Circular No. 34/2018/TT-NHNN on the management and use of the computer network of the State Bank of Vietnam

CIRCULAR

Regulations on management and use of computer networks

of the State Bank of Vietnam 

           Pursuant to the Law on the State Bank of Vietnam dated June 16, 2010;

           Pursuant to the Law on Information Technology dated June 29, 2006;

           Pursuant to the Law on Telecommunications dated November 23, 2009;

           Pursuant to the Government Decree No. 16/2017/NĐ-CP dated February 17, 2017 stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

           Pursuant to the Government Decree No. 64/2007/NĐ-CP dated April 10, 2007 on the application of information technology in the activities of state agencies;

           Pursuant to the Government Decree No. 72/2013/NĐ-CP dated July 15, 2013 on management, provision, and use of Internet services and information on networks;

           Pursuant to the Government Decree No. 27/2018/NĐ-CP amending and supplementing certain articles of the Government Decree No. 72/2013/NĐ-CP dated July 15, 2013 on management, provision, and use of Internet services and information on networks;

           At the proposal of the Director of the Department of Information Technology;

           The Governor of the State Bank of Vietnam issues this Circular stipulating the management and use of the computer network of the State Bank of Vietnam.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation and Applicability

Article 1. This Circular stipulates the management and use of the State Bank of Vietnam's computer network (hereinafter referred to as the State Bank Network).

2. This Circular applies to individuals and units under the State Bank of Vietnam (hereinafter referred to as the State Bank), organizations outside connecting and using the State Bank's network.

3. Units under the organizational structure of the State Bank that connect and use the State Bank's network shall follow the guidance of the Department of Information Technology.

Article 2. Interpretation of Terms

In this Circular, the following terms shall be understood as follows:

1. Units under the State Bank of Vietnam are administrative units within the organizational structure of the State Bank.

2. Asset Management Unit is a unit under the State Bank of Vietnam assigned the task of managing assets.

3. Asset Usage Unit is a unit under the State Bank of Vietnam assigned the task of using assets.

4. User is an individual or unit under the State Bank connecting and using the State Bank's network.

5. Technical Staff is a person trained in information technology expertise and assigned the task of managing and operating the information technology system at administrative units within the organizational structure of the State Bank.

6. External Organizations Connecting and Using the State Bank Network (hereinafter referred to as external organizations) include: credit institutions, foreign bank branches, and other organizations connecting and using the State Bank's network.

7. Data Center is the State Bank of Vietnam's data center, including the main data center and the backup data center.

8. State Bank Network includes the State Bank of Vietnam's local area network and wide area network.

9. State Bank of Vietnam Local Area Network is a network system connecting terminal devices within the premises of the State Bank.

10. State Bank of Vietnam Wide Area Network is a network system connecting the Data Center with the State Bank of Vietnam's local area networks.

11. The State Bank's Internet Network is a system providing Internet services to users at the State Bank of Vietnam.

12. Wireless Network is a network system connecting terminal devices through radio waves or shortwaves.

13. Terminal Device includes workstations, printers, scanners, fax machines, telephones using IP addresses, various types of mobile smart devices with network connections.

14. Wide Area Network Transmission Infrastructure is the transmission system of the State Bank and transmission channels rented by the State Bank from telecommunications service providers.

15. Local Area Network Transmission Infrastructure is an internal cable transmission system and network connection ports.

16. Network equipment includes switches, routers, transmission devices, network security devices, load balancers, system software, and network monitoring software.

17. Core Network Layer is the core layer of the network system responsible for connecting different layers of the network.

18. Distribution Network Layer is the layer responsible for serving as an interface between the access network layer and the core network layer.

19. Access Network Layer serves to connect users to systems.

20. Network Segmentation are separate zones within the local area network divided according to user groups and purposes including: business server network zones, intermediate network zones (DMZ zone) for providing Internet services, wireless network service zones, and network management zones for monitoring and managing the State Bank's network.

21. Identifier Name is the unique name assigned to terminal devices connecting and accessing the State Bank's network.

22. Video Conferencing Service is a technology for transmitting images and sound over an information network using the TCP/IP protocol suite.

Article 3. Network Architecture of the State Bank of Vietnam

1. Bank of Vietnam Logical Network Architecture:

a) The Bank of Vietnam Local Area Network logical architecture includes the following main layers: core network layer, distribution network layer, access network layer;

b) The local network logical architecture at the Data Center of the State Bank of Vietnam includes the following main zones: the server business network zone, the Internet network zone, the Intranet network zone, the Extranet network zone, the DMZ zone, and the management network zone;

c) The local network logical architecture at administrative units under the organizational structure of the State Bank of Vietnam includes the following main zones: the Intranet network zone, the Extranet network zone, the Internet network zone, and the management network zone;

d) The wide area network architecture of the State Bank of Vietnam includes connections between the main Data Center and the backup Data Center; the Data Center with State Bank of Vietnam units and State Bank of Vietnam branches in provinces and cities; the communication gateway connecting the State Bank of Vietnam with external organizations.

2. Bank of Vietnam Physical Network Architecture includes: networking equipment, local area network transmission infrastructure, and wide area network transmission infrastructure.

3. The local area network system is divided into network zones according to the scope of access and control of access between network zones using firewalls.

Article 4. Principles for Building, Managing, and Using the State Bank of Vietnam's Network

1. The State Bank of Vietnam's network must be designed and built with expandability capability and advanced networking technology, high availability, ensuring security, confidentiality, and bandwidth to meet the operational and business needs of the State Bank of Vietnam.

2. The State Bank of Vietnam's network is designed and built towards smart network orientation, virtualizing network infrastructure to optimize network resource management and usage, and supporting cloud computing construction of the State Bank of Vietnam.

3. The Bank of Vietnam Network is centrally and uniformly managed by the Information Technology Department and there is a division of responsibilities and hierarchical management for asset management units.

4. Users may only use the State Bank of Vietnam's network for specialized professional activities and business operations.

5. The use and sharing of information on the State Bank of Vietnam's network must comply with the State Bank of Vietnam's regulations on information system security in banking operations and relevant laws.

6. Users who fail to comply with Article 23 of this Circular will have their State Bank of Vietnam network services suspended.

External organizations that fail to comply with Article 14 of this Circular will be considered for disconnection from the State Bank of Vietnam's network.

Article 5. Network Resources and Services of the State Bank of Vietnam

1. Bank of Vietnam Network Resources include:

a) Transmission infrastructure, networking equipment;

b) IP address system, domain name system, device identifier names.

2. Bank of Vietnam Network Services include: data transmission service, video conferencing service, network monitoring and management service, and other network services.

Article 6. Ensuring Availability and Security of the State Bank of Vietnam's Network System

1. The State Bank of Vietnam's network must be equipped with technical systems for network management and monitoring to detect and prevent unauthorized access and ensure data security during exchange over the network environment.

2. Connections between external organizations and the State Bank of Vietnam's network must be controlled by cybersecurity systems and comply with the State Bank of Vietnam's regulations on information system security in banking operations.

3. Connections between the State Bank of Vietnam's network and central-level units and headquarters of external organizations must be made through a minimum of two independent transmission infrastructure routes.

4. Data transmitted between the State Bank of Vietnam's network and external organizations must be encrypted during transmission.

5. Terminal devices connecting to and using resources and services of the State Bank of Vietnam's network must be authenticated by the cybersecurity system, installed with anti-malware software, and updated with operating system security patch updates at least once every three months according to the guidance of the Information Technology Department.

Chapter II

SPECIFIC PROVISIONS

Section 1

State Bank of Vietnam Local Area Network

Article 7. Provisions on new installation, upgrade, and repair

1. Activities of new installation, upgrade, or repair of the local area network of the State Bank must comply with the network architecture requirements of the State Bank stipulated in Article 3 of this Circular and the infrastructure security architecture of the information technology system of the State Bank.

2. For new installation and upgrade of transmission infrastructure for the local area network: Property management units prepare design documentation for the transmission infrastructure to be reviewed technically by the Information Technology Department before submitting to the competent authority for approval.

3. For new installation and upgrade of network equipment: Annually, the Information Technology Department implements according to the State Bank's regulations on management and implementation of investment for information technology application activities within the State Bank system.

4. Repair of the local area network must ensure that the technical configuration and local area network design at the unit are not changed.

5. For repairs of local area network transmission infrastructure:

a) When a property using unit but not a property management unit has a need for repair, it shall notify the property management unit.

b) The property management unit shall proactively organize repairs in accordance with the Financial Management Regulations of the State Bank and notify the Information Technology Department for technical coordination before implementation.

6. For repairs of network equipment, the asset management unit must notify the Information Technology Department for coordination to determine the status of the equipment and handle as follows:

a) For equipment still within warranty period or already signed maintenance contracts, equipment repair shall be carried out according to the signed contract;

b) For equipment that has exceeded its warranty period and does not have a maintenance contract, the property management unit shall organize repairs in accordance with the Financial Management Regulations of the State Bank and notify the Information Technology Department for technical coordination.

7. The asset management unit must establish, update, and store design documents and completion drawings of the local area network when installing new, upgrading, or repairing.

Article 8. Provisions on maintenance, periodic inspection, and handling of incidents

1. Provisions on maintenance:

a) The local area network of the State Bank at the Data Center must be maintained periodically at least twice a year; The local area network at administrative units under the organizational structure of the State Bank must be maintained periodically at least once a year.

b) Maintenance activities must not interrupt and affect the operational activities of the State Bank.

c) The maintenance process must be recorded in logs regarding the operational status before and after maintenance.

d) For equipment that has signed a maintenance contract, maintenance shall be carried out according to the signed contract.

đ) For cases where network equipment has exceeded the warranty period and does not have a maintenance contract, the following actions shall be taken:

(i) The Information Technology Department shall establish a network maintenance procedure for asset management units and coordinate remote maintenance of network equipment;

(ii) The property management unit shall carry out maintenance of the network equipment managed by the unit according to the network maintenance procedures issued by the Information Technology Department.

e) The property management unit is responsible for maintaining the transmission infrastructure managed by the unit.

2. Provisions on regular inspection:

a) The Information Technology Department shall establish and issue a regular inspection procedure for the local network system;

b) The property management unit shall conduct periodic inspections of the local area network system according to the inspection procedures issued by the Information Technology Department.

3. Provisions on handling incidents:

a) The Information Technology Department shall establish and issue procedures and guidelines for incident handling;

b) Upon occurrence of an incident, the property management unit shall record the incident and handle it according to the procedures and guidelines of the Information Technology Department. For incidents not covered in the procedures and guidelines or those that have been handled according to the procedures and guidelines but remain unresolved, the property management unit shall notify the Information Technology Department for coordinated handling.

c) In cases where the Information Technology Department handles the incident, it shall inform the property management unit and the property using unit about the time and plan for resolution.

Article 9. Provisions on management and use

1. Terminal devices are only permitted to connect to the access network layer.

2. The Information Technology Department shall stipulate the issuance, unified use of IP addresses, device identifiers, and control of devices connecting to the State Bank of Vietnam's local area network.

Section 2

State Bank of Vietnam Wide Area Network

Article 10. Provisions on new installation, upgrade, and repair

1. Annually, the Information Technology Department shall prepare plans for new installation or upgrading of wide area networks and submit them to the competent authority for approval. The Information Technology Department shall implement new installations and upgrades of wide area networks according to the approved plan.

2. The Information Technology Department shall organize and implement repairs of State Bank's wide area network equipment.

Article 11. Provisions on maintenance, periodic inspection, and fault handling

1. Provisions on maintenance:

a) Wide area networks must be maintained at least twice a year, including one on-site maintenance and one remote maintenance;

b) Maintenance of wide area networks shall not interrupt or affect the operational activities of the State Bank of Vietnam;

c) The maintenance process must be carried out strictly according to the approved script, recording the operational status before and after maintenance;

d) The Information Technology Department shall develop plans and solutions for maintenance, take the lead, and notify asset management units and asset using units to cooperate in implementing maintenance. In cases where maintenance services are hired, the Information Technology Department shall follow current regulations;

e) Asset management units shall cooperate with the Information Technology Department in implementing and confirming the results of maintenance.

2. Provisions on regular inspection and handling of incidents:

a) The Information Technology Department shall establish and issue procedures and guidelines for regular inspection and incident handling;

b) Asset management units shall conduct regular inspections, record daily operations, and handle faults according to the procedures and guidelines of the Information Technology Department.

Article 12. Provisions on management and use

The Information Technology Department shall be responsible for:

1. Managing and centrally controlling the wide area network of the State Bank of Vietnam.

2. Establish, update, and store design documents and completion drawings of wide area networks when newly installed, upgraded, or repaired.

3. Record daily operations and prepare comprehensive system reports for wide area networks once every six months.

Section 3

Connection to the State Bank of Vietnam Network

Article 13. Management of connection to the State Bank of Vietnam Network

1. The State Bank of Vietnam (Information Technology Department) shall uniformly manage the connection methods and IP address ranges for terminal devices of external organizations when connecting to the State Bank of Vietnam Network.

2. External organizations shall connect, change connections to the State Bank of Vietnam Network in accordance with Article 15 of this Circular; terminate connections to the State Bank of Vietnam Network in accordance with Article 16 of this Circular.

3. In cases of additional equipment or changes in transmission paths, external organizations shall send written documents, design materials, configurations, and implementation plans to the Information Technology Department prior to deployment.

Article 14. Requirements for connection to the State Bank of Vietnam Network

1. Comply with regulations on connecting to the State Bank of Vietnam Network.

2. Ensure information security in accordance with regulations on information system security during the operation of the State Bank of Vietnam for terminal devices, network devices, and connection transmission paths to the State Bank of Vietnam Network.

3. Have sufficient technical equipment to connect to the network and ensure information security on transmission paths in accordance with current regulations of the State Bank of Vietnam.

4. Having a technical staff team with the capability to manage connected end devices and network equipment of the organization.

5. Select service providers for transmission bandwidth, pay connection installation costs, subscription fees, repair costs, and maintenance costs for transmission paths connected to the State Bank of Vietnam.

Article 15. Guidelines for Connecting or Changing Connection to the State Bank Network

1. External organizations that wish to connect or change connection to the State Bank network shall prepare a request for guidance on connecting or changing connection according to Appendix 01 attached hereto and send it via postal service or submit directly at the State Bank (Information Technology Department) or through the State Bank’s public service portal.

2. Within seven working days from the date of receipt of the request, the Information Technology Department shall notify relevant units and provide guidelines for implementation of the connection.

Article 16. Guidelines for Disconnecting from the State Bank Network

1. External organizations that no longer require connection to the State Bank network shall prepare a request for guidance on disconnecting according to Appendix 02 attached hereto and send it via postal service or submit directly at the State Bank (Information Technology Department) or through the State Bank’s public service portal.

2. Within five working days from the date of receipt of the request, the Information Technology Department shall notify relevant units and provide guidelines for implementation of disconnection.

Section 4

Internet Connection

Article 17. Management of Internet Connection

1. Computers belonging to the local area network of the State Bank of Vietnam must connect to the Internet through centralized ports established and managed by the Information Technology Department.

2. Computers belonging to the State Bank’s local area network that use information systems with a level of 3 or higher, as prescribed by the Government regarding ensuring the security of information systems according to levels, shall not be connected to the Internet.

3. In cases where units have computers belonging to the State Bank’s local area network that require direct Internet connection without going through the connection gateway established and managed by the Information Technology Department, the unit must submit to the Governor of the State Bank for review and approval (through the Information Technology Department).

4. Computers not belonging to the State Bank’s local area network that connect to the Internet are decided by the head of the unit using the asset and must comply with the State Bank’s regulations on information system security in banking operations and related laws.

5. It is not allowed to use Internet connection devices that do not go through the connection gateway established and managed by the Information Technology Department to directly connect to the State Bank network except in the case provided for in Clause 3 of this Article.

Article 18. Requirements for Internet Connection

1. Terminal devices connecting to the Internet through the centralized connection gateway managed by the Information Technology Department must join the State Bank’s Domain, install anti-malware software, security software, and be updated with operating system patches and other software according to the guidance of the Information Technology Department.

2. Users connecting to the Internet through the centralized connection gateway managed by the Information Technology Department must use access accounts issued by the Information Technology Department.

Article 19. Provisions on Monitoring and Controlling Internet Connections

1. The Information Technology Department is responsible for establishing a network security system to ensure secure communication between the State Bank network and the Internet.

2. The Information Technology Department is responsible for managing, setting policies, and controlling devices within the State Bank of Vietnam's network that connect to the Internet.

3. The Information Technology Department manages and issues Internet access accounts to users. In necessary cases, to ensure the safety of the State Bank network system, the Information Technology Department has the right to proactively suspend or revoke Internet access accounts and notify individuals or units of users.

Article 20. Provisions on Wireless Network and Mobile Device Connections

1. The wireless network system connecting to the Internet of the State Bank of Vietnam must be designed and constructed independently from the State Bank of Vietnam's network system.

2. The Information Technology Department manages the activities of network devices providing wireless Internet services and controls wireless network access devices to the State Bank of Vietnam's network.

Section 5

Responsibilities in Managing and Using the State Bank Network

Article 21. Responsibilities of the Information Technology Department

1. Managing the technical aspects of the State Bank of Vietnam's network.

2. Managing the issuance and use of resources in the State Bank of Vietnam's network within the scope of delegated management.

3. Monitor and supervise the operation of the State Bank network system to ensure continuous, stable, and secure operation.

4. Warn and guide State Bank units to address security vulnerabilities and risks to the operation of the State Bank network after detection and evaluation of severity.

5. Notify the asset management unit at least three working days before temporarily suspending network services for repair, upgrade, or maintenance.

6. Organize inspection of external organizations' network connections to the State Bank network.

7. Study and apply advanced technologies to build, manage, and operate the State Bank network in a centralized and unified manner.

8. Study and construct the State Bank network infrastructure towards dual-active (Active/Active) operation mode among State Bank data centers.

9. Organize training and guidance for State Bank units and individuals on managing and using the State Bank network.

10. Perform other tasks as prescribed in this Circular.

Article 22. Responsibilities of the asset management unit

1. Organize guidance and inspection of the use of local networks managed by the unit.

2. Coordinate with the Information Technology Department in connecting, changing connections, and disconnecting networks for organizations connected to their own unit.

3. Inspect network connections from external organizations to the State Bank of Vietnam through the connection gate established and managed by the Information Technology Department.

4. Coordinate with the Information Technology Department in managing network connections from external organizations that connect to their unit.

5. Assign technical staff to manage network equipment and coordinate in handling incidents arising at the unit.

6. Ensure necessary conditions for network equipment at the unit to operate safely and stably.

Article 23. Responsibilities of the user

1. Use resources and exploit information on the State Bank of Vietnam's network and the Internet within permitted limits and subject to supervision and control by the Information Technology Department.

2. Comply with the State Bank of Vietnam’s regulations on information system security in banking operations and related laws.

3. Comply with the State Bank of Vietnam’s and relevant laws’ provisions regarding network connection, use, and exploitation of the Internet.

4. Only install tools and software as prescribed by the State Bank of Vietnam when participating in the State Bank of Vietnam’s network system.

5. In case of incidents or signs of insecurity while using the State Bank of Vietnam’s network, report to the technical staff at the asset management unit for guidance and assistance in resolution.

6. Coordinate with technical staff in handling and confirming the results of incident resolution.

Chapter III

IMPLEMENTING PROVISIONS

Article 24. Effective Date

This Circular takes effect from March 1, 2019, and replaces Circular No. 11/2012/QĐ-NHNN dated April 25, 2012, issued by the Governor of the State Bank of Vietnam on the management and use of computer networks of the State Bank of Vietnam.

Article 25. Implementation organization

The Director of the Office, the Director of the Department of Information Technology, the Heads of relevant units under the State Bank of Vietnam, the Chairmen of the Management Councils, the Members of the Board of Directors, the General Directors (Directors) of credit organizations, foreign bank branches, and related organizations are responsible for organizing the implementation of this Circular./.