organizations providing digital signature certification services that have been granted recognition certificates, and subscribers using foreign digital certificates accepted in Vietnam (hereinafter referred to as reporting organizations).

Article 3. Reporting on digital signature certification activities

1. Reporting methods include written reports or email submissions. Email reports must be signed with a digital signature from the legal representative of the reporting organization. The digital signature must be valid and comply with legal requirements.

2. The content of the report must conform to the forms set out in Appendices I, II, and III attached to this Circular.

Article 4. Address for receiving reports

1. Written reports should be sent to: Ministry of Information and Communications (National Electronic Certification Center), 18 Nguyen Du Street, Hanoi.

2. Email reports should be sent to: [email protected].

Chapter II

REPORTING SYSTEM

Article 5. Periodic reporting

Organizations providing public digital signature certification services, organizations providing specialized digital signature certification services, and foreign organizations providing digital signature certification services shall implement periodic reporting as follows:

1. Quarterly and annual reports shall be submitted according to the form at Appendix I.

2. A quarter is calculated from the first day of the first month to the last day of the third month of the quarter. An annual report is calculated from January 1 to December 31 of the reporting year.

3. The deadline for submitting periodic reports is within the first ten (10) working days of the subsequent period.

Article 6. Emergency Reports

1. Organizations providing public digital signature certification services, organizations providing specialized digital signature certification services, and foreign organizations providing digital signature certification services shall submit ad hoc reports according to the form at Appendix II when any of the following situations occur:

a) Changes in the legal representative; personnel responsible for system management and operation, issuance of digital certificates; address; contact information of the organization; changes in technical features of the certificate issuance system affecting the security conditions for digital signatures.

b) Changes in technical features of the certificate issuance system affecting the security conditions for digital signatures;

c) Temporary suspension of new certificate issuance;

d) When a key is exposed; the certificate issuance system is breached; the certificate issuance system cannot operate; in case of other technical incidents.

2. Subscribers using foreign digital certificates accepted in Vietnam shall submit ad hoc reports according to the form at Appendix III when any of the following situations occur:

a) Exposure of the secret key;

b) Discovery of fraudulent activity;

c) Loss or damage of the storage device for the secret key.

3. Deadline for submission of ad hoc reports: Not later than three (3) working days from the date of occurrence or discovery of the ad hoc situation.

Article 7. Responsibilities of the Reporting Organization

The reporting organization shall be responsible for complying with the reporting regime regarding deadlines, content, and format as prescribed and shall bear full responsibility for the accuracy, completeness, and truthfulness of the reported content.

Chapter III

IMPLEMENTATION

Article 8. Responsibilities of Relevant Authorities

1. The National Electronic Certification Center shall be responsible for:

a) Monitoring, inspecting, urging, and guiding the implementation of reports;

b) Updating, storing, and using report information in accordance with the provisions of the law;

c) Providing information to serve the management of the Ministry of Information and Communications and related functional units on cybersecurity;

d) Reporting to the Minister of Information and Communications on activities related to digital signature certification.

2. The Cybersecurity Agency shall be responsible for: Taking the lead and coordinating with the Inspectorate of the Ministry in handling violations related to the implementation of reports as prescribed by law.

3. The Inspectorate of the Ministry shall be responsible for: Taking the lead in handling violations related to the implementation of reports as prescribed by law.

Article 9. Effective Date

1. This Circular takes effect from January 10, 2015, and replaces Decision No. 58/2008/QD-BTTTT dated December 30, 2008, issued by the Minister of Information and Communications on the issuance of the Regulation on Reporting Information on Digital Signature Certification Activities of Service Providers.

2. The Head of the Ministry's Office, the Head of the Inspectorate of the Ministry, the Director of the Cybersecurity Agency, the Director of the National Electronic Certification Center, and related organizations and individuals shall be responsible for implementing this Circular.

3. In the course of implementation, if there are difficulties or obstacles, organizations and individuals shall reflect them to the Ministry of Information and Communications (National Electronic Certification Center) for consideration and resolution./.