Decision No. 226/1999/QĐ-TTg on the responsibilities of agencies, units, and individuals in preventing, handling, and mitigating computer incidents in the year 2000

 

Pursuant to …;

Regulations on the responsibilities of agencies, units, and individuals in preventing, handling, and mitigating computer year 2000 incidents

To enhance the responsibility of agencies, units, and individuals in preventing, handling, and mitigating computer year 2000 incidents;

------------------------

PRIME MINISTER

Pursuant to the Government Organization Law dated September 30, 1992;

At the proposal of the Minister of Science, Technology, and Environment, Head of the Government Year 2000 Incident Mitigation Steering Committee,

Preventing, handling, and mitigating computer year 2000 incidents is the responsibility of all agencies, units, and individuals using information technology.

DECISION:

Article 1. The Government Year 2000 Incident Mitigation Steering Committee has the responsibility:

Article 2. 1. To guide and coordinate the activities of prevention, handling, and mitigation of the impact of computer year 2000 incidents of ministries, ministerial-level agencies, government-affiliated agencies, provincial people's committees, and related units;

2. To report to the Prime Minister on the overall situation and potential impact of computer year 2000 incidents in Vietnam;

3. To direct, study, disseminate, and guide the implementation of measures for prevention, handling, and mitigation of the impact of computer year 2000 incidents; to seek international assistance and cooperation in prevention, handling, and mitigation of computer year 2000 incidents;

4. To assign staff to work 24/24 hours during days when incidents may occur; to control information about the development of incidents and promptly direct agencies and units where incidents occur to implement contingency plans and promptly report to the Prime Minister.

Ministers of ministries, heads of ministerial-level agencies, government-affiliated agencies, and local people's committees at all levels and relevant units have the responsibility to guide, urge, and inspect their subordinate agencies and units to implement measures for prevention, handling, and mitigation of the impact of computer year 2000 incidents.

Article 3. When implementing measures for prevention, handling, and mitigation of computer year 2000 incidents, agencies and units must follow the general procedures of the National Action Plan issued together with Decision No. 1372/1999/QĐ-BKHCNMT dated July 24, 1999, of the Minister of Science, Technology, and Environment, specifically including the following contents:

Article 4. 1. Enhancing awareness of computer year 2000 incidents;

2. Inventorying information equipment;

3. Developing a mitigation plan;

4. Implementing mitigation;

5. Post-mitigation inspection;

6. Installation;

7. Developing a contingency plan.

When implementing measures for prevention, handling, and mitigation of computer year 2000 incidents, heads of agencies and units have the responsibility:

Article 5. 1. To organize, urge, and inspect the implementation of government regulations, directives of the Prime Minister, and guidelines of the Ministry of Science, Technology, and Environment and the Government Year 2000 Incident Mitigation Steering Committee regarding prevention, handling, and mitigation of computer year 2000 incidents;

2. To ensure reasonable and effective funding from allocated sources for prevention, handling, and mitigation of computer year 2000 incidents; prioritizing funding for critical equipment and applications that could cause significant impact and damage if they stop functioning or malfunction;

3. To develop a contingency plan according to the provisions in Directive No. 224/BCĐ-SC 2000 dated August 20, 1999, of the Government Year 2000 Incident Mitigation Steering Committee; organizing appropriate responses based on specific requirements of each agency or unit, including IT experts, financial experts, and other relevant experts, to be ready to support areas where incidents occur.

In addition to the responsibilities stipulated in Article 5 of this Decision, key agencies and units providing public services have the responsibility:

Article 6. 1. To provide information on the results of mitigating computer year 2000 incidents to requesting agencies, organizations, and units;

2. To announce the preparedness level and degree of "Year 2000 readiness" of their agencies and units through mass media.

Heads of agencies and units have the responsibility:

Article 7. 1. To organize, direct, and inspect the implementation of the process for mitigating computer year 2000 incidents;

2. To directly confirm, according to the hierarchy, the implementation of the process for mitigating computer year 2000 incidents for computers, network and communication devices, computer system support devices, software, and embedded systems as prescribed in Decision No. 1903/1999/QĐ-BKHCNMT dated October 27, 1999, of the Minister of Science, Technology, and Environment;

3. To organize and direct the testing of contingency plans; to take corrective actions to ensure continuous operation of the agency or unit and minimize losses;

4. To ensure the degree of "Year 2000 readiness" within their management scope;

5. To report fully, accurately, and on time to competent authorities on the content, progress of preventive, handling, and mitigation activities for computer year 2000 incidents; compatibility levels, and the degree of "Year 2000 readiness" in their agencies and units.

1. The Government Year 2000 Incident Mitigation Steering Committee shall establish a permanent working group to operate 24/24 hours on December 31, 1999; January 1, 2, and 3, 2000; February 28 and 29, 2000; and March 1, 2000, to direct and coordinate mitigation activities for computer year 2000 incidents, implement the national contingency plan if necessary, and promptly report to the Prime Minister on related issues;

Article 8.

2. On December 31, 1999; January 1, 2, and 3, 2000; February 28 and 29, 2000; and March 1, 2000, heads of agencies and units, and heads of the Year 2000 Incident Mitigation Steering Committees of agencies and units must arrange staff to work 24/24 hours daily. Agencies and units must establish a "hotline" to promptly direct handling and report to the Government Year 2000 Incident Mitigation Steering Committee.

2. On December 31, 1999; January 1, 2, 3, 2000; February 28, 29, 2000; and March 1, 2000, the Heads of agencies and units, and the Leaders of the 2000 Emergency Response Steering Committee of each agency and unit must arrange for staff to be on duty at the office 24 hours a day. Agencies and units must establish a "hotline" to promptly direct the handling and report to the Government's 2000 Emergency Response Steering Committee.

3. The Head of the Steering Committee for Remedying Incidents in 2000, heads of agencies and units must specify the specific tasks of each person in the standing team, communication methods, and reporting procedures; notify the emergency hotline number to the General Post Office Corporation and the Postal Telecommunications Corporation or local post offices, and at the same time define communication methods in case the telephone network is affected by incidents;

4. The General Post Office Corporation, the Postal Telecommunications Corporation, and provincial and municipal post offices have the responsibility to ensure continuous operation of the emergency hotlines of agencies, units, and the Steering Committee for Remedying Incidents in 2000.

Article 9. When a computer incident occurs in 2000, the agency or unit where the incident occurs must implement the following specific activities:

1. Quickly implement the contingency plan; take measures to ensure the minimum operation of information technology equipment and minimize damage caused by the incident; find optimal solutions to remedy the incident in the shortest time possible; promptly inform relevant partners about the incident to prevent its widespread impact; report to the immediate superior about the incident, as well as the measures taken and the contingency plans applied;

2. Agencies and units need to cooperate and support each other to quickly implement the contingency plan, find solutions to remedy the incident.

Article 10. Upon receiving information about a computer incident occurring in 2000 at each agency or unit, the immediate superior has the responsibility to send experts to the location of the incident to direct remediation efforts and report to the Steering Committee for Remedying Incidents in 2000 of the Ministry, sector, or locality to compile reports for the Government's Steering Committee for Remedying Incidents in 2000; coordinate with related agencies and units to mobilize forces to support remediation efforts.

For serious incidents, the Government's Steering Committee for Remedying Incidents in 2000 must promptly report to the Prime Minister.

Article 11.

1. Heads of agencies and units who fail to fulfill their responsibilities or intentionally violate regulations, leading to a computer incident in 2000, may be subject to disciplinary action or criminal liability according to the law depending on the nature and degree of violation of preventive, handling, and remediation regulations for computer incidents in 2000 and the extent of the consequences caused;

2. Individuals who lack responsibility or intentionally violate regulations on prevention, handling, and remediation of computer incidents in 2000 may be subject to administrative penalties or criminal liability according to the law depending on the nature and degree of violation and the extent of the consequences caused;

3. Agencies, units, and individuals who do not comply with regulations on prevention, handling, and remediation of computer incidents in 2000, or who take advantage of such incidents for improper business activities and profit, causing damage to other agencies, units, or individuals, in addition to being handled according to the provisions of Clauses 1 and 2 of this Article, must also compensate for damages according to the law;

Article 12.

1. Agencies, units, and individuals suffering losses due to computer incidents in 2000 have the right to request compensation from equipment, software, and service providers according to the law;

2. In cases where multiple parties are at fault in causing a computer incident in 2000 that results in damage to one party, those parties must jointly compensate the damaged party according to the degree of fault of each party as stipulated by the law. Parties causing damage are only responsible for compensating within the scope corresponding to their degree of fault;

3. In cases where the degree of fault cannot be determined, parties causing damage must compensate for losses equally.

Article 13.

1. The party suffering losses due to a computer incident in 2000 can only claim compensation for direct losses and must have sufficient evidence; they cannot claim compensation if the loss is entirely caused by their own fault;

2. The party being claimed for compensation has the right to prove that the losses suffered by the damaged party could have been avoided to exclude such losses from the amount to be compensated.

Article 14.

1. Agencies, units, and individuals may be exempted or have their compensation liability reduced if they strictly follow the regulations and guidelines on procedures for preventing, handling, and remedying computer incidents in 2000, and when the incident occurs, they mobilize all available financial, human, and technical resources to remedy it but the loss still occurs;

2. Encourage parties to negotiate and mediate among themselves to clarify the causes, responsibilities of each party, and the extent of the damage to resolve the interests of the State and related parties satisfactorily;

3. Parties shall not take advantage of mediation principles to handle issues related to their own interests while harming the interests of the State and society.

Article 15. Disputes related to claims for compensation for losses caused by computer incidents in 2000 shall be resolved as follows:

1. The party suffering losses must submit a written request for compensation to the direct provider of equipment, software, or services. Within thirty days from the date of receipt of the request, the direct provider of equipment, software, or services must respond in writing with a detailed plan to address the aftermath of the incident.

Within sixty days from the date the party suffering losses receives the response, the direct provider of equipment, software, or services must implement the plan to address the aftermath caused by the computer incident in 2000.

2. If the remediation measures implemented by the direct provider of equipment, software, or services do not yield results, the party suffering losses has the right to lodge a complaint or request the competent court to resolve the matter.

3. The provisions of this Decision do not apply to cases where a computer incident in 2000 causes damage to the health or lives of individuals.

Article 16. It is strictly prohibited to take advantage of computer incidents in 2000 for personal gain or improper business activities that cause damage to the interests of the State, units, and individuals.

Article 17. This Decision takes effect from the date of signature. The Head of the Crisis Management Steering Committee for 2000, Ministers of Ministries, Heads of ministerial-level agencies, Heads of government agencies, Chairpersons of provincial and centrally governed city People's Committees, and related agencies and units shall be responsible for implementing this Decision.