Must Internet Service Providers Comply with National Incident Response Coordination Requirements?

I have a question as follows: must an enterprise providing Internet services (ISP) comply with incident response coordination requirements of the national coordinating agency? The question was submitted by Mr. Q.B.B from Ho Chi Minh City.

Must an enterprise providing Internet services (ISP) comply with incident response coordination requirements of the national coordinating agency?

Under applicable law

Pursuant to Article 7 of Decision 05/2017/QD-TTg of 2017 on the national cybersecurity incident response network, regulations on enterprises providing Internet services are as follows:

National cybersecurity incident response network

1. Members obliged to participate in the national cybersecurity incident response network, hereinafter referred to as the incident response network, include:

…

dd) Enterprises providing telecommunications infrastructure and Internet services (ISPs); organizations and enterprises providing data center services and digital information storage space leasing services; units managing and operating national databases; specialized information security and information technology units of banking, finance, treasury, tax and customs organizations;

…

4. Network members are responsible for complying with the network’s operating regulations, complying with coordination requirements of the coordinating agency, and actively participating in and contributing to the network’s operations. Telecommunications enterprises and Internet service providers (ISPs) are responsible for storing and providing information relating to subscriber IP addresses, servers, IoT devices, log files and DNS service logs within the enterprise’s management scope; establishing an environment for installing monitoring and sampling equipment and providing network data streams for monitoring and incident detection at the request of the national coordinating agency; establishing a permanent 24/7 contact point and arranging personnel and resources ready to coordinate and implement solutions for responding to and remedying incident consequences when the attack source is determined to originate from subscribers under the enterprise or when requested by the national coordinating agency.

Thus, an enterprise providing Internet services (ISP) is obliged to participate in the national cybersecurity incident response network.

At the same time, an enterprise providing Internet services (ISP) is responsible for complying with coordination requirements of the coordinating agency.

How much may an Internet service provider (ISP) be fined for failing to comply with incident response coordination requirements of the national coordinating agency?

Pursuant to Clause 4 Article 78 of Decree 15/2020/ND-CP on violations of regulations on ensuring information security and cybersecurity incident response:

Violations of regulations on ensuring information security and cybersecurity incident response

…

4. A fine ranging from VND 50,000,000 to VND 70,000,000 shall be imposed for any of the following acts:

a) Failing to appoint a contact point to conduct coordination activities for incident response or failing to participate in the national cybersecurity incident response network;

b) Failing to comply with incident response coordination requirements of the national coordinating agency;

c) Failing to arrange premises, connection ports and necessary technical conditions as required by the Ministry of Information and Communications or the Ministry of Public Security;

d) Failing to organize incident response activities in the sector, locality or scope under its management;

dd) Failing to coordinate with the national coordinating agency, service providers and competent agencies to restore certain essential activities, data or connections in order to minimize damage to the information system or adverse social impacts;

Accordingly, where an enterprise providing Internet services (ISP) fails to comply with incident response coordination requirements of the national coordinating agency, it may be fined from VND 50,000,000 to VND 70,000,000