Circular No. 46/2025/TT-NHNN stipulates the management and use of the computer network of the State Bank of Vietnam

CIRCULAR

Regulations on management and use of computer networks

of the State Bank of Vietnam

Pursuant to the Law on the State Bank of Vietnam No. 46/2010/QH12;

Pursuant to the Law on Information Technology No. 67/2006/QH11;

Pursuant to the Cybersecurity Law No. 24/2018/QH14;

Pursuant to the Law on Information Security No. 86/2015/QH13;

Pursuant to the Law on Protection of State Secrets No. 29/2018/QH14;

Pursuant to Decree No. 26/2025/NĐ-CP of the Government stipulating the functions, tasks, powers, and organizational structure of the State Bank of Vietnam;

Decree No. Decree No. 64/2007/NĐ-CP of the Government on the application of Information Technology in state agency activities;

Pursuant to Decree No. 147/2024/NĐ-CP of the Government on management, provision, and use of Internet services and information on networks;

Decree No. Decree No. 53/2022/NĐ-CP of the Government detailing certain provisions of the Cybersecurity Law;

At the proposal of the Director of the Department of Information Technology;

The Governor of the State Bank of Vietnam issues this Circular stipulating the management and use of the State Bank of Vietnam's computer network.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

Article 1. This Circular stipulates the management and use of the State Bank of Vietnam's computer network (hereinafter referred to as the State Bank Network).

Article 2. Public service units under the organizational structure of the State Bank of Vietnam may connect and use the State Bank Network according to the guidance of the Department of Information Technology.

Article 2. Applicability

This Circular applies to:

1. Individuals who are officers, civil servants, officials, and employees under the jurisdiction of the State Bank of Vietnam.

2. Units under the State Bank of Vietnam.

3. External organizations connecting and using the State Bank Network.

Article 3. Explanation of Terms

In this Circular, the following terms shall be understood as follows:

1. Units under the State Bank of Vietnam are administrative organizations under the organizational structure of the State Bank of Vietnam.

2. Asset Management Unit is a unit under the State Bank of Vietnam assigned the task of managing assets.

3. Asset Usage Unit is a unit under the State Bank of Vietnam assigned the task of using assets.

4. State Bank Network User (hereinafter referred to as the user) is an individual or a unit under the State Bank of Vietnam granted permission to connect and use the State Bank Network.

5. Technical Staff is a person trained in information technology and assigned the task of managing and operating the information technology system.

6. External Organizations Connecting and Using the State Bank Network (hereinafter referred to as external organizations) include credit institutions, foreign bank branches, service providers for intermediary payment services, credit information companies, and other organizations connecting and using the State Bank Network.

7. Data Center is the State Bank of Vietnam's data center, including the main data center and the backup data center.

8. State Bank Network includes the State Bank of Vietnam's local area network and wide area network.

9. State Bank of Vietnam Local Area Network is a network system connecting terminal devices within a working area at the State Bank of Vietnam headquarters.

10. State Bank of Vietnam Wide Area Network is a network system connecting the Data Center with the State Bank of Vietnam's local area networks.

11. Internet Network is a system providing Internet services to users at the State Bank of Vietnam.

12. Wireless Network is a system connecting terminal devices through radio waves.

13. Terminal Device includes workstations, printers, scanners, fax machines, telephones using IP addresses, various types of mobile smart devices with network connections.

14. Wide Area Network Transmission Infrastructure is a system of transmission channels leased from telecommunications service providers.

15. Local Area Network Transmission Infrastructure is an internal cable transmission system and network connection ports.

16. Network equipment includes switches, routers, transmission devices, network security devices, load balancers, system software, and network monitoring software.

17. Core Network Layer is the core layer of the network system responsible for connecting different layers of the network.

18. Distribution Network Layer is the layer responsible for serving as an interface between the access network layer and the core network layer.

19. Access Network Layer serves to connect users to systems.

20. Network Segmentation are separate regions within the local area network divided based on the type of user and purpose of use, including: business server network segments, intermediate network segments (DMZ) for providing services on the Internet, wireless network segments for providing wireless network services, network management segments for monitoring and managing the State Bank Network, and other network segments.

21. Identifier Name is a unique name assigned to terminal devices connecting and accessing the State Bank Network.

22. Video Conferencing Service is a technology for transmitting images and sound over an information network using the TCP/IP protocol suite.

Article 4. Bank of Vietnam Network Architecture

1. Bank of Vietnam Logical Network Architecture:

a) The Bank of Vietnam Local Area Network logical architecture includes the following main layers: core network layer, distribution network layer, access network layer;

b) The Bank of Vietnam Local Area Network logical architecture is organized into zones:

(i) The Bank of Vietnam Local Area Network at the Data Center includes the following main zones: business server network zone, Internet network zone, internal connection network zone, external organization connection network zone, DMZ zone, and management network zone;

(ii) The Local Area Network at units under the Bank of Vietnam includes the following main zones: internal connection network zone, external organization connection network zone, Internet network zone, and management network zone.

c) The Bank of Vietnam Wide Area Network architecture includes connections between the main Data Center and the backup Data Center; the Data Center with units within the organizational structure of the Bank of Vietnam; communication gateways connecting the Bank of Vietnam with external organizations.

2. Bank of Vietnam Physical Network Architecture includes: networking equipment, local area network transmission infrastructure, and wide area network transmission infrastructure.

3. The local area network system is divided into network zones according to the scope of access and control of access between network zones using firewalls.

Article 5. Principles for Building, Managing, and Using the Bank of Vietnam Network

1. The Bank of Vietnam Network must be designed and constructed with expandability capabilities and advanced networking technology, high availability, ensuring security, confidentiality, and bandwidth meeting the operational and business needs of the Bank of Vietnam, ensuring connectivity, interoperability, and synchronization with dedicated data transmission networks.

2. The Bank of Vietnam Network is designed and constructed towards smart networking, virtualizing network infrastructure to optimize network resource management and usage, and support cloud computing for the Bank of Vietnam.

3. The Bank of Vietnam Network is centrally and uniformly managed by the Information Technology Department and there is a division of responsibilities and hierarchical management for asset management units.

4. Users may only use the Bank of Vietnam Network to serve assigned professional and business activities.

5. The use and sharing of information on the Bank of Vietnam Network must comply with the Bank of Vietnam's regulations on system information security and relevant laws.

6. Users who do not comply with Article 23 of this Circular will have their Bank of Vietnam Network services suspended.

7. External organizations that do not comply with Article 15 of this Circular will be considered for disconnection from the Bank of Vietnam Network.

8. Network inspection, maintenance, new installation, and upgrades for the Bank of Vietnam Network shall not disrupt and affect the Bank of Vietnam's business operations.

Article 6. Bank of Vietnam Network Resources and Services

1. Bank of Vietnam Network Resources include:

a) Transmission infrastructure, networking equipment;

b) IP address system, domain name system, device identifier names.

2. Bank of Vietnam Network Services include: data transmission service, video conferencing service, network monitoring and management service, and other network services.

Article 7. Ensuring the Readiness and Security of the State Bank of Vietnam's Network System

1. The State Bank of Vietnam's network must be equipped with technical systems for managing and monitoring the network to detect and prevent unauthorized access and ensure the security of data exchanged on the network environment.

2. Connections between external organizations' networks and the State Bank of Vietnam's network must be controlled by cybersecurity systems and comply with legal regulations and the State Bank of Vietnam’s regulations on information system security in banking operations.

3. Connections between the State Bank of Vietnam and central units of external organizations must be implemented through at least two (2) independent infrastructure transmission lines and routes.

4. Data exchanged between the State Bank of Vietnam's network and external organizations must be encrypted during transmission using appropriate secure encryption solutions and protocols to ensure confidentiality, integrity, and authentication of the data.

5. Terminal devices connecting to and utilizing resources and services of the State Bank of Vietnam's network must:

a) Be authenticated by the State Bank of Vietnam's network security system before being allowed access;

b) Install and maintain anti-malware software with automatic update and periodic scanning functions;

c) Update operating system and application software patches for security vulnerabilities at least three (3) times a year according to the guidance of the Information Technology Department.

6. Network equipment at the Data Center must be established and maintained in operation under a high availability (HA) mechanism.

Chapter II

SPECIFIC PROVISIONS

Section 1.

THE NETWORK OF THE STATE BANK OF VIETNAM'S DEPARTMENTS AND BRANCHES

Article 8. Provisions on New Installation, Upgrade, and Repair

1. Activities involving new installation, upgrade, or repair of the State Bank of Vietnam's local area network must meet the requirements of the State Bank of Vietnam's network architecture as stipulated in Article 4 of this Circular and the regulation on information system security management of the State Bank of Vietnam, and comply with the regulations on managing investment applications of information technology within the State Bank of Vietnam system.

2. For new installation and upgrade of transmission infrastructure of the local area network: property management units prepare design documentation for the transmission infrastructure and submit it to the Information Technology Department for technical review before submitting to the competent authority for approval.

3. For new installation and upgrade of network equipment: annually, the Information Technology Department implements according to the State Bank of Vietnam’s regulations on managing and implementing investments for information technology applications within the State Bank of Vietnam system.

4. Local area network repairs must ensure that the technical configuration and design of the local area network at the unit remain unchanged.

5. For repairs of local area network transmission infrastructure:

a) When a unit using the asset but not being the asset management unit has a need for repair, it must notify the asset management unit in writing;

b) The asset management unit proactively organizes the repair in compliance with the Financial Management Regulation of the State Bank of Vietnam and notifies the Information Technology Department in writing for technical coordination before implementation.

6. For repairs of network equipment, the asset management unit must notify the Information Technology Department for coordination to determine the status of the equipment and handle as follows:

a) For equipment still within warranty period or already signed maintenance contracts, equipment repair shall be carried out according to the signed contract;

b) For equipment beyond warranty period and without maintenance contracts, the asset management unit shall organize the repair in compliance with the Financial Management Regulation of the State Bank of Vietnam and notify the Information Technology Department in writing for technical coordination.

7. The asset management unit must establish, update, and store design documents and completion drawings of the local area network when installing new, upgrading, or repairing.

Article 9. Provisions on maintenance, regular inspection, and handling of incidents

1. Provisions on maintenance:

a) The local network of the State Bank at the Data Center must be maintained regularly at least twice a year; the local network at units under the State Bank must be maintained regularly at least once a year;

b) The maintenance process must be recorded regarding the operational status before and after maintenance;

c) For equipment still within warranty period or with maintenance contracts signed, maintenance shall be carried out according to the signed contracts;

d) In cases where network equipment has exceeded the warranty period and there is no maintenance contract, the following actions shall be taken:

(i) The Information Technology Department shall establish a network maintenance procedure for asset management units and coordinate remote maintenance of network equipment;

(ii) Asset management units shall carry out maintenance of network equipment managed by the unit according to the network maintenance procedure issued by the Information Technology Department.

đ) Asset management units are responsible for maintaining the transmission infrastructure managed by the unit.

2. Provisions on regular inspection:

a) The Information Technology Department shall establish and issue a regular inspection procedure for the local network system;

b) Asset management units shall conduct regular inspections of the local network system according to the regular inspection procedure for the local network system issued by the Information Technology Department.

3. Provisions on handling incidents:

a) The Information Technology Department shall establish and issue procedures and guidelines for incident handling;

b) When incidents occur, asset management units shall record them and handle the incidents according to the procedures and guidelines of the Information Technology Department. For incidents not covered in the procedures and guidelines or those that have been handled according to the procedures and guidelines but remain unresolved, asset management units shall notify the Information Technology Department for coordination in handling;

c) In cases where incidents are handled by the Information Technology Department, notifications shall be made to asset management units and asset using units regarding the time and plan for resolution;

d) The Information Technology Department shall periodically compile monthly reports on technical incident handling situations of the State Bank for monitoring and preventing recurrence.

Article 10. Provisions on access and use

1. Terminal devices must comply with the State Bank's security regulations, and are only permitted to connect to the access network layer.

2. Terminal devices accessing the State Bank's network must be assigned and used with correct IP addresses and device identification names as stipulated by the Information Technology Department.

Section 2.

THE STATE BANK WIDE AREA NETWORK

Article 11. Provisions on new installation, upgrade, and repair

1. Annually, the Information Technology Department shall develop plans for new installation or upgrading of the State Bank's wide area network, to be submitted for approval by competent authorities. The Information Technology Department shall implement new installations and upgrades of the State Bank's wide area network according to the approved plans.

2. The Information Technology Department shall organize and implement repairs of State Bank's wide area network equipment.

Article 12. Provisions on maintenance, regular inspection, and handling of incidents

1. Provisions on maintenance:

a) The State Bank's wide area network must be maintained regularly at least twice a year, including one on-site maintenance and one remote maintenance;

b) The maintenance process must be carried out strictly according to the approved script, recording the operational status before and after maintenance;

c) The Information Technology Department shall develop plans and solutions for maintenance, take the lead, and notify asset management units and asset using units to cooperate in implementing maintenance. In cases of hiring maintenance services, the Information Technology Department shall follow current regulations;

d) Asset management units shall cooperate with the Information Technology Department in implementing and confirming the results of maintenance.

2. Provisions on regular inspection and handling of incidents:

a) The Information Technology Department shall establish and issue procedures and guidelines for regular inspection and incident handling;

b) Asset management units shall conduct regular inspections, record them, handle incidents, and report results according to the procedures and guidelines of the Information Technology Department;

c) External organizations shall report incidents according to the information reception and incident handling procedures set forth in Appendix II attached to this Circular and the guidelines of the Information Technology Department.

Article 13. Provisions on management

The Information Technology Department shall be responsible for:

1. Managing and centrally controlling the wide area network of the State Bank of Vietnam.

2. Developing, updating, and storing design documents and as-built drawings of the wide area network of the State Bank of Vietnam when installing new equipment, upgrading, or repairing.

3. Recording daily activities and preparing periodic comprehensive system reports for the wide area network of the State Bank of Vietnam once every six months.

Section 3.

CONNECTION TO THE STATE BANK OF VIETNAM NETWORK

Article 14. Management of Network Connection to the State Bank of Vietnam

1. The State Bank of Vietnam (Information Technology Department) shall uniformly manage the connection methods and IP address ranges for external organizations' end devices when connecting to the State Bank of Vietnam network.

2. External organizations shall implement connections, changes, or disconnections from the State Bank of Vietnam network in accordance with Article 16 of this Circular.

3. In cases where there are changes or additions to equipment or connection paths to the State Bank of Vietnam network, external organizations shall submit written documents, design materials, configurations, and implementation plans to the Information Technology Department before deployment.

Article 15. Requirements for External Organizations When Connecting to the State Bank of Vietnam Network

1. Adhering to regulations and guidelines regarding the connection methods to the State Bank of Vietnam network.

2. Ensuring security according to the State Bank of Vietnam's information system security regulations for end devices, network equipment, and connection paths to the State Bank of Vietnam network.

3. Having sufficient technical equipment to connect to the network and ensure information security on the connection path in accordance with current State Bank of Vietnam regulations.

4. Having a technical staff team with the capability to manage connected end devices and network equipment of the organization.

5. Selecting service providers for transmission lines, bandwidth, paying installation costs, subscription fees, repair costs, and maintenance costs for the connection paths to the State Bank of Vietnam network.

Article 16. Guidelines for Implementing Connections, Changes, or Disconnections from the State Bank of Vietnam Network

1. External organizations, when needing to connect, change, or disconnect, shall submit request letters according to the model attached as Appendix I of this Circular to the State Bank of Vietnam (Information Technology Department) through one of the following methods:

a) Electronic application submitted online at the National Public Service Portal;

b) Paper documents submitted directly at the One-Stop Service Center of the State Bank of Vietnam or sent via postal services. The Information Technology Department will only accept and process paper documents in cases where the National Public Service Portal cannot operate due to technical issues. If external organizations have already submitted electronic documents through the National Public Service Portal, the Information Technology Department will not accept and process paper documents.

2. Within five working days from the date of receipt of the request letter, the Information Technology Department shall notify relevant units and provide guidance on implementing connections, changes, or disconnections.

Section 4.

INTERNET CONNECTION

Article 17. Management of Internet Connection

1. Computers belonging to the local area network of the State Bank of Vietnam must connect to the Internet through centralized ports established and managed by the Information Technology Department.

2. Computers belonging to the local area network of the State Bank of Vietnam that use information systems with a level of three or higher, as stipulated by the Government for ensuring information system security levels, shall not be allowed to connect to the Internet.

3. Computers not belonging to the local area network of the State Bank of Vietnam that connect to the Internet shall be decided by the head of the unit using the assets and must comply with the State Bank of Vietnam's regulations on information system security in banking operations and related laws.

Article 18. Requirements for Internet Connection

1. Terminal devices connecting to the Internet through the centralized connection port managed by the Information Technology Department must participate in the State Bank of Vietnam's Domain, install anti-malware software, security software, and be updated with system patches and other software according to the guidance of the Information Technology Department.

2. Users connecting to the Internet through the centralized connection port managed by the Information Technology Department must use access accounts issued by the Information Technology Department.

Article 19. Provisions on Monitoring and Controlling Internet Connections

1. The Information Technology Department is responsible for establishing a cybersecurity system to ensure security between the State Bank of Vietnam's network and the Internet.

2. The Information Technology Department is responsible for managing, setting policies, and controlling devices within the State Bank of Vietnam's network that connect to the Internet.

3. The Information Technology Department manages, monitors, and issues Internet access accounts to users. In necessary cases, to ensure the safety of the State Bank of Vietnam's network system, the Information Technology Department has the right to proactively suspend or revoke Internet access accounts and notify individuals or units using such accounts.

Article 20. Provisions on Wireless Network and Mobile Device Connections

1. The wireless network system connecting to the Internet of the State Bank of Vietnam must be designed and constructed independently from the State Bank of Vietnam's network system.

2. The Information Technology Department manages the activities of network devices providing wireless Internet services and controls wireless network access devices to the State Bank of Vietnam's network.

Section 5.

RESPONSIBILITIES IN MANAGING AND USING THE STATE BANK OF VIETNAM'S NETWORK

Article 21. Responsibilities of the Information Technology Department

1. Managing the technical aspects of the State Bank of Vietnam's network.

2. Managing the issuance and use of resources in the State Bank of Vietnam's network within the scope of delegated management.

3. Providing detailed guidance on methods and conditions for connecting to the State Bank of Vietnam's network suitable for specific requirements of each information system.

4. Monitoring and supervising the operation of the State Bank of Vietnam's network system to ensure continuous, stable, and secure operations.

5. Warning and guiding State Bank of Vietnam units to address security vulnerabilities and risks to the network's operation after detection and assessment of their severity.

6. Notifying asset management units and external organizations at least three working days before temporarily suspending network service provision for maintenance, upgrades, or repairs.

7. Organizing inspections of external organizations' network connections to the State Bank of Vietnam's network.

8. Researching and applying advanced technologies to build, manage, and operate the State Bank of Vietnam's network in a centralized and unified manner.

9. Researching and building the State Bank of Vietnam's network infrastructure to operate in an active-active mode between data centers.

10. Developing content and coordinating the organization of training and guidance for State Bank of Vietnam units and individuals regarding the management and use of the State Bank of Vietnam's network.

11. Performing other tasks as stipulated in this Circular.

Article 22. Responsibilities of the asset management unit

1. Organize guidance and inspection of the use of local networks managed by the unit.

2. Coordinate with the Information Technology Department in connecting, changing connections, and disconnecting networks for organizations connected to their own unit.

3. Inspect network connections from external organizations to the State Bank of Vietnam through the connection gate established and managed by the Information Technology Department.

4. Coordinate with the Information Technology Department in managing network connections from external organizations that connect to their unit.

5. Assign technical staff to manage network equipment and provide technical support, coordinate in handling incidents arising with the equipment assigned to their management.

6. Ensure necessary conditions for network equipment at the unit to operate safely and stably.

Article 23. Responsibilities of users and units using assets

1. Use resources and exploit information on the State Bank of Vietnam's network and the Internet within permitted limits and subject to supervision and control by the Information Technology Department.

2. Comply with the State Bank of Vietnam’s regulations on information system security in banking operations and related laws.

3. Comply with the State Bank of Vietnam’s and relevant laws’ provisions regarding network connection, use, and exploitation of the Internet.

4. Only install tools and software as prescribed by the State Bank of Vietnam when participating in the State Bank of Vietnam’s network system.

5. In case of incidents or signs of insecurity while using the State Bank of Vietnam’s network, report to the technical staff at the asset management unit for guidance and assistance in resolution.

6. Coordinate with technical staff at the asset management unit in incident handling and confirmation of incident resolution results.

Chapter III

IMPLEMENTING PROVISIONS

Article 24. Effective Date

This Circular takes effect from January 15, 2026, and replaces Circular No. 34/2018/TT-NHNN dated December 24, 2018, issued by the Governor of the State Bank of Vietnam on the management and use of computer networks of the State Bank of Vietnam.

Article 25. Responsibilities for Implementation

Heads of units under the State Bank of Vietnam are responsible for implementing this Circular./.