Are telecommunications businesses required to designate a specialized network incident response department (CERT)?

Pursuant to Article 43 of Decree 72/2013/ND-CP on response Network incident rescue:

Network incident rescue

3. Ministries, ministerial-level agencies, Government agencies, telecommunications businesses, Internet service providers, and organizations that manage and exploit important national information systems are responsible for establishing or designating a specialized network incident response department (CERT) to proactively deploy activities within their units and coordinate with the Vietnam Computer Emergency Response Center (VNCERT).

4. The Ministry of Information and Communications promulgates and organizes the implementation of regulations on coordination of network incident response.

Thus, telecommunications enterprises are responsible for establishing or appointing a specialized network incident response department (CERT) to proactively deploy activities within their units and coordinate with the Vietnam Computer Emergency Response Center (VNCERT).

Or in other words, telecommunications businesses can choose between:

Establishing a specialized network incident response department (CERT); or

Designate a specialized network incident response department (CERT).

In particular, network incident response is an activity aimed at handling and overcoming incidents that cause information insecurity on the network.

Network incident response is carried out according to the following principles:

Fast, accurate, timely, effective;

Comply with Coordination regulations of the Ministry of Information and Communications;

Coordination between domestic and international organizations and businesses.

How much will be fined if a telecommunications enterprise does not establish or appoint a specialized unit to respond to network information security incidents?

Pursuant to Clause 3, Article 78 of Decree 15/2020/ND-CP violating regulations on ensuring information security and responding to network information security incidents:

Violating regulations on ensuring information security and responding to network information security incidents

1. Fine from 10,000,000 VND to 20,000,000 VND for one of the following acts:

…

3. Fine from 30,000,000 VND to 40,000,000 VND for one of the following acts:

a) Failure to summarize and report to the National Coordinating Agency on incident developments when requested;

b) Failure to establish or designate a specialized unit to respond to network information security incidents or failure to establish an incident response team;

c) Failure to record or receive notification or failure to report network information security incidents according to proper procedures;

d) Failure to develop an incident response plan to ensure network information security;

d) Providing insufficient information while the problem has not been completely resolved;

e) Failure to synthesize and prepare periodic reports every 06 months or 01 year;

g) Incomplete implementation of incident response coordination requirements of the National Coordinating Agency.

Thus, in case a telecommunications enterprise does not establish or appoint a specialized unit to respond to network information security incidents, it may be fined from 30,000,000 VND to 40,000,000 VND.

What policies does the state have on cyber information security?

Comparing with the provisions in Article 5 of the Law on Cyber ​​Information Security 2015, the State has the following policies on cyber information security:

Promoting training, human resource development and building network information security infrastructure and techniques to meet the requirements of political stability, socio-economic development, ensuring national defense, national security, social order and safety.

Encourage research, development, and application of technical and technological measures, export support, and market expansion for cyber information security products and services produced and provided by domestic organizations and individuals;

Create conditions for importing modern products and technologies that domestic organizations and individuals do not have the capacity to produce or supply.

Ensuring a healthy competitive environment in the business of cyber information security products and services;

Encourage and create conditions for organizations and individuals to invest, research, develop and provide cyber information security products and services.

The State allocates funds to ensure network information security of state agencies and network information security for important national information systems.

In particular, according to the provisions of Clause 1, Article 3 of the Law on Cyber ​​Information Security 2015 Cyber ​​information security is the protection of information and information systems on the network from unauthorized access, use, disclosure, interruption, modification or destruction to ensure the integrity, security and availability of information.