Must ISPs Comply with the National Agency’s Incident Response Coordination?

Short answer: Yes. Internet service providers (ISPs) are responsible for cooperating with and complying with the incident response coordination requirements of the National Coordinating Agency for cybersecurity incident response (VNCERT/CC). This is a statutory obligation to ensure the safety of national information systems, regulated in the Law on Cybersecurity Information 2015 and Decree 147/2024/ND-CP on the management, provision and use of Internet services (effective from 25/12/2024, replacing Decree 72/2013/ND-CP).

Legal basis

• The Law on Cybersecurity Information 2015 — responsibilities for cybersecurity incident response;
• Decree 147/2024/ND-CP on the management, provision and use of Internet services and online information (effective from 25/12/2024, replacing Decree 72/2013/ND-CP);
• The National Coordinating Agency: the Vietnam Cybersecurity Emergency Response Team/Center (VNCERT/CC) under the Authority of Information Security — Ministry of Science and Technology (after the 2025 organizational restructuring).

What is the National Coordinating Agency?

VNCERT/CC is the national focal point coordinating cybersecurity incident response nationwide: receiving, analyzing and warning of incidents; coordinating organizations and enterprises in handling; providing technical support during large-scale cyberattacks.

Obligations of ISP enterprises in incident response

• Establishing an incident response focal point: Internet service providers must have a dedicated cybersecurity unit/focal point, ready to cooperate when required;
• Complying with coordination requirements: when VNCERT/CC coordinates incident response, the enterprise must cooperate in implementing necessary technical measures (isolation, blocking attack sources, system recovery…) within its scope of responsibility;
• Reporting incidents: promptly reporting serious cybersecurity incidents to competent authorities as prescribed;
• Ensuring system safety: implementing measures to protect its own information systems by level, complying with regulations on information system safety assurance.

How is non-compliance handled?

Acts of non-compliance with incident response coordination requirements or failure to report incidents as prescribed may be subject to administrative sanctions in the field of cybersecurity information. The specific fine levels are prescribed in the current sanctioning decree in this field — you should check the original text (Decree 15/2020/ND-CP and its amending and supplementing documents) or contact a lawyer to determine the exact applicable fine.

What should ISP enterprises prepare for compliance?

1. Issuing internal incident response regulations, assigning a focal point to cooperate with VNCERT/CC;
2. Reviewing systems and classifying information system safety levels;
3. Training technical personnel on reporting and response coordination procedures;
4. Storing system logs for incident investigation and handling;
5. Periodically conducting drills and assessing response capability.

Frequently asked questions

Are coordination requirements mandatory or merely recommendations?

They are mandatory obligations under cybersecurity information law, not voluntary recommendations. Enterprises must comply when coordinated.

Must small Internet service providers also comply?

Yes. The obligations apply to Internet service providers generally; the specific level of implementation (focal point, procedures) is suited to the scale and nature of each enterprise’s systems.

Which incidents must be reported?

Serious cybersecurity incidents affecting service provision, user data leaks, or signs of targeted attacks — to be reported promptly as guided by the coordinating agency.

Notes on applying current legal provisions

The cybersecurity information field has many detailed guiding documents that are updated frequently; document numbers and specific fine levels should be checked against the original texts at the time of application. Contact an ANT Legal lawyer at 0966.475.966 for a review of compliance obligations for telecommunications and Internet enterprises.

Common risks to note

• Not establishing an incident response focal point, being passive when coordinated;
• Delayed reporting of serious incidents;
• Not fully storing system logs for investigation;
• Applying expired documents (Decree 72/2013/ND-CP).

How can ANT Legal help?

ANT Legal advises on compliance with telecommunications, Internet and cybersecurity information law: reviewing obligations, building internal incident response regulations, handling administrative violations. For quick advice, you may contact a lawyer at 0966.475.966.

Related articles

• Nationwide company and enterprise establishment services in Vietnam
• Working regime, conditions and procedures for holding Members’ Council meetings in state-owned enterprises
• 7 things to do immediately after establishing an enterprise or company in Vietnam
• Must asset contributions for enterprise establishment be declared for and subject to value-added tax?
• Procedures for registering a sole proprietorship in Vietnam