Legal review: 15 October 2026 · Đọc tiếng Việt
Approval of a security level dossier is one stage in protecting an information system. The organisation must also implement the protection plan, assign staff, operate its policies, monitor risks and remedy weaknesses. Documentation and the actual system should remain aligned throughout the system lifecycle.
1. What follows approval?
Articles 28–30 of Decree 331/2026/ND-CP address management and technical requirements. Depending on the applicable level and circumstances, the work plan should cover:
- Security policies, internal rules and assigned management, operational and cybersecurity responsibilities;
- Protection of networks, servers, applications and data, including access and change management;
- Storage, backups, recovery checks and contingency arrangements;
- Monitoring, detection, incident response, remediation and risk management;
- Assessment of compliance and control effectiveness, with applicable reporting;
- End-of-life arrangements, handover, decommissioning and disposal of systems or data.
This is an orientation list, not a substitute for the complete technical standards and regulations applicable to a particular level. Article 30(6) requires the approved protection plan to be fully implemented before a new, expanded or upgraded system enters operation. Article 28(3) also requires cybersecurity readiness assessment before operation, upon major changes and when requested by a competent authority.
2. Does using cloud or an outsourced operator remove the owner’s responsibility?
No. Distinguish the provider’s infrastructure from the customer’s applications, accounts, data and configuration. The agreement should allocate administration and access rights, data protection, incident cooperation and continuity-preserving handover. The owner retains the responsibilities in Article 31, while the supplier performs its statutory and contractual tasks.
Article 30(8) requires logical separation and access controls for Level 3 and 4 systems leased at data centres or on cloud infrastructure. Level 5 systems and systems important to national security have separate, more stringent requirements in paragraph 9. A provider’s certificate does not replace an assessment of the customer’s actual architecture.
3. Why should legal and technical teams work together?
| Client need | Legal and organisational work | Technical work |
|---|---|---|
| Correct scope | Applicability, ownership, authority, contracts and sector obligations | System boundaries, data, architecture and connections |
| Dossier and policies | Legal grounds, allocation of responsibility, procedure and consistent records | Current-state documentation, risk assessment, protection plan and implementation evidence |
| Supplier selection | Relevant licences, scope, confidentiality, responsibility and handover | Capability, minimum access rights, service requirements and solution compatibility |
| Operations and change | Reporting responsibilities, decision authority and policy updates | Monitoring, testing, remediation, backups, recovery and configuration updates |
The aim is a plan that works within the client’s business. Coordination helps avoid policies the system cannot support, or technical measures implemented without clear responsibility and adequate evidence.
4. How should a technical provider’s licence be checked?
Decree 332/2026/ND-CP, effective from 19 August 2026, regulates cybersecurity products and services. Article 4 covers categories including cybersecurity testing and assessment, consulting, monitoring and incident response. Article 5 requires a licence when conducting business in the products and services listed in Articles 3 and 4.
Check the legal entity, licensed service categories, scope and validity, as well as practical capability. An IT business registration or an individual professional certificate does not automatically replace the business licence required for a regulated cybersecurity service. Licences issued under earlier legislation must be assessed under the relevant transition provisions rather than rejected or accepted solely because of their older title.
5. How KM UNION coordinates support
KM UNION provides legal advice, reviews obligations and assists with the legal elements of dossiers, internal rules and contracts. It also coordinates with capable IT and information security/cybersecurity providers holding the licences appropriate to their assigned services, helping the client develop a consistent legal and technical approach.
Specialist surveys, assessments, solution design and implementation falling within regulated cybersecurity business activities are assigned to providers meeting the applicable conditions and licensing scope. Each project identifies the partner, responsibilities, deliverables and information-sharing process. KM UNION does not replace statutory appraisal or approval bodies and does not guarantee immunity from all security incidents.
6. What should the engagement agreement address?
- The system list, boundaries and division between legal, documentation and technical work;
- Client inputs, deliverables, acceptance criteria and how missing information will be resolved;
- Project contacts, decision rights, access permissions and confidentiality;
- Authorisation and conditions for technical testing, test environments and continuity arrangements;
- Post-handover support, change handling and responsibility for keeping documentation current.
A transparent engagement begins with the actual system and a written scope. Contact KM UNION to assess which systems need documentation, which requirements are already met and where licensed technical support is required.
Legal sources
Luật An ninh mạng 116/2025/QH15; Nghị định 331/2026/NĐ-CP; Nghị định 332/2026/NĐ-CP.
Reviewed on 15 October 2026. This article provides general information, not advice for a particular system or dossier. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Who Needs an Information System Security Level Dossier in Vietnam?
- Vietnam Security Level Dossier: Documents and Approval Process
- Vietnam Information Security Level 2 vs Level 3: The 2026 Criteria
