{"id":2676,"date":"2026-10-15T23:34:31","date_gmt":"2026-10-15T16:34:31","guid":{"rendered":"https:\/\/kmunion.vn\/en\/?p=2676"},"modified":"2026-10-15T23:34:31","modified_gmt":"2026-10-15T16:34:31","slug":"vietnam-information-security-level-2-vs-level-3","status":"publish","type":"post","link":"https:\/\/kmunion.vn\/en\/vietnam-information-security-level-2-vs-level-3.html","title":{"rendered":"Vietnam Information Security Level 2 vs Level 3: The 2026 Criteria"},"content":{"rendered":"<div class=\"kmu-security-article\">\n<p><small>Legal review: 15 October 2026 \u00b7 <a href=\"https:\/\/kmunion.vn\/an-toan-thong-tin-cap-do-2-cap-do-3-phan-biet.html\" hreflang=\"vi\">\u0110\u1ecdc ti\u1ebfng Vi\u1ec7t<\/a><\/small><\/p>\n<p><strong>An information system\u2019s security level depends on its functions, information, scale and potential impact.<\/strong> \u201cSmall business equals Level 2\u201d and \u201cpersonal data always means Level 3\u201d are both unreliable shortcuts. First establish whether the system is within scope, then assess all relevant criteria.<\/p>\n<p>This guide explains common issues under Articles 8\u201315 of Decree 331\/2026\/ND-CP. \u201cInformation security level\u201d is a familiar search term; current documentation must reflect the applicable cybersecurity framework.<\/p>\n<h2>1. Three rules before proposing a level<\/h2>\n<ul>\n<li><strong>Use the highest applicable level.<\/strong> Where multiple criteria apply, Article 8 requires the highest level.<\/li>\n<li><strong>Define the system correctly.<\/strong> Consider business functions, data flows, dependencies and how an incident could spread. Physical location and organisational boundaries alone are insufficient.<\/li>\n<li><strong>Do not artificially split or combine systems.<\/strong> Formal restructuring must not distort the classification to obtain a lower level.<\/li>\n<\/ul>\n<h2>2. Common Level 2 and Level 3 criteria<\/h2>\n<div class=\"kmu-security-table\">\n<table>\n<thead>\n<tr>\n<th>Issue<\/th>\n<th>Level 2 \u2014 Article 12<\/th>\n<th>Level 3 \u2014 Article 13<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Internal activities<\/td>\n<td>Internal systems processing private or personal information, without state secrets.<\/td>\n<td>Other criteria and risk must be assessed. Personal data in an internal system does not automatically make it Level 3.<\/td>\n<\/tr>\n<tr>\n<td>Online services<\/td>\n<td>Online services outside the list of conditional business sectors, subject to any higher applicable criterion.<\/td>\n<td>Online services within conditional business sectors, and systems handling administrative procedures.<\/td>\n<\/tr>\n<tr>\n<td>Personal data in the relevant category of other online services<\/td>\n<td>Article 12 refers to fewer than 100,000 basic personal data subjects or fewer than 10,000 sensitive personal data subjects; all criteria and the highest-level rule must still be checked.<\/td>\n<td>At least 100,000 basic personal data subjects or at least 10,000 sensitive personal data subjects is a criterion under Article 13.<\/td>\n<\/tr>\n<tr>\n<td>Information infrastructure<\/td>\n<td>Infrastructure serving one body or organisation.<\/td>\n<td>Shared infrastructure across a ministry, sector, province or multiple provinces.<\/td>\n<\/tr>\n<tr>\n<td>Industrial control<\/td>\n<td>Employee numbers or turnover do not by themselves establish Level 2.<\/td>\n<td>Industrial control systems serving Class II, III or IV construction works fall within the relevant Article 13 criterion; the construction classification must be verified.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>This table highlights common criteria, not the entire classification framework. State secrets, defence, national security, Prime Ministerial decisions and risk assessment require additional analysis. A system meeting Level 4 or 5 criteria cannot remain at Level 3 merely because those criteria are not reproduced here.<\/p>\n<h2>3. Count data subjects, not simply accounts<\/h2>\n<p>The data thresholds refer to <strong>data subjects<\/strong>, not just logins or visits. One person may hold several accounts; a system may also process information about people without accounts. The technical team should establish an evidence-based inventory and counting method.<\/p>\n<p>Fewer than 100,000 basic personal data subjects does not offset reaching 10,000 sensitive personal data subjects. Once a Level 3 criterion is met, Level 3 and any higher criteria must be considered. Selecting the lower-threshold branch cannot be used to disregard the other criterion.<\/p>\n<h2>4. Three illustrative scenarios<\/h2>\n<p><strong>Scenario A \u2014 a non-conditional online service:<\/strong> assume an in-scope platform processes only basic personal data about 20,000 people, no sensitive personal data and no higher-level criterion. Level 2 is the starting point to examine, subject to the full functional and risk assessment.<\/p>\n<p><strong>Scenario B \u2014 sensitive data about 12,000 people:<\/strong> a system within the relevant online service category meets the Level 3 data threshold even if fewer people have login accounts. Higher-level criteria must still be checked.<\/p>\n<p><strong>Scenario C \u2014 an online service in a conditional business sector:<\/strong> a small customer base does not automatically justify Level 2. Check Article 13 and establish precisely whether the actual service falls within the conditional business list currently in force.<\/p>\n<h2>5. When should classification be reviewed?<\/h2>\n<p>Article 10 calls for risk assessment when a level is first determined and in situations including changes to functions, scope, users, data or technology; expansion, integration, interconnection or data sharing; serious incidents or high risks; and requests from competent authorities. Where reclassification is necessary, Article 25 applies the initial determination procedure.<\/p>\n<p>Build this review into product and infrastructure change management, including new customer portals, combined databases, expanded services and cloud architecture changes. An old approval does not automatically cover every later development.<\/p>\n<h2>6. Is this the same as personal data protection documentation?<\/h2>\n<p>No. System classification and protection address information system requirements. Personal data protection obligations must be assessed separately against the actual processing activities. A shared data inventory and aligned responsibilities can improve consistency, but one dossier should not be assumed to replace the other.<\/p>\n<h2>7. KM UNION\u2019s coordinated support<\/h2>\n<p>KM UNION works with technical partners to clarify applicability, functions, data categories, the basis for the proposed level and management requirements. Regulated technical services are performed by appropriately qualified and licensed providers. The engagement sets out a practical work plan and responsibilities; the legal authority to determine and approve the level remains with the designated bodies and units.<\/p>\n<h2>Legal sources<\/h2>\n<p><a href=\"https:\/\/congbao.chinhphu.vn\/van-ban\/luat-so-116-2025-qh15-468678.htm\">Lu\u1eadt An ninh m\u1ea1ng 116\/2025\/QH15<\/a>; <a href=\"https:\/\/congbao.chinhphu.vn\/van-ban\/nghi-dinh-so-331-2026-nd-cp-470334\/67978.htm\">Ngh\u1ecb \u0111\u1ecbnh 331\/2026\/N\u0110-CP<\/a>; <a href=\"https:\/\/congbao.chinhphu.vn\/van-ban\/nghi-dinh-so-332-2026-nd-cp-470329.htm\">Ngh\u1ecb \u0111\u1ecbnh 332\/2026\/N\u0110-CP<\/a>.<\/p>\n<p><em>Reviewed on 15 October 2026. This article provides general information, not advice for a particular system or dossier. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.<\/em><\/p>\n<h2>Related articles<\/h2>\n<ul>\n<li><a href=\"https:\/\/kmunion.vn\/en\/vietnam-information-system-security-level-dossier-who-must-comply.html\">Who Needs an Information System Security Level Dossier in Vietnam?<\/a><\/li>\n<li><a href=\"https:\/\/kmunion.vn\/en\/vietnam-security-level-dossier-documents-approval-process.html\">Vietnam Security Level Dossier: Documents and Approval Process<\/a><\/li>\n<li><a href=\"https:\/\/kmunion.vn\/en\/vietnam-security-level-compliance-legal-technical-support.html\">Beyond the Security Level Dossier: Legal and Technical Compliance<\/a><\/li>\n<\/ul>\n<div class=\"kmu-client-editorial-contact\"><strong>Speak with KM UNION<\/strong><\/p>\n<p><a href=\"mailto:legal@kmunion.vn\">legal@kmunion.vn<\/a> \u00b7 <a href=\"tel:+84932124427\">+84 932 124 427<\/a><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Compare Vietnam\u2019s Level 2 and Level 3 system criteria, personal data thresholds and reassessment triggers under Decree 331\/2026. Practical examples for businesses.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[78,81],"tags":[],"_links":{"self":[{"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/posts\/2676"}],"collection":[{"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/comments?post=2676"}],"version-history":[{"count":1,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/posts\/2676\/revisions"}],"predecessor-version":[{"id":2680,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/posts\/2676\/revisions\/2680"}],"wp:attachment":[{"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/media?parent=2676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/categories?post=2676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kmunion.vn\/en\/wp-json\/wp\/v2\/tags?post=2676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}