Legal review: 15 October 2026 · Đọc tiếng Việt
An information system’s security level depends on its functions, information, scale and potential impact. “Small business equals Level 2” and “personal data always means Level 3” are both unreliable shortcuts. First establish whether the system is within scope, then assess all relevant criteria.
This guide explains common issues under Articles 8–15 of Decree 331/2026/ND-CP. “Information security level” is a familiar search term; current documentation must reflect the applicable cybersecurity framework.
1. Three rules before proposing a level
- Use the highest applicable level. Where multiple criteria apply, Article 8 requires the highest level.
- Define the system correctly. Consider business functions, data flows, dependencies and how an incident could spread. Physical location and organisational boundaries alone are insufficient.
- Do not artificially split or combine systems. Formal restructuring must not distort the classification to obtain a lower level.
2. Common Level 2 and Level 3 criteria
| Issue | Level 2 — Article 12 | Level 3 — Article 13 |
|---|---|---|
| Internal activities | Internal systems processing private or personal information, without state secrets. | Other criteria and risk must be assessed. Personal data in an internal system does not automatically make it Level 3. |
| Online services | Online services outside the list of conditional business sectors, subject to any higher applicable criterion. | Online services within conditional business sectors, and systems handling administrative procedures. |
| Personal data in the relevant category of other online services | Article 12 refers to fewer than 100,000 basic personal data subjects or fewer than 10,000 sensitive personal data subjects; all criteria and the highest-level rule must still be checked. | At least 100,000 basic personal data subjects or at least 10,000 sensitive personal data subjects is a criterion under Article 13. |
| Information infrastructure | Infrastructure serving one body or organisation. | Shared infrastructure across a ministry, sector, province or multiple provinces. |
| Industrial control | Employee numbers or turnover do not by themselves establish Level 2. | Industrial control systems serving Class II, III or IV construction works fall within the relevant Article 13 criterion; the construction classification must be verified. |
This table highlights common criteria, not the entire classification framework. State secrets, defence, national security, Prime Ministerial decisions and risk assessment require additional analysis. A system meeting Level 4 or 5 criteria cannot remain at Level 3 merely because those criteria are not reproduced here.
3. Count data subjects, not simply accounts
The data thresholds refer to data subjects, not just logins or visits. One person may hold several accounts; a system may also process information about people without accounts. The technical team should establish an evidence-based inventory and counting method.
Fewer than 100,000 basic personal data subjects does not offset reaching 10,000 sensitive personal data subjects. Once a Level 3 criterion is met, Level 3 and any higher criteria must be considered. Selecting the lower-threshold branch cannot be used to disregard the other criterion.
4. Three illustrative scenarios
Scenario A — a non-conditional online service: assume an in-scope platform processes only basic personal data about 20,000 people, no sensitive personal data and no higher-level criterion. Level 2 is the starting point to examine, subject to the full functional and risk assessment.
Scenario B — sensitive data about 12,000 people: a system within the relevant online service category meets the Level 3 data threshold even if fewer people have login accounts. Higher-level criteria must still be checked.
Scenario C — an online service in a conditional business sector: a small customer base does not automatically justify Level 2. Check Article 13 and establish precisely whether the actual service falls within the conditional business list currently in force.
5. When should classification be reviewed?
Article 10 calls for risk assessment when a level is first determined and in situations including changes to functions, scope, users, data or technology; expansion, integration, interconnection or data sharing; serious incidents or high risks; and requests from competent authorities. Where reclassification is necessary, Article 25 applies the initial determination procedure.
Build this review into product and infrastructure change management, including new customer portals, combined databases, expanded services and cloud architecture changes. An old approval does not automatically cover every later development.
6. Is this the same as personal data protection documentation?
No. System classification and protection address information system requirements. Personal data protection obligations must be assessed separately against the actual processing activities. A shared data inventory and aligned responsibilities can improve consistency, but one dossier should not be assumed to replace the other.
7. KM UNION’s coordinated support
KM UNION works with technical partners to clarify applicability, functions, data categories, the basis for the proposed level and management requirements. Regulated technical services are performed by appropriately qualified and licensed providers. The engagement sets out a practical work plan and responsibilities; the legal authority to determine and approve the level remains with the designated bodies and units.
Legal sources
Luật An ninh mạng 116/2025/QH15; Nghị định 331/2026/NĐ-CP; Nghị định 332/2026/NĐ-CP.
Reviewed on 15 October 2026. This article provides general information, not advice for a particular system or dossier. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Who Needs an Information System Security Level Dossier in Vietnam?
- Vietnam Security Level Dossier: Documents and Approval Process
- Beyond the Security Level Dossier: Legal and Technical Compliance
