What responsibilities do businesses, organizations, and individuals have in doing business and using civil cryptography products and services?

What is civil cryptography?

Pursuant to Clause 18, Article 3 of the Law on Cyber Information Security 2015, regulations on civil cryptography:

“18. Civil cryptography is a cryptographic technique and cryptographic product used to secure or authenticate information that is not within the scope of state secrets.”

What are civil cryptographic products and services?

Pursuant to Article 30 of the Law on Cyber Information Security 2015 regarding products, Civil cryptography services:

“1. Civil cryptography products are documents, technical equipment and cryptographic operations to protect information that is not within the scope of state secrets.

2. Civil cryptography services include information protection services using civil cryptography products; inspection and evaluation of civil cryptography products; security consulting, network information security using products Civil cryptographic products.”

What responsibilities do businesses trading in civil cryptographic products and services have?

Pursuant to Article 35 of the Law on Cyber Information Security 2015 on the responsibilities of businesses trading in civil cryptographic products and services:

“1. Management of records and documents on technical and technological solutions of products.

2. Prepare, store and secure customer information, name, type, quantity and purpose of use of civil cryptographic products and services.

3. Annually report to the Government Cipher Committee on the business, export, import of civil cryptographic products and services and summarize customer information before the 31st of the month. 12.

4. Have measures to ensure security and safety in the transportation and preservation of civil cryptography products.

5. Refuse to provide civil cryptography products and services when detecting that organizations or individuals violate the law on the use of civil cryptography products and services, or violate the agreed commitments on using products and services provided by the enterprise. level.

6. Temporarily suspend or stop providing civil cryptographic products and services to ensure national defense, national security, social order and safety at the request of competent state agencies.

7. Coordinate and create conditions for competent state agencies to implement professional measures when required.”

Accordingly, businesses trading in civil cryptography products and services have responsibilities such as: managing records and documents on technical and technological solutions; establish, store and secure customer information; Annually report to the Government Cipher Committee on business, export and import situation; Coordinate and create conditions for competent state agencies to implement professional measures,…

What responsibilities do organizations and individuals using civil cryptography products and services have?

Pursuant to Article 36 of the Law on Cyber Information Security 2015 on the responsibilities of organizations and individuals using civil cryptography products and services:

“1. Comply with regulations committed to enterprises providing civil cryptographic products on management and use of cryptographic keys, transfer, repair, maintenance, disposal, destruction of civil cryptographic products and other related contents.

2. Provide necessary information related to encryption keys to competent state agencies upon request.

3. Coordinate and create conditions for competent state agencies to take measures to prevent criminals from stealing information, locking codes and using civil cryptographic products for illegal purposes.

4. Organizations and individuals using civil cryptography products not provided by businesses licensed to trade in civil cryptography products must declare to the Government Cipher Committee, except diplomatic representative agencies, consular agencies of foreign countries and representative agencies of intergovernmental international organizations in Vietnam.”

Accordingly, organizations and individuals using civil cryptography products and services have responsibilities such as: Complying with committed regulations on management and use of encryption keys, transfer, repair, maintenance, abandonment and destruction of civil cryptography products; Provide necessary information related to encryption keys to competent state agencies; Coordinate and create conditions for competent state agencies to take measures to prevent criminals from stealing information, locking codes, etc.