 |
| Civil cryptographic products include hardware and software products, documents and cryptographic technical and operational equipment used to protect information not classified as state secrets__Photo: https://baochinhphu.vn |
The Government on September 1 issued a decree detailing a number of articles of, and measures to implement, the Law on Cybersecurity regarding civil cryptographic products and services; conditions for dealing in civil cryptographic products and services and the export and import of civil cryptographic products. The decree also provides the competence, dossiers and procedures for the issuance, modification, suspension and revocation of licences for dealing in civil cryptographic products and services and licences for export and import of civil cryptographic products.
Decree 341/2026/ND-CP, effective on the date of issuance, defines civil cryptographic products as hardware and software products, documents and cryptographic technical and operational equipment used to protect information not classified as state secrets. Civil cryptographic services include services of protecting information using civil cryptographic products, assessing civil cryptographic products, and providing cybersecurity consultancy based on civil cryptographic products.
According to the decree, enterprises dealing in civil cryptographic products and services on the List of civil cryptographic products and services are required to possess a licence for doing business in such products and services. These products and services are subject to inspection and certification of regulation conformity before being circulated on the market. A licence for dealing in civil cryptographic products and services is valid for 10 years.
To obtain a licence, enterprises must satisfy conditions on personnel, physical infrastructure and technical plans. Specifically, an enterprise must have at least two technicians, who must possess a university or higher degree in electronics and telecommunications, information technology, mathematics or information security; and one management or executive officer possessing required professional qualifications. Additionally, the enterprise must have appropriate equipment and physical facilities as well as technical plans that conform to applicable standards and technical regulations.
Regarding import and export activities, an enterprise must possess a licence for import or export of civil cryptographic products when importing or exporting products on the List of civil cryptographic products subject to import/export licensing. This licence is valid for three years. To obtain this licence, an enterprise must possess a valid licence for doing business in civil cryptographic products and services; to-be-imported products have undergone certification and regulation conformity declaration; and the intended users and use purposes do not cause harm to national defence and security as well as social order and safety.
The decree also says that an enterprise will have its business operations suspended for up to six months if it provides products or services other than those stated in its licence or fails to satisfy business conditions. A licence for doing business in civil cryptographic products and services will be revoked if the application dossier is forged, the licence is issued ultra vires, or the enterprise terminates business operations or fails to remedy violations after the period of operation suspension.
Enterprises dealing in civil cryptographic products and services will have to comply with the terms of their licences, ensure product and service quality, create and keep customer information, and coordinate with competent state agencies upon request. They must also submit annual reports on their business operations, export and import of civil cryptographic products, as well as customer information to the Vietnam Government Information Security Commission before December 31 every year.- (VLLF)
