Decree No. 85/2016/NĐ-CP on ensuring the security of information systems according to levels

 DECREE

ON ENSURING INFORMATION SYSTEM SECURITY AT DIFFERENT LEVELS

 Pursuant to the Law on Government Organization dated June 19, 2015;

Pursuant to the Law on Information Security promulgated on December 19, 11 Pursuant to Decree No. 32/2019/NĐ-CP dated April 10, 2019 of the Government on assigning tasks, procurement or tendering for the supply of products and services using state budget from regular operating expenses;15;

At the proposal of the Minister of Information and Communications;

Government Decree on ensuring information system security at different levels is hereby issued.

 PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

This Decree provides detailed regulations on criteria, authority, procedures, and formalities for determining the level of information system security and responsibilities for ensuring information system security at each level.

Article 2. Applicability

This Decree applies to agencies, organizations, and individuals participating in or related to activities of constructing, establishing, managing, operating, upgrading, and expanding information systems in Vietnam serving the application of information technology in the operations of state agencies and organizations, and the provision of online services using information technology to serve citizens and businesses.

It is encouraged that other relevant organizations and individuals apply the provisions of this Decree to protect information systems.

Article 3. Explanation of Terms

In this Decree, the following terms are understood as follows:

1. The information system manager is the agency, organization, or individual with direct management authority over the information system. For state agencies and organizations, the information system manager is ministries, ministerial-level agencies, government-affiliated agencies, provincial People's Committees, centrally governed municipalities, or the competent authority deciding to invest in projects for constructing, establishing, upgrading, and expanding the information system.

2. Information processing involves performing one or more actions to create, provide, collect, edit, use, store, transmit, share, exchange information on a network.

3. The information system operation unit is the agency or organization entrusted by the information system manager to operate the information system. In cases where the information system manager outsources information technology services, the information system operation unit is the service provider.

4. The specialized information technology unit is the specialized information technology unit of ministries, ministerial-level agencies, government-affiliated agencies; Provincial Departments of Information and Communications, centrally governed municipalities, or the specialized information technology unit of the information system manager designated by the information system manager.

5. The specialized information security unit is the unit responsible for ensuring information security for the information system manager.

6. The specialized information security department is the department established or designated by the information system manager to implement tasks of ensuring information security and responding to information security incidents.

7. Online service is a service provided by enterprises or state agencies through a network environment to organizations and individuals.

Article 4. Principles for Ensuring Information System Security at Different Levels

1. Ensuring information system security at different levels in the operations of agencies and organizations is carried out continuously from the design, construction, operation stages until the system is decommissioned; it must comply with technical standards and norms.

2. Ensuring information system security at different levels in the operations of agencies and organizations is implemented comprehensively, synchronously, and centrally in investment solutions for protection, sharing resources to optimize performance, avoiding excessive and redundant investments.

3. Allocation and deployment of resources to ensure information system security are prioritized from higher levels to lower levels.

Article 5. Principles for Determining Level

1. The determination of the information system to determine the level is based on the following principles:

a) The information system has only one managing entity for the information system;

b) The information system can operate independently, established to directly serve or support specific business, production, or commercial activities of agencies or organizations within one of the types of information systems specified in Clause 2, Article 6 of this Decree.

2. In cases where the information system includes multiple component systems, each component system corresponds to a different level, the level of the information system is determined as the highest level among the levels of the component systems that make up the system.

Chapter II

CRITERIA FOR DETERMINING LEVEL

Article 6. Classification of Information and Information Systems

1. Information processed through the information system is classified according to its confidential attributes as follows:

a) Public information is information on a network of an organization or individual that is openly available to all entities without needing to identify the specific identity or address of those entities;

b) Personal information is information on a network of an organization or individual that the organization or individual does not openly disclose or only discloses to one or a group of entities whose identities and specific addresses have been identified;

c) Individual information is information on a network linked to identifying the specific identity of an individual;

d) State secret information is information at the Confidential, Top Secret, or Absolute Secret levels as defined by laws on protecting state secrets.

2. Information systems are classified according to their functions serving business operations as follows:

a) Internal business information systems are systems that solely serve internal management and operation activities of agencies or organizations;

b) Citizen and business service information systems are systems that directly or support providing online services, including online public services and other online services in telecommunications, information technology, commerce, finance, banking, healthcare, education, and other specialized fields;

c) Information infrastructure systems are collections of equipment, transmission lines connecting to provide common services for the activities of multiple agencies or organizations such as wide area networks, databases, data centers, cloud computing; electronic authentication, electronic certification, digital signatures; interconnection of information systems;

d) Industrial control information systems are systems with functions to monitor, collect data, manage, and control important components serving the normal operation of construction projects;

e) Other information systems.

Article 7. Criteria for Determining Level 1

An information system at Level 1 is an information system serving internal activities of agencies or organizations and only processes public information.

Article 8. Criteria for Determining Level 2

An information system at Level 2 is an information system that meets one of the following specific criteria:

1. An information system serving internal activities of agencies or organizations and processing personal information, individual information of users but not processing state secret information;

2. An information system serving citizens and businesses belonging to one of the following types:

a) Providing online public services from Level 2 downwards as prescribed by law;

b) Providing online services not included in the list of conditional business services;

c) Providing other online services processing personal information, individual information of less than 10,000 users;

3. Information infrastructure systems serving the activities of one agency or organization.

Article 9. Criteria for determining Level 3

A Level 3 information system is an information system that meets one of the following specific criteria:

1. An information system processing state secrets or serving national defense and security, which, if destroyed, would harm national defense and security.

2. An information system serving citizens and businesses belonging to one of the following types:

a) Providing online public services at Level 3 or higher as prescribed by law;

b) Providing online services within the list of business services with conditions;

c) Providing other online services that process personal information of ten thousand users or more.

3. A shared information infrastructure system serving the operations of agencies and organizations within a sector, province, or multiple provinces.

4. An industrial control information system directly serving the control and operation of normal activities of construction projects classified as Level II, III, or IV under the classification of laws on construction.

Article 10. Criteria for determining Level 4

A Level 4 information system is an information system that meets one of the following specific criteria:

1. An information system processing state secrets or serving national defense and security, which, if destroyed, would cause serious harm to national defense and security.

2. A national information system serving the development of e-Government, requiring 24/7 operation without prior shutdown plans.

3. A shared information infrastructure system serving the operations of agencies and organizations nationwide, requiring 24/7 operation without prior shutdown plans.

4. An industrial control information system directly serving the control and operation of normal activities of construction projects classified as Level I under the classification of laws on construction or important constructions related to national security according to laws on national security.

Article 11. Criteria for determining Level 5

A Level 5 information system is an information system that meets one of the following specific criteria:

1. An information system processing state secrets or serving national defense and security, which, if destroyed, would cause particularly serious harm to national defense and security.

2. An information system serving centralized data storage for certain types of particularly important national information.

3. A national information infrastructure system serving the connection and interoperability of Vietnam's operations with international operations.

4. An industrial control information system directly serving the control and operation of normal activities of construction projects classified as special level under the classification of laws on construction or important constructions related to national security according to laws on national security.

5. Other information systems as decided by the Prime Minister.

Chapter III

AUTHORITY, PROCEDURES, AND PROCEDURAL REQUIREMENTS FOR DETERMINING LEVELS

Article 12. Authority for Reviewing and Approving Levels

1. For information systems proposed to be Level 1 or Level 2:

The specialized unit responsible for information security of the information system’s management body shall conduct the review and approve the proposal for the level of information systems proposed to be Level 1 or Level 2.

2. For information systems proposed to be Level 3:

a) The specialized unit responsible for information security of the information system’s management body shall conduct the review of the proposal for the level;

b) The management body of the information system shall approve the proposal for the level.

3. For information systems proposed to be Level 4 or Level 5:

a) The Ministry of Information and Communications shall lead and coordinate with the Ministry of National Defense, the Ministry of Public Security, and relevant ministries and sectors to conduct the review of the proposal for the level, except for cases stipulated in points b and c of Clause 3 of this Article;

b) The Ministry of National Defense shall lead and coordinate with the Ministry of Information and Communications and relevant ministries and sectors to conduct the review of the proposal for the level for information systems managed by the Ministry of National Defense;

c) The Ministry of Public Security shall lead and coordinate with the Ministry of Information and Communications and relevant ministries and sectors to conduct the review of the proposal for the level for information systems managed by the Ministry of Public Security;

d) The management body of the information system shall approve the proposal for the level for information systems at Level 4; approve the plan to ensure information security for information systems at Level 5;

đ) The Prime Minister shall approve the List of Level 5 Information Systems (List of Important National Information Systems).

Article 13. Procedures and formalities for determining the level for new construction investment projects or expansion and upgrading information systems

1. The project investor shall prepare a description of the proposed level, incorporated into the content of the feasibility study report, the feasible application technology project, or the investment report of the project, to be submitted to the competent authority for examination, and to submit the feasibility study report; the feasible application technology project, or the investment report according to the laws on investment and this Decree.

2. In cases where information technology services are leased, the main leasing unit shall prepare a description of the proposed level, incorporated into the content of the plan or service leasing project, to be submitted to the competent authority for examination, and to submit it for approval by the competent authority according to the laws on leasing information technology services and this Decree.

3. The documentation describing the proposed level as stipulated in Article 15 of this Decree.

Article 14. Procedures and formalities for determining the level for operating information systems

1. Preparing the proposal for level determination:

a) The system operation unit shall prepare the proposal for level determination according to the provisions of Article 15 of this Decree;

b) For information systems proposed at Level 1 or Level 2:

The system operation unit shall submit the proposal for level determination to the examining unit for examination according to Clause 1 of Article 12 of this Decree;

c) For information systems proposed at Level 3:

The system operation unit shall submit the proposal for level determination to the examining unit for examination according to Point a, Clause 2 of Article 12 of this Decree;

d) For information systems proposed at Level 4 or Level 5:

- The system operation unit shall submit the proposal for level determination to the specialized unit on information security of the system management entity to seek professional opinions on the suitability of the proposed level and the information system security assurance plan according to the level;

- The system operation unit shall submit the proposal for level determination to the system management entity for submission to the examining authority specified in Points a, b, or c, Clause 3 of Article 12 of this Decree.

2. Examining the proposal for level determination:

The competent authority shall examine the proposal for level determination according to the provisions of Article 16 of this Decree.

3. Approving the proposal for level determination:

a) For information systems proposed at Level 1 or Level 2:

The specialized unit on information security of the system management entity shall approve the proposal for level determination and report back to the system management entity;

b) For information systems proposed at Level 3 or Level 4:

The system operation unit shall submit the proposal for level determination to the system management entity for approval;

c) For information systems proposed at Level 5:

- Based on the results of the examination of the proposal for level determination, the Ministry of Information and Communications shall take the lead, in coordination with the Ministry of National Defense, the Ministry of Public Security, and relevant ministries and sectors, to submit to the Prime Minister for approval the List of Level 5 Information Systems;

- The system operation unit shall submit the proposal for level determination to the system management entity for approval of the information security assurance plan.

Article 15. Documents for Level Proposal

The documents for level proposal include:

1. Documentation describing and generally explaining the information system.

2. Design documentation, which may be one of the following:

a) For new investment projects to build or expand, upgrade the information system: Preliminary design or equivalent documentation;

b) For operational information systems: Construction design that has been approved by competent authorities or equivalent documentation.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

5. Professional opinions from specialized units responsible for information security of the management entity regarding the proposed level 4 or level 5 information systems.

Article 16. Review of Level Proposal Documents

1. Content of review of level proposal documents:

a) Suitability of the proposed level;

b) Suitability of the security assurance plan for the information system in preliminary design, construction design, or equivalent documentation according to the corresponding level;

c) Suitability of the security assurance plan during the operation of the information system according to the corresponding level.

2. Time limit for reviewing level proposal documents:

a) For information systems proposing level 3, the maximum review time is 15 days from the date of receipt of complete valid documents;

b) For information systems proposing level 4 or level 5, the maximum review time is 30 days from the date of receipt of complete valid documents.

Article 17. Approval Documents for Level Proposal

1. Approval documents for level proposal include:

a) Level proposal documents;

b) Review opinions of the leading agency conducting the review for information systems proposing levels 3 and above.

2. Processing time for approval documents:

The maximum processing time is seven working days from the date of receipt of complete valid documents.

Article 18. Procedures and Formalities for Re-determining Levels for Approved Information Systems

For information systems that have already been approved at a level, if it is necessary to re-determine the level to suit the actual situation, the initial determination procedures and formalities shall be followed.

Chapter IV

RESPONSIBILITIES FOR INFORMATION SYSTEM SECURITY

Article 19. Security Assurance Plan for Information Systems According to Level

1. The security assurance plan for information systems must meet basic requirements in technical standards and regulations on information system security according to the level.

2. The security assurance plan for information systems includes the following contents:

a) Ensuring security in the design and construction phase;

b) Ensuring security during operation;

c) Inspection and evaluation of information security;

d) Management of information security risks;

đ) Monitoring of information security;

e) Prevention, response to incidents, and post-disaster recovery;

g) Termination of operation, exploitation, liquidation, and cancellation.

Article 20. Responsibilities of the Management Entity of Information Systems

1. The head of the agency or organization managing the information system is responsible for:

a) Directly directing and overseeing information security work within their own agency or organization;

b) In cases where there is no independent specialized unit for information security:

- Appointing the specialized unit for information technology to perform the duties of the specialized unit for information security;

- Establishing or appointing a specialized department for information security under the specialized unit for information technology.

2. The management entity of information systems is responsible for:

a) Directing the operating unit of the information system to prepare the level proposal documents; organizing the review and approval of the level proposal documents in accordance with this Decree;

b) Directing and implementing the security assurance plan for information systems according to the level for systems under their management as stipulated in Articles 25, 26, and 27 of the Cybersecurity Law, this Decree, and related laws;

c) Directing and implementing inspection, evaluation of information security, and risk management within their agency or organization, specifically as follows:

- Conducting comprehensive inspection, evaluation of information security, and risk management every two years within their own agency or organization;

- Conducting inspection, evaluation of information security, and risk management annually for systems at level 3 and level 4;

- Conducting inspection, evaluation of information security, and risk management every six months (or at any time deemed necessary or upon request or warning from competent authorities) for systems at level 5;

- Inspection, evaluation of information security, and risk assessment for systems at level 3 and above must be carried out by specialized organizations authorized by competent authorities; state-run organizations with appropriate functions and tasks, or by specialized organizations designated by competent authorities.

d) Directing and implementing short-term training, dissemination, promotion, and raising awareness about information security, specifically as follows:

- Providing short-term training programs to enhance knowledge and skills in information security for staff involved in information security within their own agency or organization;

- Disseminating and promoting awareness about information security among staff within their own agency or organization;

- Conducting information security drills within their own agency or organization; participating in national and international drills organized by the Ministry of Information and Communications.

đ) Directing the operating unit of the information system to coordinate with relevant functional units of the Ministry of Information and Communications in deploying equipment, connecting to technical systems for processing, reducing cyber attacks, and supporting monitoring of information security for online public service systems, and developing electronic government.

Article 21. Responsibilities of the specialized unit for information security of the system's management authority

1. Advising, organizing enforcement, urging, inspecting, and supervising information security work.

2. Reviewing, approving, or providing comments on the technical aspects of the application files for classification levels as prescribed in Clause 1, Clause 2, Article 12 and Clause 5, Article 15 of this Decree.

Article 22. Responsibilities of the system operation unit

The system operation unit shall be responsible for:

1. Implementing the determination of the information system security level as prescribed in Article 14 of this Decree;

2. Implementing the protection of the information system in accordance with the law and guidance, standards, and technical regulations on information security;

3. Regularly evaluating the effectiveness of measures to ensure information security, reporting to the system's management authority for adjustment if necessary;

4. Regularly or urgently reporting on the implementation of information security assurance work as required by the system's management authority or competent state management agency;

5. Cooperating and implementing the requirements of related functional agencies of the Ministry of Information and Communications in information security assurance work.

Article 23. Responsibilities of the State Management Agency

1. The Ministry of Information and Communications shall have the responsibility:

a) Implementing the review of the application file for classification level as prescribed in point a, Clause 3, Article 12 of this Decree;

b) Drafting national standard proposals, issuing national technical regulations on ensuring information security according to classification levels;

c) Providing detailed guidance on identifying the information systems as prescribed in Clause 2, Article 6 of this Decree;

d) Issuing regulations and guiding documents on ensuring information system security according to classification levels; regulations on assessment and certification of conformity and compliance regarding information security assurance according to classification levels;

đ) Guiding agencies and organizations to implement short-term training, propaganda, dissemination to raise awareness and drills on information security;

e) Providing detailed regulations on inspection, evaluation of information security and risk management in the activities of state agencies and organizations, except for cases prescribed in point d, Clause 2 and point d, Clause 3 of this Article;

g) Deploying centralized national technical infrastructure systems to handle, reduce cyber attacks, support monitoring of information security for online public service delivery systems, and develop the digital government.

2. The Ministry of National Defense shall be responsible for:

a) Implementing the review of the information security assurance plan in the application file for classification level as prescribed in point b, Clause 3, Article 12 of this Decree;

b) Drafting standard proposals, issuing technical regulations, and providing guidance on information security assurance for information systems under its management;

c) Providing guidance on criteria prescribed in Clause 1, Article 9, Clause 1, Article 10, and Clause 1, Article 11 of this Decree according to assigned functions and tasks;

d) Providing detailed regulations on inspection, evaluation of information security and risk management in the activities of the Ministry of National Defense.

3. The Ministry of Public Security shall be responsible:

a) Implementing the review of the information security assurance plan in the application file for classification level as prescribed in point c, Clause 3, Article 12 of this Decree;

b) Drafting standard proposals, issuing technical regulations, and providing guidance on information security assurance for information systems under its management;

c) Providing guidance on criteria prescribed in Clause 1, Article 9, Clause 1, Article 10, and Clause 1, Article 11 of this Decree according to assigned functions and tasks;

d) Providing detailed regulations on inspection, evaluation of information security and risk management in the activities of the Ministry of Public Security.

Article 24. Funding for Ensuring Information Security

1. The State budget shall ensure funding to implement information security requirements at each level in the activities of state agencies and organizations.

2. Investment funding for information security shall be implemented in accordance with the provisions of the Public Investment Law. For public investment projects aimed at building new or expanding and upgrading information systems, the investment funding for information security at each level shall be allocated within the project's investment capital.

3. Funding for monitoring, evaluating, managing information security risks; short-term training, propaganda, dissemination to raise awareness, and information security drills and emergency response of state agencies and organizations shall be balanced and allocated within the annual budget estimates of those agencies and organizations according to the classification levels provided for in the State Budget Law.

4. The Ministry of Finance shall guide the expenditure items for ensuring information security in the budget estimates, and provide guidance on the management and use of operating funds for ensuring information security in the activities of state agencies and organizations.

5. Based on the assigned tasks, state agencies and organizations shall establish budget estimates, manage, use, and settle accounts for the funding to implement tasks to ensure information security in accordance with the provisions of the State Budget Law.

Chapter V

IMPLEMENTING PROVISIONS

Article 25. Effective Date

This Decree takes effect from July 1, 2016.

Article 26. Implementation

1. The Ministry of Information and Communications shall be responsible for guiding and inspecting the implementation of this Decree.

2. Ministers, Heads of ministerial-level agencies, Heads of government agencies, Chairpersons of provincial People's Committees under the central government, and relevant organizations and individuals shall be responsible for implementing this Decree.

ANNEX

MODEL DOCUMENT FOR DETERMINING THE INFORMATION SYSTEM SECURITY LEVEL
year 20...) Decree No. 85/2016/ND-CP January 1 July 2016 of the Government)

Form No. 01

Respected: (Information security specialized unit).

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

(Name of the agency, organization) requests review and approval of the proposed security level application dossier with the following contents:

Part 1. General Information

1. Name of the information system;

2. Operating unit of the information system:

3. Address:

4. Proposed information system security level:

Part 2. Attached Documents

1. Documentation describing and generally explaining the information system.

2. Construction design documents that have been approved by the competent authority or equivalent documents.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

(Name of the agency, organization) requests (Information security specialized unit) to review and approve the proposed security level application dossier of the information system (Name of the information system)./

Form No. 02

Respected: (Information security specialized unit)

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

(Name of the agency, organization) requests (Reviewing agency) to review the proposed security level application dossier with the following contents:

Part 1. General Information

1. Name of the information system:

2. Operating unit of the information system:

3. Address:

4. Proposed information system security level:

Part 2. Attached Documents

1. Documentation describing and generally explaining the information system.

2. Construction design documents that have been approved by the competent authority or equivalent documents.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

5. Professional opinion of the information security specialized unit of the system manager (for systems proposing level 4 or level 5).

(Name of the agency, organization) requests (Reviewing agency) to give an opinion on reviewing the proposed security level application dossier of the information system (Name of the information system)./

Implementation Report of Production Projects of Supporting Industry Products Confirmed with Incentives

Respected: (Information security specialized unit)

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

(Name of the agency, organization) requests (Information security specialized unit) to give a professional opinion on the proposed security level application dossier with the following contents:

Part 1. General Information

1. Name of the information system:

2. Operating unit of the information system:

3. Address:

4. Proposed information system security level:

Part 2. Attached Documents

1. Documentation describing and generally explaining the information system.

2. Construction design documents that have been approved by the competent authority or equivalent documents.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

(Name of the agency, organization) requests (Information security specialized unit) to give an opinion on the appropriateness of the proposed security level and the security assurance plan for the information system (Name of the information system)./

Form number 04

(Name of the reviewing agency) has received Document No. ... dated ... month ... year ... from (Name of the requesting agency) regarding the review of the proposed security level application dossier for the information system (Name of the information system). After considering, consolidating opinions and review results from relevant agencies and organizations, (Name of the reviewing agency) provides the following review opinion:

Part 1. Documents and materials for review

1. Documentation describing and generally explaining the information system.

2. Construction design documents that have been approved by the competent authority or equivalent documents.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

5. Professional opinions from specialized units responsible for information security of the management entity regarding the proposed level 4 or level 5 information systems.

Part 2. Legal basis for review reason to conduct the review

1. Basis on the Law on Information Security dated November 19, 2015.

2. Basis on guiding documents implementing the Law on Information Security.

2. Other relevant legal bases.

Part 3. Review organizationứcialization

1. Leading unit for review:

2. Supporting units for review:

3. Forms of review: Organizing meetings or soliciting opinions in writing, or applying both methods if necessary.

Part 4. Opinions Evaluation opinion

1. Summary of opinions from supporting units as stipulated in Clause 3, Article 12 of this Decree.

2. Opinion on the suitability of the proposed level as specified in Article 16 of this Decree.

3. Other opinions (if any).

Part 5. Conclusion

The proposal for the system information security level is appropriate/inappropriate (if inappropriate, specify the unsuitable contents) according to the proposed level.

Above are the review opinions of (Reviewing Authority) for the proposal of the system information security level (System Name). We request the authority (Proposing Authority) to consider reporting to the competent authority for adjustment (if adjustment is required) or submitting to the competent authority for approval (if the proposal is accepted)./

Form number 05

Regarding the request for consideration of the Hai Thuong Lan Ong Award for Traditional Medicine Work

On approving the proposal for the level

Respectfully submitted to: (Competent Authority).

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

Based on the review opinions of the specialized unit on information technology/the reviewing authority;

(Name of agency, organization) requests approval of the proposal for the system information security level with the following contents:

Part 1. General Information

1. Name of the information system:

2. Operating unit of the information system:

3. Address:

4. Proposed information system security level:

Part 2. Attached Documents

1. Documentation describing and generally explaining the information system.

2. Construction design documents that have been approved by the competent authority or equivalent documents.

3. Documentation explaining the proposed level based on criteria stipulated by law.

4. Documentation explaining the security assurance plan according to the corresponding level.

5. Professional opinions from specialized units responsible for information security of the management entity regarding the proposed level 4 or level 5 information systems.

6. Review opinions of the leading reviewing authority regarding systems proposing levels 3 and above.

(Name of agency) submits to (System Manager) for consideration and decision on approving the proposal for the system information security level (System Name)./

Form number 06

Pursuant to …;

On approving the system information security level

(HEAD OF THE AUTHORITY Ois a communicable disease or parasite listed by the Ministry FFICE)

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

Considering the proposal of the agency (Name of Proposing Unit),

REGULATIONếQuang Binh Provincial Party Committee;

Article 1. Approves the system information security level for (System Name) as follows:

1. General Information

a) System Name:

b) Operating Unit of the System:

c) Address:

2. System Information Security Level: (level)

3. Measures to ensure information security:

a) Measures to ensure information security in the design of the system corresponding to level (level) comply with national standards (Name of Standard), national technical regulations (Name of Technical Regulation) on ensuring information security at that level.

b) Measures to ensure information security during system operation corresponding to level (level) comply with national standards (Name of Standard), national technical regulations (Name of Technical Regulation) on ensuring information security at that level.

Article 2. Implementation

1. Agency (Name of Proposing Unit) is responsible:

a) Implementing responsibilities to ensure information security of the managed system in accordance with the provisions of Article 22 of this Decree.

b) Other contents (if any).

2. Responsibilities of other related agencies (if any).

Article 3. Implementation clausesinternational ADJUSTMENT

1. Agency (Name of Proposing Unit) and other related agencies are responsible for implementing this Decision.

2. Specialized units on information security are responsible for monitoring and inspecting the implementation of this Decision and reporting to the agency (System Manager) in accordance with the law./

Form No. 07

Pursuant to …;

On approving the measures to ensure information security

(HEAD OF THE ORGANIZING AUTHORITY)

Pursuant to the Cybersecurity Law dated November 19, 2015;

(Pursuant to guiding documents for the implementation of the Cybersecurity Law and related documents);

Considering the proposal of the agency (Name of Proposing Unit),

REGULATIONếQuang Binh Provincial Party Committee;

Article 1. Approves the information security assurance plan for (Name of the) information system as follows:ệ 2. Information security assurance plan:

1. General Information

a) System Name:

b) Operating Unit of the System:

c) Address:

Article 2. Organizes

a) Measures to ensure information security in the design of the system corresponding to level (level) comply with national standards (Name of Standard), national technical regulations (Name of Technical Regulation) on ensuring information security at that level.

b) Measures to ensure information security during system operation corresponding to level (level) comply with national standards (Name of Standard), national technical regulations (Name of Technical Regulation) on ensuring information security at that level.

Article 2. Organizatioứ1. Thông tư này có hiệu lực thi hành kể

1. Agency (Name of Proposing Unit) is responsible:

a) Implementing responsibilities to ensure information security of the managed system in accordance with the provisions of Article 22 of this Decree.

b) Other contents (if any).

2. Responsibilities of other related agencies (if any).

Article 3. Implementation Provisions

1. Agency (Name of Proposing Unit) and other related agencies are responsible for implementing this Decision.

2. Specialized units on information security are responsible for monitoring and inspecting the implementation of this Decision and reporting to the agency (System Manager) in accordance with the law./