Circular No. 23/2011/TT-BTTTT on the management, operation, use, and ensuring information security on specialized data transmission networks for Party and State agencies.

CIRCULAR

Provisions on management, operation, use, and ensuring information security on dedicated data transmission networks for Party and State agencies

on dedicated data communication networks of Party and State agencies

____________________________

MINISTER OF INFORMATION AND COMMUNICATIONS

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to the Law on Telecommunications dated November 23, 2009;

Pursuant to Decree No. 64/2007/NĐ-CP dated April 10, 2007 of the Government on the Application of Information Technology in the Activities of State Agencies;

Pursuant to Decree No. 25/2011/NĐ-CP dated April 6, 2011, issued by the Government, detailing and guiding the implementation of certain provisions of the Law on Telecommunications;

Based on Decree No. 187/2007/NĐ-CP dated December 25, 2007 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications; Decree No. 50/2011/NĐ-CP dated June 24, 2011 of the Government amending Decree No. 187/2007/NĐ-CP dated December 25, 2007 of the Government stipulating the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications;

At the proposal of the Director of the Department of Information Technology Application,

PROVISIONS:

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Circular stipulates the management, operation, use, and ensuring information security on the dedicated data transmission network for Party and State agencies.

Article 2. Applicability

1. Organizations and individuals participating in the management, operation, and use of the dedicated data transmission network for Party and State agencies.

Is a subsystem of the TSLCD network connecting to terminal devices at the Central Party Office, Government Office, President's Office, National Assembly Office, Ministries, Committees, and equivalent agencies under the central government, Provincial Party Committees/City Party Committees, People's Councils, People's Committees of provinces/cities directly under the central government provided, managed, operated, and exploited by the Central Post Office.

Article 3. Explanation of Terms

In this Circular, the following terms are understood as follows:

1. The dedicated data transmission network for Party and State agencies is a high-speed transmission network using multi-protocol label switching (MPLS) over IP technology exclusively for the application of information technology in Party and State agencies, constructed and operated by Vietnam Post and Telecommunications Group (hereinafter referred to as the Dedicated Network).

2. Units using the Dedicated Network are central and local agencies within the political system that have points connected to the Dedicated Network.

Chapter II

MANAGEMENT AND OPERATION OF THE DEDICATED NETWORK

Article 4. Principles of management and operation of the Dedicated Network

1. Management and operation of the Dedicated Network must ensure efficient utilization of computer network resources and improve the quality of information technology applications in the activities of Party and State agencies.

2. The Dedicated Network shall be centrally and uniformly managed and operated; it shall be regularly reviewed, inspected, and evaluated to ensure safety, confidentiality, and high availability during operation and use.

3. The Dedicated Network must ensure uninterrupted communication (24 hours a day, 7 days a week).

Article 5. List of services provided on the Dedicated Network

1. Data transmission and private line rental services using virtual private network (VPN) connection technology include:

a) Intranet IP/MPLS VPN service;

b) Extranet IP/MPLS VPN service;

c) Internet IP/MPLS VPN service;

d) Remote IP VPN access service;

đ) Inter-provider link VPN service.

2. Video conferencing service.

3. Value-added services include:

a) Internet access service;

b) Data center service;

c) Server hosting service;

d) Network server service;

đ) Email server service;

e) Voice over IP (VoIP) service.

Article 6. Responsibilities of the Ministry of Information and Communications

1. Direct Vietnam Post and Telecommunications Group to manage and maintain the operation of the Dedicated Network.

2. Guide and direct the connection of other telecommunications networks serving Party and State agencies with the Dedicated Network.

3. Issue tariffs for the use of the Dedicated Network within its authority.

4. Guide units using the Dedicated Network to effectively utilize the services provided on the Dedicated Network.

5. Inspect, examine, and handle violations within its authority.

Article 7. Responsibilities of Vietnam Post and Telecommunications Group

1. Ensuring requirements for capacity, speed, service quality, and information security of the Specialized Network.

2. Establishing and publicizing regulations on management, operation, warning, and troubleshooting of connection transmission lines; quality standards for the network and services.

3. Establishing and submitting to the Ministry of Information and Communications for issuance: planning of network resources, solutions, technical plans; inspection, review, and evaluation plans to ensure the safety of the Specialized Network.

4. Publicizing registration points for services, technical support, troubleshooting, and complaint resolution (hereinafter referred to as service registration points) of units using the Specialized Network at the district level.

5. Establishing and publicizing detailed provisions of model contracts and authorization for the nearest registration point to negotiate and sign contracts with units using the Specialized Network.

6. Ensuring service quality according to the contract with units using the Specialized Network; in case of changes to the list of services, submitting to the Ministry of Information and Communications for approval of modifications to the service provision directory on the Specialized Network as stipulated in Article 5 of this Circular.

7. Managing the connection of backbone network infrastructure with access networks at various levels.

8. Directing provincial telecommunications units under the central government to report every six months and annually on the exploitation and use of the Specialized Network in their localities to the Department of Information and Communications; implementing periodic reports to the Ministry of Information and Communications every three months and ad hoc reports as required regarding the operation of the Specialized Network.

Chapter III

ENSURING NETWORK AND INFORMATION SECURITY ON THE SPECIALIZED NETWORK

Implement state management functions for the assurance of communication information to serve command and control of natural disaster prevention and control work and the operation of the dedicated telecommunications network for command and control of natural disaster prevention and control work.

1. Issuing mechanisms and policies to ensure network and information security on the Specialized Network within its authority.

2. Directing Vietnam Post and Telecommunications Group to implement legal provisions on ensuring network and information security on the Specialized Network.

3. Inspecting, supervising, and handling violations related to network and information security on the Specialized Network within its authority.

Article 9. Responsibilities of Vietnam Post and Telecommunications Group

1. Issuing regulations on protecting network security and information transmitted over the Specialized Network.

2. Implementing measures to ensure that the Specialized Network meets technical standards and norms for information security.

3. Deploying backup solutions and equipment to ensure continuous and secure operation of the Specialized Network infrastructure.

4. Implementing necessary measures to prevent the use or abuse of the network, equipment, hardware, and software tools to disrupt, interfere, cause chaos, damage, or destroy the operation of the Specialized Network.

5. Regularly inspecting and evaluating the level of protection for network and information security, promptly taking preventive and corrective measures.

6. Reporting immediately to the Ministry of Information and Communications for timely guidance and support in case of incidents affecting the backbone network or requiring emergency information response.

Chapter IV

USE OF THE SPECIALIZED NETWORK

Article 10. Use, sharing, and storage of information on the Specialized Network

1. Information classified as state secrets transmitted on the Specialized Network must comply with laws on protecting state secrets.

2. The use, sharing, and storage of information on the Specialized Network must comply with legal provisions on telecommunications, information technology, and storage.

3. Information used, shared, and stored on the Specialized Network must be information serving the management and operation activities and professional tasks of units using the Specialized Network.

Article 11. Responsibilities of units using the Specialized Network

1. Manage, operate, and protect network equipment at their own agency's connection points according to contracts with Vietnam Post and Telecommunications Group.

2. Be responsible for the content and information transmitted on the Specialized Network in accordance with legal regulations.

3. Do not change the network settings of devices related to the Specialized Network without authority, causing resource conflicts, affecting the operation of the Specialized Network system.

4. Be responsible for issues such as:

a) Firewall systems of the unit for the Specialized Network;

b) Management of centralized virtual private network user databases established by the agency (if any) on the Specialized Network platform;

c) Management of domain names of the agency;

d) Ownership and management of the agency's internet connection policies through the Specialized Network;

e) Recording incidents and errors regarding Specialized Network connections, security, and information confidentiality; in cases of serious incidents beyond the unit's capacity to resolve, report to the nearest service registration point of Vietnam Post and Telecommunications Group for timely and prompt resolution.

5. Register for digital signature authentication services with the Government Cryptographic Office (Ministry of Home Affairs) to ensure information security and confidentiality on the Specialized Network.

6. In cases where there are plans to upgrade or maintain internal network systems that affect the Specialized Network, notify the nearest service registration point of Vietnam Post and Telecommunications Group at least five working days in advance to ensure alignment with the overall planning of the Specialized Network.

7. Must comply with regulations on managing, operating, and using the Specialized Network; establish internal rules on the use of the Specialized Network.

8. Must comply with legal provisions on telecommunications, management and licensing of information provision, establishment of electronic information websites on the Internet, confidentiality and information security regimes.

9. Must pay usage costs as stipulated in Circular No. 06/2010/TT-BTTTT dated February 11, 2010, issued by the Minister of Information and Communications on the rates for using specialized data transmission networks of Party and State agencies. These funds shall be budgeted by the units and allocated from the annual state budget based on economy and efficiency.

10. Before December 1st each year, report to the specialized information technology unit of the agency or the Provincial Department of Information and Communications about the situation of exploitation and use of the Specialized Network in the application of information technology activities within the unit.

Article 12. Responsibilities of Individuals Using Specialized Networks

1. When connecting to a specialized network, users (belonging to units using specialized networks) must strictly comply with regulations on management, operation, and use of specialized networks.

2. In case of incidents, timely notification to authorized persons for resolution is required.

Chapter V

IMPLEMENTATION

Article 13. Responsibilities for guidance and implementation

1. The Department of Information Technology Application shall be responsible for:

a) Assist the Minister of Information and Communications in directing Vietnam Post and Telecommunications Group to manage, operate, and maintain specialized networks;

b) Promote, guide, and urge the implementation of the contents of this Circular.

2. The Telecommunications Authority has the responsibility:

a) To implement supervision over the deployment of tariffs, connections, network quality, and telecommunications services on specialized networks;

b) To submit to the Minister of Information and Communications solutions to ensure safety and security for the infrastructure of specialized networks;

c) To review the planning of network resources, technical solutions and plans, development plans for specialized networks proposed by Vietnam Post and Telecommunications Group.

3. The Vietnam Computer Emergency Response Center has the responsibility:

To coordinate with functional units to ensure the safety of information transmission on specialized networks;

To coordinate and support units using specialized networks in building information security solutions and addressing information security breaches;

To propose monitoring, warning, and prevention measures for internal networks of units connected to specialized networks to prevent unauthorized intrusions via the Internet;

To provide technical security assessment services for information systems of units using specialized networks.

4. Central agencies' dedicated information technology units have the responsibility annually to report to the Ministry of Information and Communications on the use of specialized networks in the application of information technology activities of subordinate units.

5. Provincial Departments of Information and Communications have the responsibility:

a) To advise provincial People's Committees to issue regulations on management, operation, and use of specialized networks at the local level;

b) To promote, disseminate, and guide the implementation of the provisions of this Circular for local Party and State agencies; to guide these agencies in effectively managing and utilizing specialized networks;

c) Before December 15 each year, to compile and report to the Ministry of Information and Communications on the exploitation and use of specialized networks in information technology application activities at the local level under their management.

6. Heads of units using specialized networks, within their functions and duties, have the responsibility to organize the implementation and inspect compliance with the provisions of this Circular at their units.

Article 14. Effective Date

1. This Circular takes effect from October 1, 2011.

2. During the process of managing, operating, exploiting, and using specialized networks, if there are difficulties, organizations and individuals involved need to promptly reflect them to the Ministry of Information and Communications (Information Technology Application Department)./