Circular No. 27/2017/TT-BTTTT stipulates the management, operation, connection, use, and security assurance for information on dedicated data communication networks of Party and State agencies.

CIRCULAR

REGULATIONS ON MANAGEMENT, OPERATION, CONNECTION, USE AND SAFETY GUARANTEES FOR INFORMATION ON SPECIALIZED DATA NETWORKS OF PARTY AND STATE ORGANIZATIONS

MINISTER OF INFORMATION AND COMMUNICATIONS

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to the Law on Telecommunications dated November 23, 2009;

||| Pursuant to the Cybersecurity Law dated November 19, 2015;

Pursuant to Decree No. 64/2007/NĐ-CP dated April 10, 2007 of the Government on the application of information technology in state administrative activities;Pursuant to Decree No. 25/2011

/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications, Decree No. 81/2016/NĐ-CP dated July 1, 2016 of the Government amending and supplementing certain provisions of Decree No. 25/2011/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications and Decree No. 49/2017/NĐ-CP dated April 24, 2017 of the Government amending and supplementing Article 15 of Decree No. 25/2011/NĐ-CP dated April 6, 2011 of the Government detailing and guiding the implementation of certain provisions of the Law on Telecommunications and Article 30 of Decree No. 174/2013/NĐ-CP dated November 13, 2013 of the Government on administrative penalties for violations in the fields of postal services, telecommunications, information technology and radio frequencieswithout wires;Pursuant to Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring the security of information systems; The Minister of Information and Communications promulgates this Circular regulating management, operation, connection, use and safety guarantees for information on specialized data networks of Party and State organizations.This Circular regulates management, operation, connection, use and safety guarantees for information on specialized data networks of Party and State organizations.

1. Organizations and individuals participating in the management, operation, connection and use of specialized data networks of Party and State organizations.28/2018/QĐ-TTg dated July 12, 2018 of the Prime Minister on electronic document transmission between agencies in the state administrative system;

Pursuant to Decree No. 17/2017/NĐ-CP dated February 17, 2017, issued by the Government, on the functions, tasks, powers, and organizational structure of the Ministry of Information and Communications;

At the request of the Director of the Central Postal Administration,

2. Specialized units for information technology of Party and State organizations at the central level, Provincial Departments of Information and Communications under the central government.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

1. Specialized data networks of Party and State organizations are important national information systems, used exclusively for data transmission and information technology applications of Party and State organizations (hereinafter referred to as specialized data networks and abbreviated as "TSLCD network") managed and operated by the Central Post Office as the network owner.

Article 2. Applicability

2. Level I TSLCD Network

Is a subsystem of the TSLCD network connecting to terminal devices at the Central Party Office, Government Office, President's Office, National Assembly Office, Ministries, Committees, and equivalent agencies under the central government, Provincial Party Committees/City Party Committees, People's Councils, People's Committees of provinces/cities directly under the central government provided, managed, operated, and exploited by the Central Post Office.

Article 3. Explanation of Terms

In this Circular, the following terms are understood as follows:

3. Level II TSLCD Network

Is a subsystem of the TSLCD network connecting to terminal devices at county-level agencies including District/County/Municipal Party Committees, People's Councils, People's Committees of Districts/Counties; village-level agencies including Village/Commune Party Committees, and equivalent agencies at the village/commune level provided, managed, operated, and exploited by telecommunications enterprises in their respective areas.

4. Users of the TSLCD network are Party and State organizations at the central and local levels with points connected to the TSLCD network.

5. Internet access service as defined in this Circular means dedicated Internet access through the Internet gateway of the TSLCD network to serve directive, management, and operational applications of Party and State organizations on the TSLCD network.

MANAGEMENT AND OPERATION OF THE TSLCD NETWORK

4. The entities using the TSLCD network are central and local Party and State agencies that have connection points to the TSLCD network.

5. The Internet access service as prescribed in this Circular refers to dedicated Internet through the Internet gateway of the TSLCD network for serving directive, management, and operational applications of Party and State agencies on the TSLCD network.

Chapter II

MANAGEMENT AND OPERATION OF THE TSLCD NETWORK

Article 4. Principles for Managing and Operating the TSLCD Network

1. Management and operation of the TSLCD network must ensure efficient exploitation of network resources and improve the quality of information technology applications in the activities of Party and State agencies.

2. The TSLCD network shall be centrally and uniformly managed and operated; it shall be periodically or randomly reviewed, inspected, and evaluated to ensure safety, confidentiality, and high availability during operation and use.

3. The TSLCD network must ensure uninterrupted communication (24 hours/day and 7 days/week).

Article 5. List of Services Provided on the TSLCD Network

1. Basic Services

a) Virtual private network service (point-to-point, multi-point);

b) Dedicated circuit service;

c) Specialized internet access service;

d) Video conferencing service;

đ) Voice service;

e) Other basic services as prescribed by the Ministry of Information and Communications.

thông.

2. Value-added Services

a) Voice mail service;

b) Email service;

c) IPTV service;

d) Virtual server rental service;

đ) Other value-added services as prescribed by the Ministry of Information and Communications.

3. Supplementary Services

a) Supplementary services of IP voice, including caller ID display service, call waiting service, call transfer service, call blocking service, speed dialing service;

b) Other supplementary services as prescribed by the Ministry of Information and Communications.

Chapter III

PROVISIONS ON CONNECTION AND USE OF THE TSLCD NETWORK

Article 6. Requirements for Connection for Units Using Level I TSLCD Network

1. Connection location: determined through mutual agreement between the Central Post and Telecommunications Administration and the connecting unit based on selecting technically feasible connection locations.

2. Connection method and interface: direct fiber optic connection to the Level I TSLCD network, complying with relevant technical standards and mandatory standards set by the Ministry of Information and Communications.

3. IP address resources and routing parameters: ensure uniformity of IP address resources and routing parameters according to legal regulations and guidelines issued by the Ministry of Information and Communications (Central Post and Telecommunications Administration) for the TSLCD network.

4. Installation of terminal equipment: installation and connection of subscriber terminal equipment and internal networks to the Level I TSLCD network must comply with telecommunications resource management regulations, standards, and technical specifications.

Article 7. Requirements for Connection for Units Using Level II TSLCD Network

1. Must connect via the telecommunications enterprise's infrastructure, not directly to Level I TSLCD network devices.

2. Telecommunications enterprises must ensure interconnection among points within the Level II TSLCD network based on the usage needs of provincial Party and State agencies and must meet connection requirements stipulated by the Central Post and Telecommunications Administration.

3. To ensure interconnection between the Level I and Level II TSLCD networks, telecommunications enterprises must establish trunk connections to the Level I TSLCD network.

4. Interconnection between points in different Level II TSLCD networks belonging to different telecommunications enterprises, and between points in different Level II TSLCD networks belonging to different provinces and centrally-administered cities must be approved by the Central Post and Telecommunications Administration and must route through the central point of the Level I TSLCD network.

5. IP address resources and routing parameters: ensure uniformity of IP address resources and routing parameters according to legal regulations and guidelines issued by the Ministry of Information and Communications (Central Post and Telecommunications Administration) for the TSLCD network.

Article 8. Requirements for trunk connection between Level I TSLCD network and Level II TSLCD network

1. Connection location: The Central Post and Telecommunications Administration and the telecommunications enterprises providing the Level II TSLCD network connection shall uniformly select the connection location on the network based on technical feasibility but must not violate the provisions on connection set forth in Articles 42 and 44 of the Telecommunications Law.

2. Connection method and interface: Direct optical cable connection between the Level I TSLCD network and the Level II TSLCD network based on compliance with relevant technical standards and mandatory standards prescribed by the Ministry of Information and Communications.

3. IP address resources and routing parameters: ensure uniformity of IP address resources and routing parameters according to legal regulations and guidelines issued by the Ministry of Information and Communications (Central Post and Telecommunications Administration) for the TSLCD network.

Article 9. Requirements for the network infrastructure of telecommunications enterprises providing connections to the Level II TSLCD network

1. Only telecommunications enterprises with networks at provincial, district, and commune-level agencies of centrally governed cities and provinces; having sufficient network infrastructure to connect to units within the Level II TSLCD network; possessing staff to ensure direct monitoring, operation, and support for handling incidents at connection points, and having trunk connections to the Level I TSLCD network may provide services.

2. Connections to the TSLCD network must ensure the safety and confidentiality of transmission lines in accordance with regulations.

3. Services deployed on the Level II TSLCD network must comply with technical standards prescribed by the Ministry of Information and Communications.

Article 10. Use, Sharing, and Storage of Information on the TSLCD Network

1. The use, sharing, and storage of information on the TSLCD network must comply with laws on telecommunications, information technology, information security, and archiving.

2. Information used, shared, and stored on the TSLCD network must be information serving management operations and professional activities of units using the TSLCD network.

3. Important information transmitted over the TSLCD network must comply with laws on protecting state secrets and encryption using fundamental cryptographic keys.

Chapter IV

INFORMATION SECURITY ON THE TSLCD NETWORK

Article 11. General Provisions on Ensuring Information Security for the TSLCD Network Infrastructure

1. Design the network infrastructure to divide into functional network zones corresponding to the level of the information system.

2. There must be a plan to manage access to the system from external networks, aiming to manage and prevent unauthorized access from external networks to internal networks.

3. There must be measures to manage access from within the network to external networks and the Internet, ensuring that only legitimate connections according to the policy of the agency or organization are allowed to connect externally.

4. There must be a plan to store and manage system logs to serve the purpose of monitoring normal operations and activities related to information security of the system.

5. There must be a plan to prevent and combat intrusion and malicious software, aiming to monitor early detection, handle, and prevent cyber attacks and unusual events occurring on the system through the network environment.

6. There must be a plan to protect network devices and information security devices within the system, aiming to monitor and prevent unauthorized access, changes to configuration and operation of the device.

Article 12. Provisions on ensuring information security for TSLCD networks

1. TSLCD network level I must meet at least the criteria for ensuring information system security according to the level, as prescribed in Clause 5, Article 9 of Circular 03/2017/TT-BTTTT dated April 24, 2017 issued by the Minister of Information and Communications detailing and guiding certain provisions of Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring information system security according to levels.

2. TSLCD network level II must meet at least the criteria for ensuring information system security according to the level, as prescribed in Clause 3, Article 9 of Circular 03/2017/TT-BTTTT dated April 24, 2017 issued by the Minister of Information and Communications detailing and guiding certain provisions of Decree No. 85/2016/NĐ-CP dated July 1, 2016 of the Government on ensuring information system security according to levels.

Article 13. Provisions on ensuring information security for the management subsystem of TSLCD networks

1. The management subsystem must be separated from other network subsystems and shall not be connected to the Internet.

2. There must be a centralized authentication system for accounts accessing device configurations, with appropriate permissions granted to administrators.

Chapter V

RESPONSIBILITIES OF RELATED UNITS

Article 14. Responsibilities of the Central Post Office

1. To take the lead in developing plans for the development of TSLCD networks.

2. To take the lead in guiding units to implement the contents of this Circular.

3. To coordinate with the Department of Science and Technology in drafting and submitting standards and technical regulations on management, operation, connection, use, and ensuring information security on TSLCD networks to the Ministry of Information and Communications for issuance.

4. To take the lead in issuing regulations, policies, quality indicators, procedures, and norms to ensure connectivity and information security related to TSLCD networks.

5. To periodically or urgently inspect and evaluate to ensure the security of TSLCD networks, coordinating the handling of incidents occurring on the network.

6. To coordinate in conducting inspection and supervision work on TSLCD networks.

7. In emergency situations, mobilize the infrastructure and capacity of telecommunications enterprises to serve urgent information requirements of central Party and State agencies.

8. Every six months and annually, to direct telecommunications enterprises providing connections and services for TSLCD level II networks in provinces and centrally-administered cities to report on the exploitation and use of TSLCD networks to the Central Post Office and Provincial Departments of Information and Communications.

9. To act as the point of contact of the Ministry of Information and Communications to receive information from Provincial Departments of Information and Communications about TSLCD networks.

10. To act as the point of contact for providing telecommunications enterprise services deployed on TSLCD level I networks.

11. To deploy solutions and equipment to ensure requirements regarding capacity, speed, service quality, information security, and backup plans for TSLCD networks.

12. To periodically review, assess, and propose levels of information system security assurance, for approval by competent authorities.

Article 15. Responsibilities of relevant agencies and units under the Ministry of Information and Communications

1. Responsibilities of the Telecommunications Administration: to coordinate in reviewing IP resources, routing parameters, technical solutions, and development plans for TSLCD networks proposed by service providers.

2. Responsibilities of the Cybersecurity Administration:

a) To guide the determination of information security levels for TSLCD networks;

b) To coordinate with the Central Post Office in drafting, adjusting, and supplementing regulations on ensuring information security related to TSLCD networks;

c) To coordinate with the Central Post Office in implementing measures to ensure information security on TSLCD networks;

d) To coordinate and support information rescue operations in cases of incidents related to information security.

3. Responsibilities of the Vietnam Computer Emergency Response Center:

a) To coordinate with functional units to ensure information transmission security on the TSLCD network according to their assigned functions and tasks;

b) To coordinate and support units using TSLCD networks in coordinating rescue operations for information security incidents;

c) To coordinate in implementing monitoring, warning, and prevention measures for internal networks of units connected to the TSLCD network to prevent unauthorized Internet access.

4. Responsibilities of the Inspectorate: to take the lead in inspection and supervision work to ensure compliance with regulations, procedures for management, operation, connection, exploitation, use, and ensuring security and safety on TSLCD networks.

5. Responsibilities of the Department of Science and Technology: to take the lead and coordinate with the Central Post Office in drafting and submitting technical standards and regulations on management, operation, connection, use, and ensuring information security on TSLCD networks to the Ministry of Information and Communications for issuance.

Article 16. Responsibilities of Telecommunications Enterprises Providing Infrastructure Connection and Services for TSLCD Networks

1. Announce service registration points, technical support, fault resolution, and complaint handling (hereinafter referred to as service registration points) for secondary-level TSLCD network users.

2. Develop and announce detailed provisions regarding model contract contents and authorize the nearest service registration point to negotiate and sign contracts with secondary-level TSLCD network users.

3. Ensure service quality and readiness for connection points within secondary-level TSLCD networks in provinces and centrally-administered cities.

4. Adhere to regulations on connection, network quality, and information security assurance for TSLCD networks as stipulated by the Ministry of Information and Communications.

5. Mobilize infrastructure and capacity of enterprises to serve urgent information requests from central Party and State agencies through the Central Post and Telecommunications Administration.

6. Implement solutions and backup systems and personnel to ensure continuous and secure operation of TSLCD network infrastructure.

7. Report and be subject to supervision and review by the Central Post and Telecommunications Administration concerning services provided on the TSLCD network and incidents involving secondary-level TSLCD networks.

8. Annually, before June 15 and December 15, compile and report to the Central Post and Telecommunications Administration and provincial Departments of Information and Communications on the situation of TSLCD network exploitation and usage at the local level.

Article 17. Responsibilities of Specialized Information Technology Units of Central Party and State Agencies

1. Annually report to the Ministry of Information and Communications on the use of TSLCD networks in the application activities of units under and affiliated with the agency.

2. Develop plans for network development, coordinate with the Central Post and Telecommunications Administration to review and issue them.

Article 18. Responsibilities of Provincial Departments of Information and Communications

1. Develop plans for the development of secondary-level TSLCD networks at the local level.

2. Direct and guide organizations, individuals, and telecommunications enterprises to implement legal regulations on ensuring network and information security on secondary-level TSLCD networks.

3. Take the lead in inspecting and handling violations of regulations on the use, sharing, storage of information, and information security on secondary-level TSLCD networks within their authority.

4. Advise provincial People's Committees to promulgate management, operation, and usage regulations for secondary-level TSLCD networks at the local level.

5. Promote, disseminate, and guide the implementation of this Circular's provisions for local Party and State agencies; guide these units to manage and exploit secondary-level TSLCD networks effectively.

6. Before December 15 each year, compile and report to the Ministry of Information and Communications (Central Post and Telecommunications Administration) on the situation of TSLCD network exploitation and usage in local information technology application activities managed by the unit.

Article 19. Responsibilities of Units and Individuals Using TSLCD Networks

1. Manage, operate, and protect network equipment at the connection point located at their own agency according to TSLCD network regulations and contracts with service providers.

2. Ensure that content and information transmitted over the TSLCD network comply with legal regulations.

3. Do not change network connection settings of devices related to the TSLCD network without authority, causing resource conflicts, and affecting the operation of the TSLCD network system.

4. When incidents occur, promptly notify the authorized person to resolve them.

5. Be responsible for issues such as:

a) Managing the firewall system of the unit for the TSLCD network;

b) Managing the centralized virtual private network user module established by the unit (if any) on the TSLCD network platform;

c) Managing domain names of the unit;

d) Managing the unit's Internet connection policies through the TSLCD network;

đ) Record network connection incidents, security, and information confidentiality issues; in case of serious incidents beyond the unit's capability to resolve, notify the Central Post and Telecommunications Administration (for primary-level TSLCD networks) or the nearest service registration point of the service provider (for secondary-level TSLCD networks) to cooperate in timely and rapid resolution.

6. Register for digital signature certification services with the Government Cryptographic Office to ensure information security on the TSLCD network.

7. In cases where there are plans to upgrade or maintain internal systems affecting the TSLCD network, notify the Central Post and Telecommunications Administration (for primary-level TSLCD networks) or the nearest service registration point of the service provider (for secondary-level TSLCD networks) at least five working days in advance to ensure compatibility with the overall planning of the TSLCD network.

8. Ensure compliance with regulations on managing, operating, and using the TSLCD network; develop internal regulations on using the TSLCD network.

9. Ensure compliance with legal regulations on telecommunications, management, and licensing for information provision, setting up web pages on the Internet, and confidentiality and information security regimes.

10. Before December 1 each year, report to the Ministry of Information and Communications (for units under Ministries and equivalent agencies) and report to the Department of Information and Communications in the province or centrally-administered city (for provincial, district, and commune-level agencies).

Chapter VI

IMPLEMENTING PROVISIONS

Article 20. Implementation

The Director of the Central Post and Telecommunications Administration, Heads of relevant agencies and units under the Ministry of Information and Communications; Provincial Departments of Information and Communications and units using TSLCD networks, within their functions and responsibilities, are responsible for organizing implementation and supervising compliance at their units in accordance with the provisions of this Circular.

Article 21. Effective Date

1. This Circular takes effect from December 5, 2017, and replaces Circular No. 23/2011/TT-BTTTT dated August 11, 2011, issued by the Minister of Information and Communications on regulations for managing, operating, using, and ensuring information security on TSLCD networks of Party and State agencies.

2. During the process of managing, operating, exploiting, and using the TSLCD network, if there are any difficulties, the relevant organizations and individuals shall promptly report to the Ministry of Information and Communications (Central Post Office Authority). /.