CIRCULAR

Promulgating the security of information system in banking operations

_______________

Pursuant to the Law on State Bank of Vietnam dated June 16, 2010;

Pursuant to the Law on the Credit Institutions dated June 16, 2010 and the Law on amending and supplementing a number of Articles of the Law on the Credit institutions dated November 20, 2017;

Pursuant to the Law on E-transactions dated November 29, 2005;

Pursuant to the Law on Information Technology dated June 29, 2006;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Law on Cybersecurity dated June 12, 2018;

Pursuant to the Decree No. 85/2016/ND-CP dated July 01, 2016 of the Government on the security of information systems by classification;

Pursuant to the Decree No. 16/2017/ND-CP dated February 17, 2017 of the Government defining the functions, tasks, powers and organizational structure of the State Bank of Vietnam;

At the proposal of the Director of the Informatics Technology Department;

The Governor of the State Bank of Vietnam promulgates a Circular on information system security in baking operations

Chapter I

GENERAL PROVISIONS

Article 1. Scope of adjustment and subject of application

1. This Circularspecifies minimum requirementsfor assurance of information system security in baking operations.

2. This Circular applies to credit institutions, branches of foreign banks,and intermediary payment service providers, credit information companies, the National Payment Corporation of Vietnam (NAPAS), Vietnam Asset Management Company (VAMC), National Banknote Printing Plant, Deposit Insurance of Vietnam(hereinafter referred to as "institutions") which have establishedand used the information system for one or more organization’s technical and professional activities.

Article 2. Definition

For the purpose of this Circular, the terms below shall be construed as follows:

1.“Information technology risk” means probability of loss when carrying out operations relating to information systems. Information technology risk relates to management and use of hardware, software, communication, system interface, operation and people.

2.“Information security incident”means incident in which digital information and information system are attacked or harmed resulting in negative effects on their confidentiality, integrity and availability.

3.“Technical vulnerability" means any component ofaninformation system that is highly vulnerable tobeexploited andtaken advantages of,when being attacked or illegally penetrated.4. “Data center” includes technical infrastructure (base station and cable system) and computer system with auxiliary equipment installed into such system for the purpose of processing, storing, exchanging and managing data in a concentrated manner.

5.“Mobile device" means a digital device which can be hand-held without any effect on its operating capability and has an operating system, capability to process or connect to a network as well as a display screen such as a laptop, tablet and smart phone.

6.“Information-bearing object" means physical means used for storing, transmitting and receiving digital information.

7.“Firewall” means a collection of components or a system of equipment and software that is placed between two networks with the aim of controlling all outgoing and incoming connections.

8.“Untrusted network” means an external network connecting to the internal network of an institution which is not under management of such institution or any foreign credit institution in relation to such institution such as affiliated entity or commercial presence of such institution in Vietnam.

9.“Cloud computing service" means offering computing resources(including resources of calculation, network connection, storage, software and other computing resources)through network environment which enables ubiquitous users to access, adjust and pay according to the using requirement.

10.“User account” or "account" means an unique collection of information representative of an user on the information system which is used for logging in and accessing to resources permitted on such information system.

11.“Third party” means any individual or enterprise (excluding foreign credit institution and members of the foreign credit institution in case the institution is an affiliated entity or commercial presence in Vietnam of such foreign credit institution) entering into a written agreement (hereinafter referred to as "contract for service use") with the institution to supply information technology services.

12. “Legal representative” is the at-law representative of credit institutions, enterprises, General Directors (Directors) of the foreign bank branches

13. "Competent authority” means a title or person authorized in writing to perform one or more than one duty of an institution by the legal representative of such institution.

14. “Multi-factor authentication” means the confirmation of the two factors to prove the correct identity. The authentication factors include: (i) Information that users know (PIN number, secret key…); (ii) things user own (smart cards, token device, mobile phones…); (iii) User’s biometric signals.

Article 3. Generalprinciples

1. The institution shall take responsibilityforensuringinformation security under the principle that clearly defines power and responsibility of each department and individual in such institution.

2. Information system shall be categorized in orderprescribed at Article 5 of this Circular and applied the suitableinformation security policy.

3. Information technology risks that can be probably incurred in the institutions must be identified, classified, assessed timely and efficiently.

4. Information security regulations shall be established and adopted according to regulations herein and harmony in interests, costs and the ability to take risk of the institution shall be ensured.

Article 4.Information classification

Information processed and stored through the information system shall be classified by confidentiality as follows:

1.Public information refers to information that is publicly disclosed to any person without determination of his/her identity and address;

2. Private information (or internal information) refers to the information not yet managed and used under that authorization given to an identified person or a group of identified persons in such institution;

3. Personal information is the customer’s identity information and other information such as: account, deposit, asset, transactions and others;

4. Confidentialinformation refers to information as (i) third-degree, second-degree and first-degree secret information as per provisions of the Law on Protection of State secrets or;(ii) confidential information in compliance with the institution’s regulations and is only accessed by restricted persons

Article 5.Classification of information systems

1. For the online service’s information systems for customers, institutions shall make classification in accordance with the regulations of the Decree No. 85/2016/ND-CPdated July 01, 2016 of the Government on the security of information systems by classification. For other information systems, the classification is prescribed in Clauses 2, 3, 4, 5, 6 and 7 of this Article.

2. Level 1 information system refers to the information system that supports internal operations of an institution and only public information processed.

3. Level 2 information system refers to one of the following information systems:

a) Information systems that supports daily internal operations of an institution, including user’s private and personal information and confidential information in compliance with the institution’s regulations but not processing the state confidential information;

b) Information system for client service without 24/7 requirements;

c) Information infrastructure system serving the operations of some departments of an institution or micro-economic and financial organization, grassroots people’s credit funds.

4. Level 3 information system refers to one of the following information systems:

a) Information system providing classified information processing of state secret at the third-degree level;

b) Information systems that supports daily internal operations of an institution with no operation termination over 4 working hours;

c) 24/7 information system for client service with no operation termination without plan in advance;

d) Payment system of the third party for using outside institution system;

dd) Information infrastructure system for common use in banking .

5. Level 4 information system refers to one of the following information systems:

a) Information system of state confidential information at the second-degree level;

b) Information system serving customers processing and storing the data of 10 million customers and above;

c) 24/7 national information infrastructure system in banking which allows no operation termination without plan in advance;

d) Important payment systems in banking in accordance with the regulations of the State Bank;

dd) 24/7 Information infrastructure information infrastructure system for common use in banking which allows no operation termination without plan in advance;

6. Level 5 information system refers to one of the following information systems:

a) Information system of state confidential information at the first-degree level;

b) National information system in banking connected the activities of Vietnam with other foreign countries;

c) National information infrastructure in banking serving the connection between Vietnam with other foreign countries.

7.In case the information system includes more than one component system and each component system is categorized by different importance,the defined information system level shall be the highest level in the component system.

8. The institution shall organize and carry out the information system categorized by different important levels in accordance with the regulations prescribed in Clauses 1, 2, 3, 4, 5, 6 and 7 of the Decree No. 85/2016/ND-CP. Proposal dossiers for Level 4 and Level 5 information system shall be passed to the State Bank (the Informatics Technology Department) for opinions.

9. The list of level of information system shall be made, checked and updated after putting into use and on an annual basis.

Article6. Information security regulations

1. The institution shall set out information security regulations in consistent with its information system, organizational structure, management requirement and operations. Information security regulations must be signed for issuance by the legal representative of such institution and imposed throughout such institution.

2. Information security regulations shall at least contain basic contents as follows:

a) Management of information technology assets;

b) Management of human resources;  

c) Assurance of safety in terms of physical and installation environment;

d) Management of information use and exchange;

dd) Access management;

e) Management of use of information technology service provided by a third party;

g) Management of acceptance, development and maintenance of information systems;

h) Management of information security incidents;

i) Assurance of continuous operation of information systems;

k) Internal inspection and reporting mechanism

3. The institution shall carry out review of information security regulations at least once every year and ensure sufficiency of those regulations as per provisions herein. When discovering any shortcoming which causes insecurity of the information system or as required by competent authorities, the institution shall carry out amendment or adjustment to the issued information security regulations.

Chapter II

REGULATIONS ON ASSURANCE OF INFORMATION SECURITY

Section 1. MANAGEMENT OF INFORMATION TECHNOLOGY ASSETS

Article7. Management of information technology assets

1. Information technology assets include:

a) Information assets such as digital data and information which are processed and stored through the information system;

b) Physical assets such as information technology equipment, means of media, information-bearing objects and equipment that support operation of the information system;

c) Software assets such as software systems, utility software, middleware, databasemanagement system, application programs, source codes and development tools.

2. The institution shall make a list of all information technology assets attached to each information system as prescribed in Clause9Article5herein. Annual review and update of such list is required.

3. According to the importance of information systems, the institution shall adopt management and protection methods suitable for each type of information technology asset.

4. According to classification of information technology assets prescribed in Clause 1 this Article, the institution shall set up and adopt regulations on asset management and use as prescribed in Article8,9,10, 11and 12herein.

Article8. Management of information assets

1. Each information system requires a list of information assets and regulations on powers and responsibilities of individuals or departments in the institution that are entitled to access to, use and manage such information.

2. Information assets shall be categorized as prescribed in Article 4 herein.

3. Information assets categorized asconfidential information must be encrypted or secured by appropriate methods for the purpose of information protection during the process of producing, exchanging and storing information.

4. The institution shall employ methods for data leakage prevention applied to information assets contained in Level 3 information systems.

Article9. Management of physical assets

1. In addition to provisions specified in this Article,Physical assets that are mobile devices,andinformation-bearing objects must be managed as prescribed in Article 11and 12herein.

2.With regard to each information system under management of an institution, such institution shall make a list of physical assets with basic information including name, value, installation position, asset manager, use purpose, using condition and equivalent information system.

3. Individuals or departments in the institution shall be assigned or bound to take responsibility to use and manage physical assets.

4. Any physical asset moved out of the institution s head office must be approved by the competent person and protected by appropriate methods with the aim of securing the information stored in such asset in case the asset containsconfidential information.

5.When changing the purpose of use of the physical asset containingconfidential information or liquidating such asset, the institution shall use methods for completely and permanently eliminating or removing such confidential information so that it could not be restored. Where it is impossible to eliminate the confidential information, the institution shall adopt a method for eliminating the data storageconstituent of such asset.

Article10. Management of software assets

1.As regards each information system, the institution shall make a list of software assets with basic information including name, value, use purpose, using extent, asset manager, copyright information, version and equivalent information system(if any).

2. Individuals or departments of the institution shall be bound to take charge of management of software assets.

3. Periodic review and update on patches of security-related errors for software assets are required.

4. Software assets shall be stored by information-bearing objects in accordance with regulations in Article 12herein.

Article 11. Management of mobile devices

1. Mobile devices must be registered for controlling purpose when connecting to the local area network (LAN) of each institution.

2. Mobile devices must be connected to information systems and services of each institution within a limited area and connection from mobile devices to permitted information systems of the institution must be controlled.

3. Regulations on responsibilities of mobile device users in each institution shall be set out.

4. The following technical methods shall be applied to mobile devices for working purpose:

a) Set up the function of remotely disabling and locking the device in case the mobile device is lost or stolen;

b) Back up data on mobile devices to protect and restore data where necessary;

c) Adopt methods for protecting data when mobile devices are sent to warranty, maintenance or repair service providers.

5. With regard to mobile devices that are assets of an institution, the following technical methods shall be adopted other than those prescribed in Clause 4ofthis Article, at least including:

a) Control installed software and update software versions and patches on mobile devices;

b) Install internal and confidential informationprotectionsoftware (if any), create a password and install software for prevention of malicious codes and other security-related errors.

Article 12. Management of use of information-bearing objects

Institutions must manage the use of information-bearing objects as follows:

1. Control connection and disconnection of information-bearing objects from and to devices of the information systems.

2. Develop methods to ensure safety of information-bearing objects during the transportation and storage process.

3. Adopt methods for protecting classified information contained in information-bearing objects.

4. Assign individual responsibilities for management and use of information-bearing objects.

Section 2.

HUMAN RESOURCE MANAGEMENT

Article 13.Human resourcesorganization

1. The legal representative of the institution himself/herself must provide guidelines and take responsibility for preparation of strategies and plans for assurance of information security and response to cybersecurity incidents that occur in such institution.

2. Institutions that only have  Level 2 information systems andbelowshall appoint the department to have responsibility in information security.

3.Institutions directly managing Level3information systems and above shall:

a) Establish or assign a department in charge of information security to perform the task of information security assurance and response to cyber security incidents for the institution;

b) People holding the following positions must be separated: (i) Developers and administrators of information systems; (ii) Developers and operators of information systems; (iii) Administrators and operators of information systems; (iv) Information security inspectors, developers, administrators and operators of information systems.

Article 14. Recruitment and duty assignment

The recruitment and duty assignment shall be implemented as follows:

1. Define responsibilities of each position to which an employee is recruited or assigned for assurance of information security.

2. Consider and evaluate personal ethics and professional qualifications based upon curriculum vitae and juridical record of each employee before appointing such employee to vital position of the information system such as operator of Level 3 information systemandabove or information system administrator .

3. Request the recruited candidates to make a written commitment to information security on a separate basis or give such commitment in the labor contract. Such commitment must include terms and conditions regarding responsibilities for information security during and after a period of time working for the institution.

4. Provide training in the institution s regulations on information security to newly-recruited employees.

Article 15.Human resourcesmanagement

Human resources management shall be implemented as follows:

1. Broadcast and provide updated regulations on information security to all staff members at least once every year.

2. Carry out inspection of compliance with information security regulations of every individual and department affiliated to the institution at least once every year.

3. Implement disciplinary measures imposed on any individual or department breeching the information security regulations of the law and those issued by the institution.

Article 16.Termination or changeof employment

When an employee in an institution terminates or change employment, such institution shall:

1.Determine responsibilities of such employee at the date of employment termination or change;

2.Request such employee to hand over the information technology assets;

3.Revoke the right to access to the information system of the employee resigning from his/her job;

4.Timely change the access right to information system of the employee who changes his/her employment in order to conform to the principle that such right is given adequately for him/her to perform the assigned duty;

5.At least every six months, carry out review, inspection and comparisonwithin a department orbetween personnel management department and department in charge of management of granting and revocation of rights to access to information systems for the purpose of complying with regulations specified in Clause 3 and 4 this Article;

6.Inform the State Bank of Vietnam (Informatics Technology Department) of cases in which individuals working in information technology sector of the institution have been disciplined in forms of dismissal, discharge or legal proceedings on account of violationsin accordance with the regulations prescribed at Section 2, Chapter XXI of the Criminal Code (Crime in information technology, telecommunications).

Section 3.

ASSURANCE OF PHYSICAL AND ENVIRONMENTAL SAFETY FOR LOCATION FOR INSTALLATION OF INFORMATION TECHNOLOGY EQUIPMENT

Article 17. General requirements applied to theinstallationlocation of information technology equipment

1. Build guard fences and entrance and exit gates or develop methods for controlling and restricting unauthorized access risks.

2. Employ methods for prevention of explosion or flood risks.

3.Areas that require high level of information safety or security, including areas for installation of servers, storage devices, security instruments and communications equipmentfrom Level 3 and abovemust be isolated from areas for common use, distribution and cargo handling, and must have working rules and instructions as well as take measures to control persons who enter or leave such areas.

Article 18. Requirements applied to the data center

In addition to conformity with requirements specified in Article 17herein, the data center must satisfy the following requirements:

1. Security guards must be present at entrances and exits at all time.

2.Entrance and exit door must be firm and fireproof and locked with at least two distinct types of security keys and put under 24/7 surveillance and guard.

3. Areas for equipment installation must be waterproof and protected from direct sunlight as well as floods.Areas for installation of equipment of Level3information systems and above must be put under 24/7 guard and surveillance.

4. There must be at least one power source supplied by the grid and one supplied by the power generator.The automatic transfer switch between two power sources must be available. Whenever power source supplied by the power transmission grid is cut, the power generator must automatically run to supply power.The power source must be connected through UPS system to supply power for equipment and ensure the capability to maintain continuous operations of the information system.

5. There must be an air conditioner system to ensure continuous operations.

6. There must be a lighting protection system and surge protection system.

7. There must be an automatic fire alarm and fire suppression to ensure that firefighting activities do not cause harm to the built-in equipment.Except for the case that the institution has back-up system to ensure the total security for the data and is capable for replacing all the main system within 01 hour.

8. There must be a technical floor system or electricity insulating layer and earthing system.

9. There must be a surveillance camera and data storage system which has capacity to store data within90days.

10. There must be a temperature and humidity monitoring and controlling system.

11. There must be an entrance and exit logbook.

Article 19. Physical asset security

1.Physical assets must be arranged or installed in a safe and guarded position in order to reduce risks incurred by environmental threats or perils and unauthorized access.

2.Physical assets belonging to Level3information systems and above must be provided with an adequate amount of power and support systems whenever interruption of the main power source occurs. Electric overload, voltage sag or surge protection solutions,earthsystem, standby generation system and UPS system must be in place to ensure continuous operations.

3. Power supply and communication cables used for data transmission or other information support services must be protected from infringement and damage.

4. Equipment used for professional operations that are installed outside the head office of the institution must be supervised and protected from any act of infringement and unauthorized access.

Section 4.

MANAGEMENT OF OPERATION ANDINFORMATION EXCHANGE

Article20. Management responsibilities and operational procedures of the institution

1. The institution shall establish procedures for operation of Level3information systems and above which at least including the following contents: system startup and shutdown, data backup and restoration, application operation, troubleshooting and supervision and recording of system operations into a logbook. For the purpose of such procedure, scope and responsibilities of persons who use and operate the systems must be clearly determined. At least once every year, the institution shall carry out necessary review, provide update and amendments to procedures for operation of information systems to satisfy actual conditions.

2. The institution shall introduce procedures to all staff members involved in the operation and supervise the compliance with those issued procedures.

3. Operational environment of Level3information systems and aboveand customer’s personal information systemmust meet the following requirements:

a) Such environment must be independent from environment of development, inspection and experiment;

b) Measures to ensure information security must be applied;

c) Installation of application development equipment and instruments are not permitted;

d) All functions and utility software that are not currently in use on information systems shall be eliminated or turned off.

4. Information systems for handling client s transaction must satisfy the following requirements:

a) A single individual is not allowed to participate in different processes varying from conduction or ratification of a transaction;

b)Apply the confirmation of multi-factors at the final approval when making arising inter-bank financial electronic transaction with the value of VND 100 million and above (except for the Straight Though Process that have auto confirmation for transaction among interconnection system);

c)Measures to ensure integrity of transaction data must be applied;

d) All actions must be tracked and ready for the check, control if necessary.

Article 21. Plan preparation and information system acceptance

1. The institution shall develop technical standards,norms and requirements to ensure normal operations of all current information systems and other information systems before officially putting those systems in use.

2. According to technical standards,norms and requirements which have been developed, the institution shall carry out surveillance and maximization of performance of information systems, and assessment of demand satisfaction, operating condition and system configuration of information systems for the purpose of forecasting and preparing extension and refine plans to ensure the demand satisfaction capability in the future. The institution shall carry out necessary review and provide update on technical standards,norms and requirements in case of any change made to information systems, and provide relevant staff members with technical training and technical transfer in terms of elements subject to such change.

Article 22. Data backup

Data shall be backed up to ensure data security as follows:

1. The institution shall make a list of information systems categorized in order of importance that require to be duplicated with storage period, backup time, backup method and time of testing for system restoration from the backup file .

2. Data of Level3information systems and above must be automatically backed up in consistent with the frequency of data change in order to adhere to the principle that any newly-generated data must be backed up within 24 hours;the left data of information systems shall be periodically backed up in accordance with institution’s regulations.

3.Data Level3information systems and above must be backed up in external storage devices(such as magnetic tapes, hard disks, optical tapes or other storage devices)and must be retained and stored and separated from the area of information system sources within the next working day of the backup completion.

4.It is required to check and restore backup data stored in external storage devices:

a) At least once per year for the data Level 3 information systems and above;

b) Every two years, for other system.

Article 23. Management of network safety and security

Network safety and security shall be managed as follows:

1. Formulate regulations on management of network safety and security and management of terminal devices of the entire information systems

2. Make and store records of logical and physical diagrams relating to the network systems, including wide area network (WAN/Intranet) and local area network (LAN)

3. Develop a computer network system of an institution meeting the following requirements:

a) Network areas must be separated from one another according to the users, purposes of use and information systems, at least including: (i) a separate partition for the server of Level3information system and above; (ii) demilitarized zone (DMZ) for Internet services; (iii) independent network for wireless network services;

b) There must be devices with firewall installation to control connections and access to important network areas;

c) There must be devices with firewall installation and software for detecting, preventing and fighting against unauthorized access to control connections and access from untrusted network to the network system of the institution;

d) Measures to timely control, detect and prevent unauthorized connections and access to the local area network system of the institution which owns Level 2 information systems and above must be applied;

dd) Download balance plans and denial of service attack handling plans applied to Level3information systems and above which provides services on the Internet must be prepared;

4. Applications must be developed and configured according to the design of network security equipment; methods for tracing and timely identifying technical vulnerabilities, holes of the network systems must be adopted and regular inspection and detection of illegal connections or installation of equipment and software to the network system must be carried out.

Article 24. Information exchange

The institution shall take the following responsibilities for information exchange with clients and third parties:

1. Issue information exchange regulations including the following contents: type of information exchanged, powers and responsibilities of each individual getting access to information, means of information exchange; methods for ensuring integrity and confidentiality of information during the process of transmitting, receiving and processing and information preservation regime

2. Make a written commitment in which responsibilities and obligations of all parties involved in information use and assurance of information security are clearly defined when exchanging internal and classified information with external parties

3. Employ encryption methods or information security methods applied to classified information before the exchange. For the server of Level 5, institutions must have safe connection and professional devices and equipment for encode and decode secret information exchange.

4. Use methods for protecting information exchange equipment and software in order to prevent illegal access and utilization

5. Adopt methods for strictly managing, supervising and controlling websites that provide online information, services and transactions to the clients

Article 25.Information organization management of online transaction services

1. Information systems that provide online transaction services for clients must satisfy the standard TCVN 11930:2017 (Standard: Information Technology – Safety Technique – Primary Requirements on information system security at all levels) and other requirements as follows:

a) Ensure integrity of information exchanged with the clients during the online transaction;

b) Ensure confidentiality of information on the transmission line and deliver sufficient information to the right address, and develop protection methods for preventing such information from being corrected or replicated in an illegal manner;

c) Assess potential risks incurred in online transactions according to the clients, type of transaction and transaction limit with the aim of working out feasible solutions for transactions in conformity with regulations of the State Bank of Vietnam;

d) Apply anti-phishing authentication measures and methods for preventing and fighting against illegal alteration to websites which provide online transaction services.

2. Information systems that provide online transaction services must have methods for strict supervision, detection and warning of:

a)Suspected transactions based upon determination of transaction time and place (geographical location and IPaddress), transaction frequency rate, transaction monetary amount and number of authentication inconsistent with regulations;

b) Abnormal operations of the systems;

c) Denial of Service attack (DoS) and Distributed Denial of Service attack (DDoS)

3. The institution shall give instructions for information security assurance methods and warning of risks to clients before use of online transaction services and on a periodic basis.

4. Methods for ensuring software integrity must be employed when online transaction applications and software on the Internet are provided.

Article 26. Supervision and recording of operations of information systems into the logbook

Operations of information systems shall be monitored and recorded into the logbookfrom the Level 2 and aboveas follows:

1.Record operations of information systems and users, errors and information insecurity incidents into a logbook and retain such logbook, include information of:

a) Internet connection (firewall log);

b) Sign-up;

c) Configuration change;

d) Data access and important services (if any);

dd) Arising errors in the operation;

e) Warnings from devices;

g) Efficiency of device activities (for the information system from level 3 and above).

2.Data contained in logbooks of Level 2 information systems and above must be preserved online for at leastonemonth in a concentrated manner and backed up at leastsix months.Data contained in logbooks of Level3information systems and above must be preserved online for at least three months in a concentrated manner and backed up at least a year.

3. Have plans in supervision and warning when having any changes in confidential information store in back-up system or device of the system of Level 4 information and above.

4.Protect the function of logbook recording and information contained in the logbook, anti-phasing and unauthorized access and ensure that the system administrators and users could not remove or revise the logbook containing their own activities on the system

5. Synchronize the time of different information systems.

Article 27. Malicious code protection

Regulations on malicious code protection shall be made and satisfied as follows:

1. Define responsibilities of individuals and departments relating to protection from malicious codes

2. Employ methods for protecting from malicious codes applied to the entire information systems of the institution

3. Update new malicious code samples and malware protection software: set up automatic or daily updates.

4. Check and remove malicious codes for externally-received information-bearing objects before use.

5. Control the software installation to ensure compliance with information security regulations of the institution.

6. Take control of unknown emails, enclosures or links attached to unknown emails.

Section 5.

ACCESS MANAGEMENT

Article 28. Requirements for access management

1. Regulations on access management applied to users, groups of user, equipments and instruments used for accessing to information systems satisfying professional requirements and information security requirements shall include basic contents as follows:

a) Registration, granting, extension and revocation of access rights of the users;

b) Each account getting access to the system must be given to a single user; in case one account is shared by different persons for access purpose, such common use must be approved by competent authorities and responsibilities of each person at each using time must be defined.

c) The account of automatic connection application and service must be transferred under one user’s management and limit the assess rights in accordance with using purpose; that user is not allowed to use this account for other purpose;

d)With regard to Level3information systems and above,and information system for client s personal information,limit and control access from the followingadministrators accounts: (i) Develop a mechanism to control opening of administrators accounts with the aim of ensuring that no administrator s account could be put in use without approval of competent authorities; (ii) Work out methods for controlling use of administrators’ accounts; (iii) Administrators accounts must be used within a time limit which ensures task completion and must be revoked right after such completion; (iv) Connection of system administration must be made by the intermediary server or centralized management system, not allowed to process from administrator’s computer;

dd) Manage and grant passwords to access to information systems;

e) Review, check and revise users’ access rights;

g)Set out information security requirements applied to equipment and instruments used for access purpose

2. Regulations on password management must meet the following requirements:

a) Any password must contain at least six characters including numbers, uppercase lattes, lowercase letters and special characters if allowed by the systems; Valid requests for passwords must be automatically checked when a password is set up;

b)Any defaultpasswordset by a manufacturer on a device, software and database must be changed before use;

c)Password management software must be developed with the following functions: (i) Requesting for password change in first login (not applicable to one-time passwords); (ii) notifying users of change ofapasswordwhich is about to expire; (iii) invalidating an expired password; (iv) invalidating an password in case the number of incorrect entry exceeds the permittedtime; (v) granting permission to promptly change a password which has been disclosed or is exposed to a risk of being disclosed or upon the request of users; (vi) preventing use of old password during a specified period. 

3.Regulations on responsibilities of users who are granted access rights shall include the following contents: using passwords in accordance with regulations, ensuring password confidentiality, using equipment or instruments for access purpose and signing out of the systems when stopping work or temporarily leaving the systems.

Article 29. Management of local networkaccess

Policies on management of access to the local network shall be formulated and implemented meeting the following requirements:

1. Issue regulations on management of network access and network services including the following basic contents:

a) Networks and network services permitted for use, mode, means and requirements of information security for access purpose;

b) Responsibilities of administrators and users;

c) Procedures for granting, changing and revoking connection rights;

d) Control of network access, use and administration

2. Employ methods for strict control of connections from untrusted networks to the local network of the institution for the purpose of information security assurance.

3. Take control of installation and use of remote access tools and software.

4. Control access to ports used for setting and administration of network devices.

5. Grant right to access to a network and network service under the principle that such right is sufficient to perform the assigned tasks.

6. Connect through the Internet to the local network of the institution for the purpose of virtual private network use and multi-factor authentication.

Article30. Management of information systemaccessand applications

Access management shall satisfy the following requirements:

1. Take control of utility software possibly affecting information systems

2. Regulate time of application access corresponding with the time of professional operations and services provided by such application.Automatically switch off a working session after a rest time in order to prevent unauthorized access.

3. Manage and give the right to access to information and applications adhering to the principle that such right is sufficiently granted to perform tasks assigned to the users. To be specific:

a) Give rights to access to each folder and function of each program;

b) Give rights to read, record, remove and use information, data and programs.

4. Information systems supported from a common resource must be approved by competent authorities.

5. With regard to servers of Level3information systems and above, it is required to establish a secure connection and auto login prevention plan.

6. For the Level 4 information system and above must apply the multi-factor authentication when sign in the server, application or other important devices and network security.

Article 31. Internetconnection management

Regulations on management of Internetconnectionshall meet the following requirements:

1.Regulations on management of connection and access to the Internet including the following basic contents:

a) Responsibilities of individuals and departments involved in use of the Internet;

b) Type of persons permitted to connect and access to the Internet;

c) Restricted and prohibited acts;

d) Internet access and connection control;

dd) Information security methods for Internet connection.

2. Manage Internet connection ports of the entire institution in a concentrated and consistent manner

3. Provide network security solutions for Internet connection ports with the aim of ensuring security against risks from Internet attacks into the local network of the institution

4. Use instruments for timely detecting and identifying vulnerabilities, holes, attacks as well as illegal access to the local network of the institution through Internet connection ports.

Section 6.

MANAGEMENT OF USE OF INFORMATION TECHNOLOGY SERVICES PROVIDED BY THIRD PARTIES

Article 32. General principles for use of services provided by third parties

When using information technology services provided by a third party, the institution shall adhere to the following principles:

1. Do not reduce the capacity to provide continuous services for clients of such institution

2. Do not reduce control of professional procedures of such institution

3. Do not change responsibilities for ensuring information security of such institution.

4. Information technology services provided by the third party must satisfy regulations on information security issued by such institution

Article 33. Requirements for service uses provided by third parties

Before using services provided by a third partythat shall be deployed for the information system Level 3 and above and other information system for client’s personal information, the institution shall perform the following tasks:

1. Carry out assessment of information technology risks and operating risks which at least includes:

a) Identifying risks, analyzing and estimating the extent of damage and threats to information security;

b) Defining capacity to control professional procedures, capacity to provide continuous services for the clients and capacity to provide information for regulatory agencies;

c) Clearly determining responsibilities for service quality assurance of parties concerned;

d) Working out risk minimizing methods and trouble preventing and solving methods;

dd) Reviewing and adjusting policies on management of risks (if any).

2. If using the cloud computing service, in addition to requirements specified in Clause 1 this Article, the institution shall take on the following duties:

a) Separate activities and professional tasks expected to be performed on cloud computing based upon assessment of impacts of the aforesaid activities and professional tasks on operations of the institution;

b) Prepare backup plans for components of Level3information systems and above.Backup plans must be tested and assessed to see whether they are available to replace activities and professional tasks performed on the cloud computing;

c) Set out criteria for selection of third parties meeting requirements specified in Article 34herein;

d) Review, amend and apply information security methods of the institution and limit access through cloud computing to information systems of such institution.

3. In case the third party is hired to perform all administration activities for Level3information systems and above,and information systems for client’s personal information,the institution shall carry out risk assessment as prescribed in Clause 1 this Article and send reports on such assessment to the State Bank of Vietnam (Informatics Technology Department).

Article 34. Criteria for selecting a third party providing the cloud computing service

Any third party shall be selected if itmet at least the following requirements:

1.Beingan enterprise;

2.Owninginformation technology infrastructure corresponding to the service requested by the institution which:

a)Complyingwith provisions of Vietnamese laws;

b)Beinggranted an unexpired international certificate of information security.

Article 35. Contract for service use with a third party

The contract for service use with a third partyfor the Level 3 information system and above and other information system for client’s personal informationshall at least contain the following contents:

1. Commitment to ensure information security made by the third party which includes:

a) Not replicating, altering, using or providing data of the institution using the service for another individual or institution, except for cases required by competent regulatory agencies as per law provisions; in such case, the third party is required to notify the institution using the service of data provision to another institution before such provision, unless cases in which notification will go against the law of Vietnam;

b) Broadcasting information security regulations issued by the institution to staff members of the third party involved in contract execution and using monitoring methods for ensuring conformity with the aforesaid regulations

2. Regulations on time limit for service interruption and troubleshooting time, requirements regarding assurance of continuous operation (on-site backup, backup data, disaster recovery), requirements regarding storing, calculating and processing capacity as well as actions taken in case of lack of service quality assurance

3. Cases in which lease of a auxiliary contractor by the third party causes no change in responsibilities of such third party for services in current use of the institution.

4. Data generated during the service use that is considered asset of the institution. When the service use is terminated:

a) The third party shall return all data used and data generated during the service use for the institution;

b) The third party shall make a commitment to delete all data of the institution within a specified period.

5. Notification of any violations against information security regulations applied to the service in use committed by staff members of the third party

6. The contract for use of cloud computing service containing the following additional contents apart from those prescribed in Clause 1, 2, 3, 4 and 5 this Article:

a) The third party must provide reports on audit of compliance with information technology regulations conducted by independent audit authority every year within the time of contract execution;

b) The third party must provide instruments for control of cloud service quality and procedures for monitoring and control of cloud service quality;

c) The third party must clearly designate locations (cities or countries) for establishment of the data center outside of the Vietnamese territory which provides services for the institution;

d) Responsibilities for data protection and prevention of unauthorized access to data through service distribution channels from the third party to institution must be defined;

dd) The third party must assist and cooperate in investigation carried out as required by competent regulatory agencies of Vietnam as per law provisions;

e) Data of the institution must be separated from other clients’ data used on the same technical basis provided by the third party.

Article 36. Responsibilities of the institution during the use of services provided by a third party

The institutions shall have responsibility when using the third party’s services as follows:

1. Provide, notify and ask the third party to comply with information security regulations issued by the institution.

2. Establish procedures and allocate resources to monitor and control services provided by the third party with the aim of ensuing service quality under provisions of the signed contract. With regard to cloud computing services, monitoring and control of service quality are required.

3. Impose the institution’s information security regulations on devices and services provided by the third party which are operated on the infrastructure used and managed by such institution.

4. Manage changes in services provided by the third party including changes made to suppliers, solutions, versions and changes of contents specified in Article 41herein and assess all impacts of those changes for safety assurance before use

5. Employ methods to strictly monitor and limit access right of the third party when such party is allowed to obtain access to information systems of the institution.

6. Supervise staff members of the third party during the contract execution. If discovering any violation against information security regulations committed by such staff member, the institution shall notify and cooperate with the third party in timely handling.

7. Revoke right to access to information systems granted to the third party, change locks and passwords transferred from such third party right after job completion or contract termination.

8. With regard to Level3information systems and above or information systems using cloud computing services, assessment of compliance with information security regulations of the third party under provisions of the signed contract must be carried out. Carry out annual or irregular assessment of compliance with regulations as required. Results of information technology audit conducted by the independent audit authority may be used in such assessment.

Section 7.

MANAGEMENT OF ACCEPTANCE, DEVELOPMENT AND MAINTENANCE OF INFORMATION SYSTEMS

Article 37. Requirements for information system safety and security

When creating or improving its information systems, the institution must classify information systems in order of importance as prescribed in Article5herein. With regard to Level2information systems and above, such institution shall take on the following obligations:

1. Prepare design data and description of information security plans. For the purpose of such data and description, safety and security requirements shall be set out in conjunction with technical and professional requirements.

2. Prepare system testing and verifying plans which is launched in consistent with the design data meeting information security requirements before acceptance. The testing results must be reported in writing and approved by competent authorities before use.

3. Strictly monitor and manage purchase of external software in compliance with regulations in Article 36herein.

Article 38. Assurance of safety and security for applications

Application programs supporting operations of the institution must at least satisfy the following requirements:

1. Verify validity of data input into applications and ensure the input data is accurate and valid;

2. Verify validity of data requiring automatic processing contained in applications for the purpose of detecting false information incurred by processing errors or intentional information alteration;

3. Work out methods for ensuring authenticity and protecting integrity of data processed by applications;

4. Verify validity of data retrieved from applications and ensure information is processed by applications in an accurate and valid manner;

5. Users’ passwords in Level 2 information systems and above must be encrypted at the application layer.

Article 39. Encryption management

Encryption shall be managed as follows:

1. Develop and employ encryption methods under national technical regulations on data encryption applied to banking or accredited international standards

2. Work out encryption management methods in order to protect information of the institution.

Article40. Safety and security for software development

1. The institution shall manage software development as follows:

a) Manage and control source programs

Any access or approach to source programs must be approved by the competent authority;

b) Manage and protect system configuration folders

c) Require the third party to supply the source of software for the outsourced software of the information system Level 2 and above.

2. Select and control testing and experiment data Real data of information systems in current operation is not allowed to be used in testing activities if the data containing client s information and classified information are not changed or hidden.

Article 41.Changes management in information systems

The institution shall issue procedures and methods for management and control of information system changes which at least include:

1. Recording changes, preparing changing plans, conducting inspection and experiment of changes and making result reports, approving changing plans before making official changes to software version, hardware configuration, software parameters and operational procedures. Preparing backup plans for system recovery in case of unsuccessful changes or unexpected problems.

2. Carrying out inspection and assessment of effects caused by changes to ensure normal and safe operations in new environment of Level 2 information systems and above in cases of changes made to the version or operating system, database and middleware.

Article 42. Assessment, evaluation ofinformation system safety

1. Assessment of information system safety and security must include the following contents:

a) Checking the legal compliance on information system security at all levels’

b) Evaluating the efficiency of the information system security;

c) Evaluating and find out the malicious code, gap, technical disadvantages in accordance with the regulations prescribed at Article 43 of this Circular;

d)Conducting penetration test required for information systems which have connection to and provide information and services on the Internet or connect to clients and third parties

dd)Checking configuration of security devices, systems for automatic grant of access rights, systems for management of terminal devices and list of user accounts;

2. The institution shall carry out assessment of security of Level3information systems and aboveand other information system for client’s personal informationas per regulations in Clause 1 this Article before use.

3. During operation of information systems, the institution shall carry out security assessmentas per regulations Clause 1 of this Articleas follows:

a) Carry out assessment once every six months for Level5information systems;

b) Carry out assessment once every year for Level4 and 3information systems and devices directly interacting with the external environment such as connecting to the Internet, clients and third parties;

c)Carry out assessment once every two years, evaluate the information security and risk management for information security in the whole activities of the institutions.

4. Assessment results must be reported in writing to the legal representative of the institution and the competent authority. As for any content fails to comply with information security regulations (if any), methods, plans and time limit for resolution must be recommended.

Article 43. Management of technical vulnerabilities

The institution shall manage technical vulnerabilities as follows:

1. Set out regulations on assessment, management and control of technical vulnerabilities of active information systems

2. Regularly update information concerning technical vulnerabilities and holes;

3.Carry out scanning and detection of malicious codes, technical holes and vulnerabilities of active information systemsas per regulations at Clause 3, Article 42 or when receive the relevant information to new malicious codes and technical holes

4. Assess the level of impact and risks caused by technical holes and vulnerabilities of active information systems which have been detected and recommend possible solving plans

5. Develop and adopt troubleshooting methods and report the troubleshooting results

Article 44. Management of information system maintenance

The institution shall carry out information system maintenance as follows:

1. Issue regulations on information system maintenance right after such system is officially put in use Maintenance procedures shall at least contain the following contents:

a) Maintenance scope and subjects;

b) Maintenance time and frequency;

c) Technical scenario and procedures for maintenance of each component and the entire information system;

d) Reports sent to the competent authority for handling purpose if any incident is found during the maintenance;

dd) Duties and responsibilities assigned to department in charge of maintenance and maintenance supervision

2. Carry out maintenance as prescribed in Clause 1 this Article in respect of information systems under management of the institution

3. Review maintenance regulations at least once every year or in case of changes made to information systems.

Section 8.

MANAGEMENT OF INFORMATION SECURITY INCIDENTS

Article 45. Procedures for handling incidents

Incidents shall be managed as follows:

1. Issue procedures for handling information security incidents including the following contents:

a) Receiving any information on incidents incurred;

b) Assessing the level and extent of impacts of such incident on operations of information systems. According to the level and extent of the incident, the institution shall report such incident to equivalent level of management authorities for guidelines on troubleshooting

c) Employing troubleshooting methods;

d) Recording and reporting the troubleshooting results

2. Assign responsibilities to individuals and collectives in terms of reporting, receiving and handling information security incidents.

3. Create forms for recording and storing troubleshooting documents.

Article 46. Incident handling and control

Incidents shall be controlled and handled as follows:

1. Make a list of information security incident and troubleshooting plan in respect of Level3information systems and aboveand information system for processing client’s personal informationand review and update such list and plan at least once every six months.

2. Immediately report to the competent authority and relevant persons if any information security incident is found for the purpose of finding solutions as soon as practicable.

3. Collect, record, protect and store evidence at the institution during incident inspection and handling.

4. Assess and determine causes, and adopt methods for prevention of incident recurrence after troubleshooting.

5. In case information security incidents relate to violations against laws, the institution shall take responsibility to collect and provide evidence for competent authorities in accordance with law soft provisions.

6. Annually rehearsal should be organized to have the plan to solve the Level 3 information system security and above and alternately perform if having more than 02 Level 3 information system and above.

Article 47. Network Security Operation Center

1. The Level 3 information security system and above must establish or appoint the authorized department to manage the operation of the Network Security Operation Center (not applicable for the branches of foreign banks, intermediary suppliers for payments, non-banking credit institutions, micro-economic institutions, primary credit institutions, credit information companies, Vietnam Asset Management Company, National Banknote Printing Plant).

2.The Network Security Operation Center shall take on the following obligations:

a. Proactively monitor, collect and receive any information and warning about internal and external information security risks;

b. Develop a system for security information and event management, collect and store information in a concentrated manner, at least including: logbooks of Level 2 information systems and above and warning and logbook of network security equipment such as firewall and IPS/IDS;

c. Analyze information in order to detect and warn in respect of cyber attack risks and threats and cyber security incidents and send reports to the system administrator if finding any incident relating toLevel 3 information systems and above and other information systems of client’s personal information;

d. Coordinate incident response activities, zone, prevent and minimize impact and damage to information systems if any incident occurs;

dd. Carry out investigation and determination of attack methods, modes and causes and take measures to prevent incident recurrence;

e. Provide information as required by the State Bank for the purpose of network security surveillance in baking.

Article 48. Cyber security incident response activities

1.Thecyber security incident response team in banking shall include:

a) The Steering Committee established by the State Bank’s Governor;

b) Coordinating authority which is the Information Technology Authority (State Bank);

c) Members of the team: the Information Technology Authority (State Bank), credit institutions (departments in charge of information security) and voluntary members which may be voluntary organizations or business facilities.

2. The teamshall cooperate with internal and external resources in efficient cyber security incident response which helps to ensure safety in banking operations.

3.Principles for incident response and coordination

a)The team shall be responsible for: (i) Approving the annual operation strategies and plans; (ii)Manage the team operation (incident response, training and practice for incident); (iii) Evaluate the operation activities of the network, report annually to the Governor of the State Bank;

b) Organizations prescribed in point c Clause 2 this Article shall take responsibility to provide resources and become members of the team;

c) If any cyber security incident is found, the members must notify such incident to the coordinating authority as prescribed in Clause 1 Article 54herein;

d) If facing serious incidents which could not be handled on their own, the members shall request help from the coordinating authority;

dd) According to each incident, the coordinating authority shall ask for assistance of the members or competent regulatory agencies.

4. Principles for information management and use in incident response and coordination:

a) Information exchanged and provided during incident response and coordination must be classified information;

b) Any act of use of information exchanged during incident response and coordination which cause negative effects on prestige and image of the organization proving such information is prohibited.

Section 9.

ASSURANCE OF CONTINUOUS OPERATION OF INFORMATION SYSTEMS

Article 49. Principles for continuous operation assurance

1. The institution shall at least satisfy the following requirements:

a) Analyze impact and assess risks in respect of interruption or termination of information system operation;

b) Establish a scenario and procedure for assurance of continuous operation of information systems as prescribed in Article 51herein;

c) Adopt methods for ensuring continuous operation as prescribed in Article 52herein.

2. Based upon impact analysis and risk assessment specified point a Clause 1 this Article, the institution shall make a list of information systems requiring continuous operation assuranceincluding Level 3 information systems and above.

3. Information systems requiring continuous operation assurance specified in Clause 2 this Article must ensure great availability and have disaster recovery systems.

Article50. Establishment of disaster recovery systems

1. The institution shall establish a disaster recovery system meeting the following requirements:

a) It is required to carry out risk assessment and consider possibility of disasters having impact on both main information system and disaster recovery system when selecting the location for establishment of the disaster recovery system such as natural disaster including earthquake, flood and widespread epidemic, disasters caused by human and technologies including power network incidents, fire, traffic incidents and cyber security attacks;

b) Location for establishment of the disaster recovery system must satisfy requirements specified in Article 17herein;

c) The disaster recovery system must be capable to replace the main system: (i)within 4 hours in respect of theLevel 3information systemand above (except for the information system for state secret information); (ii) within 24 hours in respect for the state secret information; (iii) as per institution’s regulations for other systems.

2. Institutions that only have a single office in Vietnam must have a standby office which is located in a different area and separated from the main office, and equipped with necessary devices to ensure continuous operation of information systems instead of the mainworking place.

Article 51. Formulation of procedures and scenario for assurance of continuous operation of information systems

The procedure and scenario for assurance of continuous operation shall be established as follows:

1. Establish a procedure for response to operational insecurities and interruptions of each component of Level3information systems and above.

2. The institutions having the main and back-up information systems located outside Vietnam must make plans to ensure the continuous operation of information systems for the case of transmission interruption with the main and backup information systems.

2. Construct a scenario for conversion of operation from the main system to the standby one, including job description, conversion process and expected completion date which meet the following requirements:

a) Have necessary resources, instruments and conditions for conversion;

b) Have forms for result recording;

c) Assign staff members involved in the conversion to give instructions for conversion, monitor, carry out conversion, operate the system and check the results;

d) Take measures to ensure information security;

dd) Prepare plans for assurance of continuous operation in case of unsuccessful conversion.

4. The institution that has a single office in Vietnam must construct a scenario for conversion of its operation to the standby office.

5. Conversion procedures and scenario must be checked and updated in case of changes made to information systems, organizations structure, personnel and responsibilities given to relevant departments in the institution.

Article 52.Plan implementation for continuous operation assurance

1. Plans for assurance of continuous operation of information systems(except for the information system have the main and backup information operating at the same time)shall be prepared and implemented meeting the following requirements:

a) Carry out inspection and assessment of operation of the standby system at least once every six months;

b) Carry out operation conversion from the main information system to the backup one and put it into official operation within at least 01 working day, for each information system in accordance with the list in Clause 2, Article 49 herein; carry out operation conversion every once year for Level 4 information system and higher, twice per year for Level 3 information system and lower; access the results and update the conversion procedure and script (if any). In the case that the operation conversion cannot made in the working days, the backup system must be made with the same capacity and configuration with those of the main system; and the conversion and inspection of the backup system’s readiness shall be carried out annually.

2. Institutions that have a single office in Vietnam must perform annual drill for operational conversion to ensure continuous operation of information systems.

3. Plans for operational conversion drill shall be notified to the State Bank (Information Technology Authority) within 5 working days before such drill via the email[email protected].

Section 10.

INTERNAL INSPECTION AND REPORTING MECHANISM

Article 53. Internal inspection

The institution shall carry out internal inspection as follows:

1. Set out regulations on internal inspection in respect of information security assurance

2.Annually, prepare plans and carry out internal inspection of compliance with regulations herein and internal regulations on information security assurance. For commercial banks and branches of foreign banks, internal inspection shall be carried out by the risk management departments or the compliance department at least once every year and by internal audit department or independent audit institutions at least once every three years.

3. Send reports on results of information security inspection to the legal representative of the institution and competent authorities in which plans for dealing with problems failing to comply with information security regulations (if any) that remain unsolved shall be provided

4. Implement such plan and report the results of handling of unsolved problems stated in the aforesaid reports as prescribed in Clause 3 this Article

Article 54. Reporting mechanism

The institution shall send reports to the State Bank (Information Technology Authority) including the following contents:

1. Reports on cyber security incidents(in accordance with the Appendix 01 attached with Circular)sent within 24 hours starting from the detection of such incident and within 5 working days after incident handling under instructions provided in the Appendix issued thereto to the email address [email protected].

2. Reports on risk assessment as prescribed in Clause 3 Article 33herein sent directly or by post to the State Bank (Information Technology Authority) in case all management activities for Level3information systems and above of the institution are performed by another organization under a lease contract, which is sent 10 working days before such management.

3. Reports all individual working in the institution’s information technology which have been disciplined as per regulations prescribed at Clause 6, Article 16 of this Circular shall be sent 05 working days directly or by post to the State Bank of Vietnam (Information Technology Authority) from the time of having the disciplinary decisions.

Chapter III

IMPLEMENTATIONORGANIZATION

Article 55. Responsibilities of entities affiliated to the State Bank

1. The Information Technology Authority shall take responsibility to:

a) monitor and send consolidated reports on implementation of institutions to the Governor of the State Bank as per regulations herein;

b) prepare annual plans for inspection of implementation of this Circular;

c) preside over and cooperate with relevant entities affiliated to the State Bank in dealing with questions arising during implementation of this Circular.

2. The Payment Systems Department shall assume responsibility to corporate with the Informatics Technology Department to investigate the implementation of this Circular at the intermediary service suppliers for payment.

3. The banking investigation and supervision agencies shall be responsible for investigating the implementation of this Circular at all the institutions and handling the administrative violations for all the violations at this Circular as per legal regulations.

4. The State Banks in provinces and cities shall be responsible for investigating the implementation of this Circular at all the institutions and handling all administrative violations at this Circular as per legal regulations.

Article56.Effect

1. This Circular takes effect on January 01, 2021, unless otherwise prescribed at Clause 2 of this Article and replaces the Circular No. 18/2018/TT-NHNN dated August 21, 2018 of the Governor of the State Bank of Vietnamon information system security in banking operations.

2. Point b, Clause 4, Article 20 takes effect on January 01, 2022.

Article 57. Implementation organization

3. Director of the Information Technology Authority, Directors of relevant entities affiliated to the State Bank, Chairman of Boards of Director, Member Councils, Directors General (Directors) of credit institutions, branches of foreign banks and intermediary payment service providers,the National Payment Corporation of Vietnam (NAPAS), Vietnam Asset Management Company (VAMC), National Banknote Printing Plant, Deposit Insurance of Vietnamshall implement this Circular ./.

For the Governor

The Deputy Governor

Nguyen Kim Anh