Circular No. 37/2009/TT-BTTTT stipulates on the files and procedures related to issuing licenses, registering, and recognizing organizations providing digital signature authentication services.

CIRCULAR

Regulations on documents and procedures related to issuing licenses, registration, and recognition for organizations providing digital signature certification services

This Circular stipulates the documents and procedures related to issuing licenses, registration, and recognition for organizations providing digital signature certification services, including:

______________________

MINISTER OF INFORMATION AND COMMUNICATIONS

Pursuant to the Law on Electronic Transactions dated November 29, 2005;

Pursuant to Decree No. 26/2007/NĐ-CP dated February 15, 2007 of the Government detailing the implementation of the Electronic Transactions Law regarding digital signatures and digital signature certification services;

BASED ON THE GOVERNMENT DECREE NO. 187/2007/NĐ-CP OF DECEMBER 25, 2007 ON THE FUNCTIONS, TASKS, POWERS, AND ORGANIZATIONAL STRUCTURE OF THE MINISTRY OF INFORMATION AND COMMUNICATIONS;

At the proposal of the Director of the Department of Information Technology Application,

c) Enterprises may be granted permission for no more than one block out of the total three dual-frequency blocks (FDD) B

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

1. Issuing licenses for providing public digital signature certification services;

2. Temporarily suspending or revoking licenses for providing public digital signature certification services;

3. Issuing digital certificates for organizations providing public digital signature certification services;

4. Registering activities of organizations providing specialized digital signature certification services;

This Circular applies to organizations providing public digital signature certification services; agencies and organizations providing specialized digital signature certification services; and foreign organizations requesting certificates recognizing digital signatures and certificates in Vietnam.

Article 2. Applicability

PART 1. DOCUMENTS

Chapter II

SPECIFIC PROVISIONS

Article 3. Documents for applying for a license to provide public digital signature certification services

1. The application for a license to provide public digital signature certification services shall comply with the provisions of Article 16 of Decree No. 26/2007/ND-CP, including:

a) An application form for a license to provide public digital signature certification services according to Appendix I of this Circular;

b) A certification regulation in accordance with Decision No. 59/2008/QD-BTTTT dated December 31, 2008 promulgating the list of mandatory standards applicable to digital signatures and digital signature certification services;

c) Detailed information about the personal background, qualifications, and credentials of the head, system management personnel, certificate issuance personnel, and other relevant staff members as prescribed in Clause 5 of Article 16 of Decree No. 26/2007/ND-CP.

2. The application for changes to the content of the license shall comply with the provisions of Clause 2 of Article 18 of Decree No. 26/2007/ND-CP, including:

a) A request for changes to the content of the license according to Appendix II of this Circular;

b) A report on the operation status must include the following contents: general situation; number of certificates issued classified by type of certificate; number of certificates revoked classified by type of certificate; total number of valid certificates classified by type of certificate.

3. In cases where a new license is requested pursuant to Clause 5 of Article 18 of Decree No. 26/2007/ND-CP, a request for a new license according to Appendix III of this Circular.

4. The application for extending the validity period of the license shall comply with the provisions of Clause 2 of Article 19 of Decree No. 26/2007/ND-CP, including:

a) An application for extension of the license to provide public digital signature certification services according to Appendix IV of this Circular;

b) A copy of the license to provide public digital signature certification services still valid for at least 60 days from the date of submission of the application for extension;

c) A report on the provision of service operations over the past three years as prescribed in point b of Clause 2 of this Article.

Article 4. Documents for applying for a digital certificate for an organization providing public digital signature certification services

1. A copy of the license to provide public digital signature certification services issued by the Ministry of Information and Communications.

2. Documents in accordance with Article 21 of Decree No. 26/2007/ND-CP, including:

a) An application for a digital certificate according to Appendix V of this Circular;

b) Documents specified in the certification regulation of the national digital signature certification service provider published on the website http://www.rootca.gov.vn.

3. The requirement for electronic issuance of digital certificates in accordance with the standard for digital signatures issued by the Ministry of Information and Communications. This requirement must be created by the organization providing public digital signature certification services and must correspond to its own key pair.

3. Request for issuance of electronic certificates in accordance with the standard for digital signatures issued by the Ministry of Information and Communications. This request must be generated by the organization providing public key infrastructure certification services and must correspond to its own key pair.

Article 5. Documents for registering the operation of organizations providing specialized digital signature certification services

1. A request for registration of the operation of organizations providing specialized digital signature certification services according to the model at Appendix VI of this Circular. The content of the organization's registration of operations providing specialized digital signature certification services shall comply with the provisions of Article 46 of Decree No. 26/2007/ND-CP.

2. Documents proving that the service recipients have the same nature of activities or work purposes and are linked to each other through the charter of operation or legal regulations stipulating the organizational structure or form of cooperation and joint activities in accordance with the requirements set out in Clause 2 of Article 4 of Decree No. 26/2007/ND-CP.

Article 6. Documents for applying for a certificate of qualification to ensure the security of digital signatures of organizations providing specialized digital signature certification services

The application for a certificate of qualification to ensure the security of digital signatures shall comply with the provisions of Article 49 of Decree No. 26/2007/ND-CP, including:

3. Detailed information about the personal background, qualifications, and certificates of the head, the person responsible for managing the system of equipment providing services, the person in charge of issuing digital certificates, and other related staff members.

Article 7. Documents for applying for recognition of foreign digital signatures and digital certificates

The application for recognition of foreign digital signatures and digital certificates shall comply with the provisions of Article 53 of Decree No. 26/2007/ND-CP, including:

1. An application for recognition of foreign digital signatures and digital certificates according to the model at Appendix VIII of this Circular.

2. The original content and a Vietnamese translation of international treaties containing provisions on the recognition of foreign digital signatures and digital certificates that Vietnam has signed or joined with the country where the organization providing digital signature certification services is registered to operate.

3. A certified true copy (with notarization or another lawful form of certification) of the license or certificate of qualification to operate in the field of digital signature certification services issued by the home country.

4. A certificate of the organization providing digital signature certification services currently operating, issued by the competent authority of the home country within three months prior to the date of submitting the application for registration.

5. Technical documents proving the reliability of the digital signatures and digital certificates issued by the foreign organization providing digital signature certification services, which must not be lower than the reliability of digital signatures and digital certificates issued by public digital signature certification service providers in Vietnam, and must meet the mandatory standards for digital signatures and digital signature certification services issued by the Ministry of Information and Communications.

6. A certified true copy of the license to establish a representative office in Vietnam.

Section 2. PROCEDURES

1. Submission and receipt of documents

Organizations applying for a license to provide public digital signature certification services (including new issuance, change of content, reissue, and extension of the license) submit the documents via postal mail or directly to the Ministry of Information and Communications (Information Technology Application Department), 18 Nguyen Du Street, Hai Ba Trung District, Hanoi City.

Within five working days from the date of receipt, the Ministry of Information and Communications will check the validity of the documents. In case the documents are invalid, the Ministry of Information and Communications will notify the organization applying for the license in writing to make corrections and supplements to the documents.

2. Examination of documents

The Ministry of Information and Communications will examine the documents and seek opinions from relevant agencies and units as prescribed. Agencies and units asked must provide examination opinions in writing and bear responsibility for issues in the documents under their management functions.

3. Decision on licensing

Within sixty working days from the date of receipt of valid documents, the Ministry of Information and Communications will decide to issue: a license; change the content of the license; reissue or extend the license. The license for providing public digital signature certification services is according to the model at Appendix IX of this Circular.

In case of non-approval, the Ministry of Information and Communications will send a written notification to the organization applying for the license, specifying the reasons.

Article 9. Procedures for temporarily suspending or revoking licenses to provide public digital signature certification services

1. An organization providing public digital signature certification services shall have its license temporarily suspended when one of the cases specified in Clause 1, Article 20 of Decree No. 26/2007/ND-CP occurs; its license shall be revoked when one of the cases specified in Clause 2, Article 20 of Decree No. 26/2007/ND-CP occurs.

2. Within fifteen working days from the date of the decision to temporarily suspend the license, if the organization whose license has been temporarily suspended fails to remedy the conditions leading to the suspension within the stipulated period, the Ministry of Information and Communications shall proceed to revoke the license in accordance with Point d, Clause 2, Article 20 of Decree No. 26/2007/ND-CP.

In other cases where licenses are revoked as provided for in Points a, b, and c, Clause 2, Article 20 of Decree No. 26/2007/ND-CP, the Ministry of Information and Communications shall issue a decision to revoke the license after notifying the organization in writing.

3. The Ministry of Information and Communications shall restore the license if the organization whose license has been temporarily suspended remedies the conditions leading to the suspension within the stipulated period.

4. An organization providing national digital signature certification services shall announce the temporary suspension, restoration, or revocation of the license on the website http://www.rootca.gov.vn and notify in writing any related organizations and individuals.

Article 10. Procedures for Issuing Digital Certificates to Organizations Providing Public Digital Signature Certification Services

An organization providing public digital signature certification services requesting issuance of a digital certificate shall submit five sets of application files (one original set and four copies) through postal service or directly to the National Digital Signature Certification Service Provider (National Digital Signature Certification Center) at address: No. 6 Chua Mot Cot Street, Ba Dinh District, Hanoi City.

Within five working days from the date of receiving the application files, the National Digital Signature Certification Service Provider shall examine the validity of the application files. If the application files are invalid, the National Digital Signature Certification Service Provider shall notify the organization requesting the digital certificate in writing to amend and supplement the application files.

2. Examination of documents

a) Within thirty days from the date of receiving valid application files, the National Digital Signature Certification Service Provider shall organize the examination of the application files and consider the request for issuance of a digital certificate.

b) If the public key of the organization requesting the digital certificate coincides with the public key of another organization already issued a digital certificate, the National Digital Signature Certification Service Provider shall request the organization to generate a new key pair.

c) Verify the actual conditions for issuing a digital certificate to the organization providing public digital signature certification services.

3. Issuance of Digital Certificate

a) The National Digital Signature Certification Service Provider shall issue a digital certificate to the organization requesting it if the application files are valid and all conditions are met.

b) The National Digital Signature Certification Service Provider shall transfer the digital certificate and the notification of issuance of the digital certificate to the organization requesting it and update the information on the website at http://www.rootca.gov.vn.

c) Maintain an online database of issued digital certificates at http://www.rootca.gov.vn.

1. Submission and acceptance of application forms Organizations providing specialized digital signature certification services submit registration applications through postal mail or directly at the Ministry of Information and Communications (Information Technology Application Department), 18 Nguyen Du Street, Hai Ba Truong District, Hanoi City.

2. Acceptance of registration

a) The Ministry of Information and Communications examines the registration application for specialized digital signature certification services;

b) Within sixty working days from the date of receiving valid applications, the Ministry of Information and Communications sends a notification accepting the registration of the organization's operation to provide specialized digital signature certification services according to the model in Appendix X of this Circular.

In case of non-approval, the Ministry of Information and Communications sends a notification to the applying organization, clearly stating the reasons.

1. Submission and receipt of documents

Organizations providing specialized digital signature certification services request issuance of certificates of qualification for ensuring the security of digital signatures by submitting applications through postal mail or directly at the Ministry of Information and Communications (Information Technology Application Department), 18 Nguyen Du Street, Hai Ba Truong District, Hanoi City.

Within five working days from the date of receiving the application, the Ministry of Information and Communications checks the validity of the application. If the application is invalid, the Ministry of Information and Communications notifies the requesting organization in writing to amend and supplement the application.

2. Examination of documents

The Ministry of Information and Communications will examine the documents and seek opinions from relevant agencies and units as prescribed. Agencies and units asked must provide examination opinions in writing and bear responsibility for issues in the documents under their management functions.

3. Issuance of certificates

Within sixty working days from the date of receiving valid applications, the Ministry of Information and Communications issues certificates of qualification for ensuring the security of digital signatures according to the model in Appendix XI of this Circular.

In case of non-approval, the Ministry of Information and Communications sends a notification to the requesting organization, clearly stating the reasons.

1. Submission and receipt of documents

Organizations providing foreign digital signature certification services request issuance of recognition certificates for foreign digital signatures and certificates by submitting applications through postal mail or directly at the Ministry of Information and Communications (Information Technology Application Department), 18 Nguyen Du Street, Hai Ba Truong District, Hanoi City.

Within five working days from the date of receiving the application, the Ministry of Information and Communications organizes the examination of the validity of the application. If the application is invalid, the Ministry of Information and Communications sends a notification to the requesting organization in writing to amend and supplement the application.

2. Examination of documents

The Ministry of Information and Communications reviews the application and solicits opinions from relevant agencies and units. Agencies and units asked must provide review opinions in writing and bear responsibility for issues within their management functions.

3. Issuance of recognition certificates

Within sixty working days from the date of receiving valid applications, the Ministry of Information and Communications issues recognition certificates for foreign digital signatures and certificates according to the model in Appendix XII of this Circular.

In case of non-approval, the Ministry of Information and Communications sends a notification to the requesting organization, clearly stating the reasons.

Article 14. Fees and Charges

Relevant agencies and organizations are responsible for paying fees and charges when implementing licensing, registration, and recognition procedures for organizations providing digital signature certification services. The National Digital Signature Certification Center organizes the collection and payment of fees and charges in accordance with regulations.

Chapter III

IMPLEMENTATION

Article 15. Responsibilities of the Department of Information Technology Application

1. Guide and inspect agencies and organizations in implementing procedures related to issuing licenses, registering, and recognizing digital signature certification services in accordance with the contents specified in this Circular.

2. Implement necessary measures to ensure the management of activities providing digital signature certification services.

3. Publish forms and relevant documents related to licensing, registration, and recognition of organizations providing digital signature certification services on the website http://www.rootca.gov.vn. The National Digital Signature Certification Center shall be responsible for guiding on the forms and updating information related to licensing, registration, and recognition of organizations providing digital signature certification services on this website.

Article 16. Effective Date

1. This Circular takes effect from February 1, 2010.

2. During implementation, if any issues arise or difficulties occur, individuals and units concerned must promptly report them to the Ministry of Information and Communications for review, supplementation, and amendment.