Legal review: 15 October 2026 · Đọc tiếng Việt
A proposed information system security level dossier should explain what the system does, why the proposed level is appropriate and how it will be protected. It must reflect the design or actual operating environment and follow the correct appraisal and approval route. It is not a certificate guaranteeing that a company can never suffer a security incident.
1. What documents are required?
Article 21 of Decree 331/2026/ND-CP identifies these components:
- System overview: the system owner, operator, scope, scale, intended users and architecture.
- Design documentation: a preliminary design or equivalent for new construction, expansion or upgrade projects; an approved construction design or equivalent for an operating system.
- Proposed level explanation: information categories, system type, applicable legal criteria and supporting risk identification.
- Cybersecurity protection plan: the management and technical measures for the proposed level, explaining how each requirement will be implemented.
- Specialist opinion: the dedicated cybersecurity unit’s professional opinion for proposed Level 4 or Level 5 systems.
Requests, submission documents, appraisal opinions and decisions follow the relevant procedural stage and the forms attached to the Decree. Not every form is required at the same time for every level.
2. Who appraises and approves the dossier?
| Level | Appraisal | Approval |
|---|---|---|
| 1 and 2 | The system owner’s dedicated cybersecurity unit | That unit approves the proposed level and reports to the owner. |
| 3 | The owner’s dedicated cybersecurity unit | The system owner. |
| 4 | The Ministry of Public Security under the applicable allocation; Article 18 provides separate arrangements for military and government cryptographic systems | The system owner, based on appraisal results. |
| 5 | The competent authority under Article 18 | The Ministry of Public Security coordinates submission of the national security system list to the Prime Minister; the owner approves the cybersecurity protection plan. |
Read Articles 18 and 20 together. Level 3 or 4 systems designated as important to national security follow the Level 5 procedure. Where the dedicated cybersecurity unit also manages or operates the system, the owner must address independent appraisal through the prescribed competent unit or independent appraisal council arrangement. An external consultant does not automatically become the statutory approving authority.
3. A practical preparation workflow
- Confirm scope and responsibility. Identify the applicable obligations, owner, operator and dedicated cybersecurity unit. Review appointments and any valid delegation.
- Survey the system. Inventory applications, devices, servers, network zones, IP addresses, services, data and external connections. The technical team should confirm that the records reflect the actual environment.
- Support the proposed level. Apply Articles 8–15, including the highest applicable criterion and risk assessment. A lower level cannot be selected simply to reduce the work.
- Prepare policies and the protection plan. Allocate responsibility for access, changes, backups, incidents and technical controls. Article 30(7) requires the security regulations to be approved and issued before the proposed level dossier is approved.
- Obtain appraisal and approval. Submit to the correct unit, resolve identified issues and preserve the final approved version.
- Implement and retain evidence. Carry out the approved plan, assess readiness before operation and maintain the applicable protection activities.
Article 19 integrates classification into investment documentation for new or upgraded systems. IT service leasing requires coordination between the customer and supplier, with documentation updated to match the actual infrastructure. For an operating system, Article 20 places dossier preparation with the operating unit.
4. Statutory processing periods are not a project completion guarantee
Article 23 provides up to five working days for feedback and instructions on an invalid dossier. Appraisal periods are up to 15 working days for Level 3 and 25 working days for Levels 4 or 5, counted from receipt of a complete, valid dossier. Article 24 provides an approval processing period of up to seven working days from receipt of a complete, valid approval dossier.
These periods do not cover the entire survey, remediation, redesign, document preparation or technical deployment process. The practical schedule depends on the system and the quality of available evidence. It should be agreed only after the initial review.
5. Questions to resolve before submission
- Are the owner and operator consistently identified across decisions, contracts and architecture records?
- Do the system boundaries properly address cloud services, APIs and supporting systems?
- Are data categories, data subject counts and potential impacts supported by evidence?
- Does the plan distinguish implemented controls from planned improvements, with responsible parties identified?
- Have the internal security regulations been issued by the correct authority and translated into workable operating procedures?
6. How KM UNION can help
KM UNION reviews legal grounds, responsibilities and approval routes; prepares the legal elements of documentation, internal rules and contracts; and supports clarification within the agreed mandate. Technical partners survey the environment, document architecture, assess risk and develop technical solutions. Regulated cybersecurity services are allocated to providers with the appropriate licences. This coordinated approach connects the legal dossier to the actual system and defines clear deliverables and responsibilities.
Legal sources
Luật An ninh mạng 116/2025/QH15; Nghị định 331/2026/NĐ-CP; Nghị định 332/2026/NĐ-CP.
Reviewed on 15 October 2026. This article provides general information, not advice for a particular system or dossier. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Who Needs an Information System Security Level Dossier in Vietnam?
- Vietnam Information Security Level 2 vs Level 3: The 2026 Criteria
- Beyond the Security Level Dossier: Legal and Technical Compliance
