Circular No. 20/2017/TT-BTTTT on the coordination and emergency response to cybersecurity incidents nationwide

 

CIRCULAR

Regulations on coordination and emergency response to information security incidents nationwide

national cybersecurity 

||| Pursuant to the Cybersecurity Law dated November 19, 2015;

Pursuant to Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring information system security at different levels; on ensuring the security of information systems by level;

Pursuant to Decree No. 17/2017/NĐ-CP dated February 17, 2017 of the Government; The Minister of Information and Communications issues this Circular detailing the implementation of certain provisions of the Law on Competition and Rewards in the Information and Communications Sector.

Pursuant to Decision No. 05/2017/QĐ-TTg dated March 16, 2017 of the Prime Minister on the national information security emergency response plan system;

At the proposal of the Director of the Vietnam Computer Emergency Response Team (VNCERT);

The Minister of Information and Communications issues this Circular on coordination and emergency response to information security incidents nationwide.

PART I

GENERAL PROVISIONS 

Article 1. Scope and Applicability

Article 1. This Circular stipulates activities related to coordination and emergency response to information security incidents nationwide (excluding activities related to coordination and emergency response to serious information security incidents as prescribed in Decision No. 05/2017/QĐ-TTg dated March 16, 2017 of the Prime Minister on the national information security emergency response plan system (hereinafter referred to as Decision No. 05/2017/QĐ-TTg)).

Information security incidents involving systems managed by the Ministry of National Defense and the Ministry of Public Security are not within the scope of this Circular.

The subjects to which this Circular applies are agencies, organizations, and individuals involved in coordination and emergency response to information security incidents.

Article 2. Interpretation of Terms

1Information security incident means an attack or harm that affects the integrity, confidentiality, or availability of information or information systems (hereinafter referred to as incident).

2Emergency response to information security incidents refers to activities aimed at handling and mitigating information security incidents, including monitoring, collecting, analyzing, detecting, warning, investigating, verifying incidents, preventing incidents, restoring data, and restoring normal operation of information systems.

3. Emergency response point of contact is a department or individual appointed by members of the national information security emergency response network to represent them in communication and exchange of information with the National Coordination Agency for emergency response or other members during coordination and emergency response activities.

Article 3. Classification of organization and implementation of emergency response to ensure information security nationwide

The classification of organization and implementation of emergency response to ensure information security nationwide includes agencies, organizations, and units implementing national information security emergency response as prescribed in Decision No. 05/2017/QĐ-TTg. Agencies and organizations participating in coordination and emergency response activities nationwide include:

1. The Ministry of Information and Communications - the Standing Office for national information security emergency response (shortened as the Standing Office) and the National Coordination Committee for emergency response (shortened as the National Coordination Committee); the Vietnam Computer Emergency Response Team (VNCERT) - the National Coordination Agency for emergency response (shortened as the National Coordination Agency).

2. The Emergency Response Steering Committee of Ministries, ministerial-level agencies, government agencies, and provincial People's Committees under the central government (shortened as the Emergency Response Steering Committee at the ministry/provincial level).

3. Specialized units for emergency response to information security incidents (shortened as Specialized Units for Emergency Response); Emergency Response Teams or emergency response departments at Ministries, ministerial-level agencies, government agencies, and provincial People's Committees under the central government (shortened as Emergency Response Teams/Departments).

4. The National Emergency Response Network (shortened as the Emergency Response Network); and the Network Management Board.

5. System administrators; system operation units; and agencies, organizations, and specialized units designated or summoned by the Standing Office, the National Coordination Agency, or the Emergency Response Steering Committee at the ministry/provincial level to participate in emergency response.

Article 4. Principles for Coordination and Emergency Response

1.  Comply with legal regulations on coordination and emergency response for cybersecurity.

2.  Proactive, timely, swift, accurate, synchronized, and effective.

3.  Close cooperation, accuracy, synchronization, and effectiveness among domestic and foreign agencies, organizations, and enterprises.

4.  Emergency response must first be carried out and handled by local forces and the primary responsibility of the system administrators.

5.  Comply with conditions and priority principles for maintaining the operation of information systems approved by competent authorities in emergency response plans.

6.  Information exchanged within the network must be verified before proceeding with subsequent operational steps.

7.  Ensure confidentiality of information obtained when participating in and implementing emergency response activities according to the requirements of the National Coordination Agency or affected agencies, organizations, or individuals. 

Chapter II

EMERGENCY RESPONSE NETWORK 

Article 5. Emergency Response Network

1. The emergency response network operates nationwide, comprising specialized units for emergency response and relevant agencies, organizations, and enterprises detailed in Article 7 of Decision No. 05/2017/QĐ-TTg.

2. The emergency response network operates under the Operational Regulations of the Network and related guidance from the National Coordination Agency (Vietnam Computer Emergency Response Team). The Network Management Board is established by the Ministry of Information and Communications as stipulated in Article 7 of Decision No. 05/2017/QĐ-TTg.

3. Network members report their profiles using Form No. 01 issued together with this Circular, updating annually and submitting to the National Coordination Agency. Organizations, businesses, and individuals voluntarily registering to join the network must submit a registration form using Form No. 02 and send it to the National Coordination Agency.

Article 6. Responsibilities and Authorities of Network Members

1. Network members have the following responsibilities and authorities:

a) Implement responsibilities and authorities as prescribed in Decision No. 05/2017/QĐ-TTg;

b) Appoint a competent point of contact for emergency response with sufficient expertise and skills to carry out coordinated emergency response activities; ensure continuous communication 24/7; publish information about the incident reception address on the website; provide and update information about the point of contact, technical personnel, and emergency response staff within their management scope to the National Coordination Agency; update information about the point of contact within 24 hours of any changes;

c) Compile and prepare semi-annual reports (before June 20th) and annual reports (before December 15th) using Form No. 05 and submit them to the National Coordination Agency; submit ad hoc reports when required by the National Coordination Agency;

d) Report to the National Coordination Agency upon receiving information or discovering incidents affecting information systems within their management scope;

đ) Develop and implement emergency response plans, guide emergency response activities, organize and manage the operations of emergency response teams within their management scope;

e) Have the right to request other network members to provide guidance, support, and assistance in handling and responding to incidents when necessary; participate in seminars, meetings, training sessions, and other activities within the network;

g) Have the right to share information, experiences, and warnings about incidents and cybersecurity situations both domestically and internationally;

h) Network members that are functional agencies under the Ministry of Public Security and the Ministry of Defense are exempt from Points c and d of this Clause.

2. Responsibilities and Authorities of the National Coordination Agency:

a) Implement responsibilities and authorities as prescribed in Decision No. 05/2017/QĐ-TTg;

b) Publish its telephone number, fax number, email address, and hotlines on its website, ensuring resources to maintain uninterrupted hotline service for prompt receipt and handling of incidents; compile contact information (addresses, phone numbers, fax numbers, email addresses) and information about points of contact, technical personnel, and emergency response staff of network members and emergency response teams;

c) Develop, implement, and operate the network's portal, technical systems supporting communication and information exchange within the network, and technical systems serving coordination, emergency response, handling, and resolution of incidents;

d) Guide national reporting and inquiry procedures for cybersecurity incidents; manage the network; research and propose measures to enhance resources for effective network operations;

đ) Collect, receive, process, and prepare information and warnings for authorized persons and relevant agencies, organizations, and units regarding cybersecurity risks, incidents, and preventive, blocking, and handling measures;

e) Organize seminars, meetings, disseminate, exchange information, train, educate, and conduct exercises on cybersecurity and emergency response; organize joint activities of the network.

Article 7. Main activities of the emergency response network

The management board organizes the implementation of the tasks of the emergency response network, including the following main activities:

1. Researching, collecting, receiving, analyzing, verifying, evaluating, and warning about incidents, information security risks, and malicious software.

2. Coordinating to implement emergency response, handling, preventing, and rectifying incidents; inspecting and urging the development and implementation of plans for responding to information security incidents and the fulfillment of responsibilities and obligations by network members.

3. Building and enhancing the capacity of network members and emergency response teams, including:

a) Training, simulation, education, and advanced instruction to improve expertise, skills, and duties; organizing domestic and international missions to survey, learn experiences, exchange, and cooperate.

b) Holding regular meetings, organizing seminars, conferences, and roundtable discussions to exchange and share information and experiences on coordination, incident response, and ensuring information security.

c) Supporting the establishment and application of management and operation procedures for information systems according to national standards, technical regulations, and international standards on information security and incident response.

d) Organizing specialized research, compiling reports, materials, guidelines, and statistics on information security and related issues to share and disseminate within the network.

4. Participating in information dissemination and promotional activities to raise awareness about prevention, emergency response, and ensuring information security.

5. Organizing and maintaining the operations of the network management board; and implementing other activities related to coordination, emergency response, and ensuring information security.

Chapter III

COORDINATION AND EMERGENCY RESPONSE ACTIVITIES

Article 8. Coordination and emergency response activities

1. Coordination of emergency response is the activity of the National Coordination Agency and authorized agencies aimed at mobilizing, directing, and coordinating unified resources including: human resources, material resources (equipment), financial resources (finance, budget) to prevent, monitor, collect, detect, warn about incidents; receive, analyze, verify, classify incidents; direct, coordinate, organize emergency response, readiness, and response to incidents to mitigate risks and losses caused by incidents.

2. The National Coordination Agency performs the function of warning and coordinating emergency response nationwide; has the authority to mobilize and coordinate network members and related organizations and units to jointly prevent, handle, and rectify incidents nationwide; promulgates and is responsible for dispatches/directives for coordination according to Model No. 06 issued together with this Circular.

3. Operations of coordination and emergency response activities:

a) Monitoring, analyzing, detecting, warning about threats, vulnerabilities, incidents, cyber attacks, and preventive solutions.

b) Developing and proposing response plans and strategies for incidents.

c) Organizing training and simulations for emergency response and ensuring information security.

d) Directing and mobilizing resources for emergency response within the scope of authority; providing technical support and implementing measures to counteract and prevent cyber attacks.

đ) Investigating, analyzing, determining the origin, method, and approach of attacks to counteract, prevent, while warning and guiding to prevent widespread incident spread; collecting and building comprehensive incident reports.

e) Sharing, exchanging, and providing information between relevant agencies and organizations regarding emergency response, coordination activities, and incident handling processes.

g) Other activities related to emergency response as decided by the Ministry of Information and Communications.

4. Forms of information exchange for coordination and emergency response are conducted through one or more methods such as: Official letters, emails, telephone, fax, multimedia messaging, or advanced communication technology systems; and ensuring compliance with relevant laws when exchanging confidential information.

Article 9. Notification and Reporting of Cybersecurity Incidents

1. Forms of Notification and Reporting of Incidents

a) Form of Incident Notification: By letter, fax, email, multi-party messaging, or through the technical system for reporting cybersecurity incidents as guided by the National Coordination Agency;

b) Form of Incident Report: In paper form or electronic form (signed and stamped or digitally signed by the authorized person).

2. Reporting of Cybersecurity Incidents

a) Units and individuals operating information systems shall notify the incident information within five days from the time of discovery to the following authorities and units simultaneously: The management body of the information system, the National Coordination Agency, the specialized unit responsible for incident response, and relevant members of the incident response network (if applicable). At the time of reporting, if the incident has not been resolved, the unit or individual operating the system must update the incident information to the previously notified authorities and units immediately upon completion of the resolution process;

b) In cases where units and individuals operating information systems determine that the incident exceeds their capacity to handle, they must immediately prepare an Initial Incident Report, report it to the management body of the information system, the specialized unit responsible for incident response (if applicable), and the National Coordination Agency; after completing the incident response, they must complete the Final Incident Response Report within five days and report it to the management body of the information system and the National Coordination Agency. The National Coordination Agency will only recognize the completion of the incident response after receiving the Final Incident Response Report;

c) Organizations and individuals who are not units or individuals operating information systems, when discovering signs of attack or cybersecurity incidents, must promptly notify the incident information to one or more of the following authorities and units simultaneously: The unit or individual operating the information system, the management body of the information system, the National Coordination Agency, the specialized unit responsible for incident response, or relevant members of the incident response network;

3. Types of Notifications and Reports of Incidents:

a) Incident Notification, contents include: Name and address of the unit or individual notifying the incident; name or domain name, IP address of the affected information system; name and address of the unit or individual operating and the management body of the affected information system (if known); description of the incident and the time of discovery; results of incident handling, recommendations, suggestions, and other related information (if applicable);

b) Initial Incident Report, contents according to Form No. 03 of Appendix I issued together with this Circular;

c) Situation Report;

d) Specific Response Plan Report;

đ) Request for Support and Cooperation Report;

e) Final Incident Response Report, contents according to Form No. 04 of Appendix I issued together with this Circular.

4. During the incident response process, units and individuals operating the system must take the lead and coordinate with relevant authorities and units to establish and maintain implementation of incident response reports as prescribed and required by competent authorities.

Article 10. Detection, organize credit institutions, foreign bank branches are responsible for organizing the implementation of this Circular.Reception, to verify, Initial Handling and Classification of Cybersecurity Incidents 1. Units and individuals operating information systems have the responsibility:

a) Upon detecting an incident: Organize monitoring, recording, and collecting information related to the incident and organize notification or reporting of the incident as prescribed in Article 9 of this Circular;

b) Upon receiving an incident notification: Immediately respond to the organization or individual sending the incident notification to confirm the information;

c) Verify the incident and conduct initial handling: Take the lead and coordinate with the unit responsible for ensuring information security (if applicable), the specialized unit responsible for incident response, and telecommunications and Internet service providers (ISP) to analyze, verify, and assess the incident; immediately implement initial incident response activities, deploy the incident response procedure according to the approved cybersecurity incident response plan or the procedure stipulated in Article 11 of this Circular; in cases where the incident may be a serious incident, report immediately to the management body of the information system, the specialized unit responsible for incident response, and send to the National Coordination Agency;

2. Specialized units responsible for incident response or members of the incident response network have the responsibility:

a) Upon detecting an incident: Immediately notify the incident to the unit or individual operating the information system, the management body of the information system, and the National Coordination Agency;

b) Upon receiving an incident notification or report: Record and accept according to regulations and immediately respond to the organization or individual sending the incident notification or report to confirm the information;

c) Organize verification and handling of the incident: Coordinate with the unit or individual operating the information system to review, verify, and handle the incident within their capability and responsibility; in cases where the incident may exceed their handling capacity or may be a serious incident, report immediately to the management body of the information system and the National Coordination Agency;

d) Monitor the situation of incident response and report or propose, seek guidance from the management body of the information system and the Central or Provincial Incident Response Steering Committee when exceeding their authority, scope of responsibility, or handling capacity;

đ) Summarize and report to the National Coordination Agency on the development of the incident when requested.

3. The National Coordination Agency has the responsibility:

a) To record and accept notifications and reports of cybersecurity incidents according to the correct procedures;

b) To immediately respond to the organization or individual sending the notification or report to confirm the information after receiving it.

b) Respond to organizations and individuals who have sent notifications or reports of incidents immediately upon receipt to confirm the information;

c) Review, verify, and classify incidents to issue warnings, coordinate the selection of response options, organize rescue operations, and report, proposing to the Standing Agency for consideration and decision on serious incidents and appropriate emergency response plans. In cases classified as serious incidents, the National Coordination Agency will lead and cooperate with relevant agencies to implement steps according to the process for responding to serious incidents as stipulated in Decision No. 05/2017/QĐ-TTg.

d) Organize cooperative activities with international organizations for incident response to receive early warnings, information about incidents, cyber security risks, and to coordinate in responding to cross-border attacks.

đ) Perform other responsibilities of the National Coordination Agency; report and propose to the Standing Agency for issues exceeding their authority.

Article 11. Process for Responding to Cybersecurity Incidents

The process for responding to cybersecurity incidents follows the diagram in Appendix II, specifically including:

1. Receiving, analyzing, initial response, and reporting incidents

a) Receiving and verifying incidents

Lead unit: Information system operation units or individuals.

Supporting units: Incident response specialized units, National Coordination Agency.

Content: Monitor, receive, analyze early warning signs and incident indicators from internal and external sources. Upon analysis and verification of an incident, record, collect evidence, and determine the source of the incident.

b) Implement initial priority response steps

Lead unit: Information system operation units or individuals.

Supporting units: Incident response specialized units, related network members, National Coordination Agency.

Content: After confirming the occurrence of an incident, the information system operation units or individuals will organize the implementation of initial priority steps to address the incident based on the approved contingency plan or guidance from the specialized incident response unit or the National Coordination Agency.

c) Select response options

Lead unit: Information system operation units or individuals.

Supporting units: Incident response specialized units, related network members, National Coordination Agency.

Content: Based on the approved contingency plan or guidance from the specialized incident response unit or the National Coordination Agency, select measures to prevent and handle the incident; report and propose to the System Management Authority, the Provincial/Central Level Emergency Response Steering Committee for instructions if necessary.

d) Direct handling of the incident (if necessary)

Lead unit: Provincial/Central Level Emergency Response Steering Committee.

Supporting unit: System Management Authority.

Content: Based on reports and proposals from the information system operation units or individuals, the Provincial/Central Level Emergency Response Steering Committee will collaborate with the System Management Authority and consult the National Coordination Agency (if necessary) to direct the specialized incident response unit to mobilize the Incident Response Team/Department within their jurisdiction to carry out rescue and handling operations; direct public relations activities and information provision. During the response, depending on the actual situation, the Provincial/Central Level Emergency Response Steering Committee may decide to supplement team members and adjust the incident response plan.

đ) Report the incident

Lead unit: Information system operation units or individuals.

Supporting units: Related specialized incident response units responsible, telecommunications/internet service providers (ISP).

Content: After implementing initial priority response steps, the information system operation units will organize the notification and reporting of the incident to relevant organizations and individuals inside and outside the organization according to Article 9 of this Circular and internal regulations (if applicable).

e) Coordinate response operations

Lead unit: Provincial/Central Level Emergency Response Steering Committee; National Coordination Agency.

Supporting units: Information system operation units or individuals, specialized incident response units, related network members.

Content: Based on the nature of the incident and support requests from the information system operation units or individuals and specialized incident response units, the Provincial/Central Level Emergency Response Steering Committee and the National Coordination Agency will coordinate, supervise cooperation mechanisms, and share information within their scope of functions to mobilize resources for incident response.

2. Implement response, prevention, and handling of incidents

Lead unit: Information system operation units or individuals; Incident Response Team/Department.

Supporting units: Units responsible for ensuring information security for affected systems, specialized incident response units, related network members, National Coordination Agency.

Content:

a) Collect evidence, analyze, and determine the scope and affected objects.

b) Analyze and determine the origin of the attack, organize response and prevention, minimize impact and damage to the information system.

3. Handle incidents, remove, and restore

a) Handle incidents, removal

Lead unit: Information system operation units or individuals; Incident Response Team/Department.

Supporting units: Units responsible for ensuring information security for affected systems; specialized incident response units, related network members, National Coordination Agency.

Content: After implementing preventive measures, the information system operation units or individuals, specialized incident response units, and Incident Response Team/Department will eliminate and remove malicious codes, harmful software, and fix information security vulnerabilities in the information system.

b) Restore

Lead unit: Information system operation units or individuals.

Supporting units: Incident Response Team/Department, units responsible for ensuring information security for affected systems, specialized incident response units, related network members, National Coordination Agency.

Content: The information system operation units or individuals will lead and collaborate with related units to implement restoration activities for the information system, data, and connections; configure secure systems; supplement security equipment, hardware, and software for the information system.

c) Inspect and evaluate the information system

Lead unit: Information system operation units or individuals.

Coordinating units: The unit responsible for ensuring information security for the affected system, the specialized unit for incident response, the management body of the information system, the National Coordination Agency.

Content to be implemented: The unit and individual operating the system, along with related units, shall carry out inspections and evaluations of the entire operation of the information system after the incident has been resolved. In cases where the system has not yet stabilized, it is necessary to continue organizing the collection and verification of the cause, and to implement the corresponding steps under Clause 2 and Clause 3 of this Article to thoroughly resolve the issue and restore normal operations of the information system.

4. Summary and evaluation

Lead unit: Information system operation units or individuals.

Coordinating units: The specialized unit for incident response; the incident response team/unit; the management body of the information system; the Ministry-level and provincial Incident Response Steering Committee; the National Coordination Agency.

Content to be implemented: The unit and individual operating the affected system shall cooperate with the specialized unit for incident response and the incident response team/unit to compile all relevant information, reports, and analyses regarding the incident, the implementation of the incident response plan, and report to the management body of the information system, the Ministry-level and provincial Incident Response Steering Committee, and the National Coordination Agency; organize the analysis of the cause, draw lessons from the incident handling activities, and propose additional measures to prevent and respond to similar incidents in the future.

Chapter IV

MEASURES TO ENSURE IMPLEMENTATION

INCIDENT RESPONSE FOR INFORMATION SECURITY OF NETWORKS

Article 12. Development and Implementation of Emergency Response Plans for Ensuring Information Security of Networks

1. Agencies, organizations, and enterprises shall develop and implement emergency response plans for ensuring information security of networks for their respective agencies, organizations, and enterprises, including:

a) For systems that have been approved at Level 04, Level 05, or are included in the List of Important National Information Systems, according to the Draft Plan for Responding to Information Security Incidents specified in Article 16 of Decision No. 05/2017/QĐ-TTg;

b) For systems not covered by Point a of Clause 1 of this Article, according to Appendix III attached to this Circular.

2. System management bodies and agencies or units authorized to approve emergency response plans must determine conditions and priority principles to maintain the operation of the information system during incident response and consider this as a mandatory requirement in the emergency response plan.

3. The National Coordination Agency shall guide the development and implementation of emergency response plans, backup response, and incident handling for information security of networks; organize training and drills regionally, nationally, and internationally; develop plans and organize regular inspections and evaluations on the implementation of emergency response plans for information security of networks by ministries, sectors, localities, and organizations and enterprises.

Article 13. Funding

Funding for coordinating and responding to information security incidents across the country shall be carried out in accordance with Article 17 of Decision No. 05/2017/QĐ-TTg and related guiding documents.

Chapter V

IMPLEMENTATION

Article 14. Effectiveness

1. This Circular takes effect from November 1, 2017, and replaces Circular No. 27/2011/TT-BTTTT dated October 4, 2011, issued by the Ministry of Information and Communications on coordinating activities to respond to internet network incidents in Vietnam.

2. During the implementation process, if there are any difficulties or issues arising, the relevant organizations and individuals should promptly reflect them to the Ministry of Information and Communications (through the Vietnam Computer Emergency Response Team Center) for consideration, supplementation, and amendment./.

 

THE MINISTER

(Signed)

 

TRUONG MINH TUN