Conditions for trading in civil cryptographic products and services? Order and procedures for applying for a Business License for this type of product?

What is civil cryptography?

Pursuant to Clause 18, Article 3 of the Law on Cyber Information Security 2015, which regulates civil cryptography event:

“18. Civil cryptography is a cryptographic technique and cryptographic product used to secure or authenticate information that is not within the scope of state secrets.”

What are civil cryptographic products and services?

Pursuant to Article 30 of the Law on Cyber Information Security 2015 on products and services Civil cryptography:

“1. Civil cryptography products are documents, technical equipment and cryptographic operations to protect information that is not within the scope of state secrets.

2. Civil cryptography services include information protection services using civil cryptography products; inspection and evaluation of civil cryptography products; security consulting, network information safety using civil cryptography products Civil cryptography products and services.”

What conditions must be met when trading in civil cryptographic products and services?

Pursuant to Article 31 of the Law on Cyber Information Security 2015 on trading in civil cryptographic products and services:

“1. Enterprises must have a License to trade in civil cryptographic products and services when trading in civil cryptographic products and services Civil cryptography products and services belong to the List of civil cryptography products and services.

2. Enterprises are granted a License to trade in civil cryptography products and services when they fully meet the following conditions:

a) Have a management, operating, and technical team that meets professional requirements for information security and safety;

b) Have a system System of equipment and facilities appropriate to the scale of providing civil cryptographic products and services;

c) Have a technical plan in accordance with standards and technical regulations;

d) Have a plan for security and network information security in the process of managing and providing civil cryptographic products and services;

dd) Have a business plan appropriate.

3. Civil cryptographic products must be tested and certified to comply with regulations before being circulated on the market.

4. Enterprises licensed to trade in civil cryptographic products and services must pay fees according to the provisions of law on fees and charges.

5. The Government promulgates the List of civil cryptographic products and services and detailed regulations on this Article.”

Accordingly, if you want to trade in civil cryptography products and services, businesses must have a License to trade in civil cryptography products and services. And businesses must meet the following conditions to be granted a License to trade in civil cryptographic products and services.

– Have a management, operations, and technical team that meets professional requirements for information security and safety;

– Have a system of equipment and facilities appropriate to the scale;

– Have a technical plan in accordance with standards and technical regulations;

– Have a plan for network information security and safety;

– Have a suitable business plan.

Sequence and procedures for applying for a Business License for civil cryptographic products and services

Pursuant to Article 32 of the Law on Cyber Information Security 2015 on the Order and procedures for applying for a Business License for civil cryptographic products and services:

“1. Enterprises requesting a License to trade in civil cryptographic products and services submit an application for a License at the Government Cipher Committee.

2. Dossier to request a License to trade in civil cryptographic products and services is made in two sets, including:

a) Application for a License to trade in civil cryptographic products and services;

b) Copy of Business Registration Certificate or Investment Registration Certificate or other documents of equivalent value;

c) Copy of diploma or professional certificate in security and information security of the management, executive, and technical team;

d) Technical plan includes documents on technical characteristics and technical parameters of the product; product standards and technical regulations; service standards and quality; technical measures and solutions; product warranty and maintenance plan;

dd) Network information security and safety plan in the process of managing and providing civil cryptographic products and services;

e) Business plan including scope, supply objects, scale of product quantity, system services to serve customers and technical assurance.

3. Within 30 days from the date of receipt of complete dossier, the Government Cipher Committee shall appraise and issue a Business License for civil cryptographic products and services; In case of refusal, it must be notified in writing and clearly state the reason.

4. The license to trade in civil cryptographic products and services is valid for 10 years.”