Decision No. 29/2008/QD-NHNN On Maintenance of Information Technology Equipment Systems in the Banking Industry

Pursuant to …;

Issuing regulations on the maintenance of information technology equipment systems in the banking industry

_________________________

GOVERNOR OF THE STATE BANK OF VIETNAM

Pursuant to the Law on the State Bank of Vietnam 1997 and the Law Amending and Supplementing Certain Provisions of the Law on the State Bank of Vietnam 2003;

Pursuant to the Law on Credit Organizations 1997 and the Law Amending and Supplementing Certain Provisions of the Law on Credit Organizations 2004;

Decree No. Decision No. 96/2008/NĐ-CP dated August 26, 2008 of the Government stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

At the proposal of the Director of the Banking Information Technology Department,

DECISION:

Article 1. This Decision hereby promulgates the Regulations on the Maintenance of Information Technology Equipment Systems in the Banking Industry.

Article 2. This Decision shall take effect fifteen days from the date of publication in the Official Gazette.

Article 3. The Head of the Office, the Director of the Banking Information Technology Department; Heads of units under the State Bank of Vietnam; Governors of the State Bank of Vietnam branches in provinces and centrally governed cities; Chairmen of the Management Councils, General Directors (Directors) of credit organizations are responsible for implementing this Decision./

REGULATIONS

REGULATIONS ON THE MAINTENANCE OF INFORMATION TECHNOLOGY EQUIPMENT SYSTEMS IN THE BANKING INDUSTRY

(Issued together with Decision No. 29/2008/QĐ-NHNN dated October 13, 2008 of the Governor of the State Bank of Vietnam)

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation and Applicability

1. These regulations prescribe technical standards, procedures, formalities, and measures to ensure safety and confidentiality in the maintenance of information technology equipment systems in the banking industry.

2. These regulations apply to the State Bank system and various types of credit organizations that utilize information technology in their banking operations (hereinafter referred to collectively as "banks").

Article 2. Interpretation of Terms

1. The information technology equipment system of banks referred to herein includes hardware equipment, network systems, software applications, and databases serving one or more technical and business activities of the bank.

2. Maintenance refers to the work of maintaining and servicing the equipment system throughout its usage period to maintain operational capability, extend lifespan, and promptly identify and prevent individual device, group device, or entire system malfunctions and security risks.

3. Remote maintenance is the method of performing maintenance on IT equipment and software remotely through the bank's computer network.

4. Emergency maintenance is the work of promptly addressing or preventing technical issues affecting the bank's operations.

5. Scheduled maintenance aims to ensure continuous optimal operation of the system according to a pre-planned schedule.

6. Self-maintenance is maintenance carried out by the bank's technical staff.

7. Warranty service involves repairing defects or technical failures caused by the manufacturer within the warranty period of the equipment or software.

8. Script is a set of predefined requirements, procedures, scenarios, data, and results used for testing, installation, warranty, and maintenance of IT equipment, software, and databases.

9. Outsourced service is maintenance performed through contracts signed with organizations providing maintenance services.

10. Maintenance logbook is a record book established by the bank to document each maintenance session. After each maintenance session, basic information to be recorded includes: time, location, person conducting the work, completed and unfinished tasks, and recommendations (if any).

11. Maintenance form is a separate sheet used to track repair, replacement, modification, and additional installation of hardware and network devices from installation until no longer in use. The form contains basic information about: time, person conducting the work, and details related to changes and additional installations of the equipment.

12. Staff member THE HEAD OF THE MINISTRY’S OFFICE, THE HEAD OF THE MINISTRY’S INSPECTION DEPARTMENT, THE HEADS OF THE DEPARTMENTS, THE DIRECTOR OF THE VIETNAM CIVIL AVIATION ADMINISTRATION, THE CHIEF EXECUTIVE OFFICER OF THE VIETNAM AIRPORTS CORPORATION - CPTP, AND THE HEADS OF THE AUTHORITIES, ORGANIZATIONS, AND INDIVIDUALS CONCERNED ARE RESPONSIBLE FOR IMPLEMENTING THIS CIRCULAR./. is the person assigned to manage the system, inspect, supervise maintenance, repair, and replacement of components and equipment, organize acceptance of post-maintenance results for use.

Article 3. Basic principles for maintaining computer equipment

1. Maintenance can be carried out on-site or remotely.

2. It shall not disrupt the normal operation of the Bank.

3. The organization and implementation must be scientific and reasonable according to the plan approved by the competent authority or in accordance with the signed contract. Maintenance for each type of equipment must ensure compliance with the technical regulations, conditions, and standards set forth by the manufacturer or supplier.

4. Effectively prevent the risk of equipment failure, and prevent virus infection of the Bank's devices, software, and databases during the maintenance process.

5. Ensure system safety, protect the Bank's data confidentiality, and prevent unauthorized data theft or exploitation during the maintenance process.

6. Maintenance requirements, timeframes, and implementation measures must be formalized in writing from the time of installing the computer equipment system and regularly updated during its operational use.

Article 4. Hardware equipment (hereinafter referred to as hardware) includes:

1. System devices: Various types of servers, storage disk cabinets (Storage), tape libraries (Tape Library), uninterruptible power supply systems (UPS of 5 KVA or higher, generators).

2. Specialized devices: Personal computers (PC), laptops (notebooks), terminal stations (terminals), laser printers, dot matrix printers, scanners, uninterruptible power supply systems (UPS under 5 KVA, stabilizers), automatic teller machines (ATMs), various card readers.

Article 5. Network systems include:

1. Network and communication devices: Routers (Router, Switch), modems (Modem), transmission optimization devices, trunk lines (fiber optic cables, leased lines), IP telephone call processing centers (IP Call processing), and other communication equipment.

2. Security and protection devices: Firewalls (Firewall), intrusion detection devices, data encryption or decryption devices (Encryptor/Decryptor), identification devices, and other security and protection equipment.

3. Network nodes (network nodes), network cables, and other accessories.

Article 6. Computer software and database of the Bank (hereinafter referred to as software and database) include:

1. Banking business software, software for managing and operating the Bank, specialized web pages.

2. System software, anti-virus software, spyware, network management software, communication network software, security and protection software, middleware, firmware.

3. Database including data and database management systems.

Article 7. Conditions for organizations and individuals participating in the maintenance of computer equipment

1. Individuals involved in maintenance activities must have full moral qualities, capabilities, knowledge, and professional expertise in information technology; in the field required for maintenance.

2. Organizations providing maintenance services are companies and specialized units operating in the fields of information technology and telecommunications, having legal personality and legally conducting business operations. They must have a sufficient number of qualified maintenance staff to carry out maintenance work according to the Bank's requested schedule and content.

3. Depending on the actual situation, the Bank may impose additional conditions suitable for the maintenance work, such as human resource standards, repair tools, and specific software requirements for detecting faults and accepting results after maintenance.

Chapter II

SPECIFIC PROVISIONS

Article 8. Basic contents of computer equipment maintenance

1. Basic contents of hardware and network system maintenance:

a) Checking the operational status of equipment; checking the configuration of equipment, testing transmission speed, and performing industrial cleaning.

b) Detecting, recommending, and repairing or replacing faulty or outdated equipment.

2. Basic contents of software and database maintenance:

a) Software upgrades: including timely fixing program defects (patching), meeting business innovation requirements, and replacing obsolete algorithms or technologies.

b) Software adjustments: including changing and supplementing software components to better meet user requirements and equipment conditions.

c) System software maintenance (operating system): checking system performance, free disk space. Deleting intermediate data files, deleting log files beyond their retention period.

d) Checking, eliminating computer viruses, harmful codes, worms, and maintaining according to specific standards provided by suppliers.

Article 9. Time for implementing computer equipment maintenance

1. Daily and weekly, users of computer equipment must be responsible for managing, cleaning the exterior of the equipment, not allowing dust accumulation, and promptly reporting to responsible persons when abnormal signs appear on machines, equipment, software, or databases.

2. Periodically, the Bank must conduct technical inspections of equipment to promptly detect potential failures; optimize database parameters, clean up old and redundant data.

3. At least every six months, the Bank must carry out maintenance once. Equipment within its warranty period still requires regular maintenance.

Article 10. Procedure for Implementing Computer Equipment Maintenance

The maintenance process includes the following basic steps:

1. Technical briefing among relevant parties regarding the operational status of machines, equipment, software, and databases to develop detailed implementation plans.

2. For software, databases, machines, and equipment containing security keys (passwords), management staff must replace them with temporary security keys; store configurations and important data to prevent data loss during maintenance.

3. Maintenance personnel perform maintenance tasks. During maintenance, maintenance personnel must use temporary security keys.

4. After completing maintenance work, relevant parties must organize operations to inspect the operational status of each type of equipment, individual software, and the entire system; check industrial hygiene standards, and recheck maintenance log entries.

5. Management staff must organize inspections and supervision of maintenance work, restore security keys to their original state, and ensure that equipment is ready for use.

Article 11. Organization of Computer Equipment Maintenance Implementation

1. General principles

Based on the level of importance and technical difficulty of each information technology system; based on organizational models and local technical staff capabilities, the Bank may choose to self-maintain, hire external services, and select regular maintenance, emergency maintenance, on-site maintenance, remote maintenance, while ensuring compliance with principles stipulated in Article 3 of this Regulation.

2. Hierarchical organization in implementation

a) Level 1 management unit: units with functions to manage information technology of the State Bank or specialized responsibilities for information technology at headquarters of banks. These units have the following main tasks:

- Managing the maintenance work of computer equipment throughout the system, assigning specific tasks to lower-level management units, and organizing overall inspection and supervision.

- Implementing maintenance of large or critical IT systems, unified software and databases, various types of server systems, wide area networks (WAN), backup systems, and security systems; maintaining specialized computer equipment at workplaces.

- Preparing budget estimates and settling annual expenses according to regulations.

b) Level 2 management unit: branches of banks or equivalent units under the direction of level 1 IT units. These units have the following main tasks:

- Implementing maintenance of computer equipment at locations assigned by level 1 management units and maintaining specialized computer equipment at their workplaces.

- Preparing budget estimates and settling annual expenses for assigned tasks according to regulations.

Article 12. Safety and Security in Computer Equipment Maintenance

1. Organize supervision and acceptance of results according to the approved scenario. Do not allow unqualified personnel to perform maintenance or carry out maintenance without necessary repair tools.

2. For software, databases, machines, and equipment containing security key codes, temporary security key codes must be used during maintenance and changed immediately upon completion of the maintenance work.

3. Must have backup plans for machinery, equipment, spare parts, and components to ensure smooth and quick maintenance work. Measures to prevent risks during maintenance work must be implemented.

4. Spare parts and components must be technically inspected before upgrading, replacement work. For equipment containing confidential data that can still be exploited, storage and complete deletion of this data must be carried out before repair or replacement. Changes in design and configuration of equipment during repairs, replacements, or upgrades must be fully recorded in logs.

5. Remote maintenance may only be performed when the bank's network system has been equipped with security tools including transmission encryption devices, firewalls, and anti-computer virus devices.

Chapter III

MANAGEMENT OF MAINTENANCE WORK

Implement financial regulations as stipulated in the Law on Credit Institutions; Decree No. 93/2017/ND-CP; detailed guidance provided in this Circular and other regulatory documents on financial management.

1. The Bank must have a written maintenance plan and measures to organize its implementation. Each year, it must prepare a budget and other resources for maintenance work.

2. Assign staff with sufficient capacity to manage and supervise throughout the maintenance period and accept results after maintenance is completed.

3. Create favorable conditions for maintenance work to be carried out according to plan, quickly, effectively, and safely.

Article 14. Responsibilities of Organizations and Individuals Managing Maintenance Work

1. Implement maintenance work at the Bank according to the plan and regulations stipulated in Chapter II of this Regulation.

2. Organize inspection and supervision to ensure maintenance work and acceptance of results after maintenance is completed.

3. Manage maintenance logs, maintenance forms, and report on maintenance work.

Article 15. Responsibilities of Organizations and Individuals Performing Maintenance Work

1. Must perform maintenance according to the approved scenario. Any technical issues that could affect the Bank's operations must be reported immediately to the competent authority for timely handling and resolution.

2. After resolving technical issues, hand over damaged equipment, replaced spare parts, and the current technical condition of machinery and equipment to the responsible manager of the Bank. Those who cause damage to machinery and equipment due to negligence must bear responsibility for compensation. After completing the work, record in the maintenance log and form.

3. Strictly comply with internal rules for entering and leaving the office and regulations on asset security and safety of the Bank.

Chapter IV

IMPLEMENTING PROVISIONS

Article 16. Handling Violations

Any violation of the provisions of this Regulation will be subject to administrative penalties, material damage compensation, and criminal liability pursuit according to the law depending on the level of violation.

Article 17. Responsibility for Implementation

1. The Director of the Banking Information Technology Department is responsible for guiding and coordinating with the Inspector General of the State Bank of Vietnam, the Head of the General Supervision Department, and the Head of the Accounting and Finance Department to inspect the implementation of this Regulation.

2. Heads of units under the State Bank of Vietnam; Governors of Provincial and Central City Branches of the State Bank of Vietnam; Chairmen of Management Boards, General Directors (Directors) of credit organizations are responsible for organizing the implementation and inspection of compliance with this Regulation within their units.