Công văn 1552/BTTTT-CATTT năm 2020 về đôn đốc tổ chức triển khai bảo đảm an toàn cho hệ thống thông tin theo mô hình “4 lớp” do Bộ Thông tin và Truyền thông ban hành

Pursuant to Directive No. 14/CT-TTg dated June 7, 2019 of the Prime Minister on strengthening assurance of network safety and security in order to improve Vietnam's ranking index;

Pursuant to Notice No. 139/TB-VPCP of the Government Office: Conclusion of Prime Minister Nguyen Xuan Phuc at the online conference of the National Committee on e-Government with Steering Committees for e-Government development, e-Government of Ministries, agencies and local governments on February 12, 2020.

The Ministry of Information and Communications proposes Ministries, ministerial-level agencies and Governmental agencies and People's Committees of provinces and centrally affiliated to initiate the “4 layers of security” for the information system under their administration as follows: (1) In-place forces, (2) Self-perform or hire a professional enterprise to perform surveillance and security, (3) Self-perform or hire an independent enterprise to perform periodical check and evaluation, (4) Connect and share information with the national surveillance system, in specific:

1. “Layer 1” In-place forces

Designate and strengthen the focal point in charge of cyberinformation security to be effective in advising, initiating, inspecting, and urging the implementation of regulations of law on assurance of network safety and security.

2. “Layer 2” Self-perform or hire a professional enterprise to perform surveillance and security

Self-perform surveillance and response to cyberinformation security incidents, and protection of the information system under their administration, or select/hire a qualified organization or enterprise to perform surveillance and response to cyberinformation security incidents, and protection of cyberinformation security.

3. “Layer 3” Perform or hire an independent enterprise to perform periodical check and evaluation

Select/hire an organization or enterprise being independent of the organization or enterprise that performs surveillance and security in order to perform periodic check and evaluation of cyberinformation security for information systems at level 3 or higher under their administration or perform ad hoc check and assessment when required in accordance with the law;

For level 3 and level 4 information systems, perform annual check and evaluation and report to the Ministry of Information and Communications before December 14 to consolidate and report to the Prime Minister;

For the national important information system (level 5), perform biannual check and evaluation and report to the Ministry of Information and Communications before June 14 and December 14 every year to consolidate and report to the Prime Minister.

4. “Layer 4” Connect and share information with the national surveillance system

Connect and share information on information security surveillance with the National Cyber Security Center (NCSC) affiliated to the Authority of Information Security (AIS) under Ministry of Information and Communications; and provide ranges of Public IP addresses of information systems in regulatory agencies and organizations under their management.

Request the ministries, ministerial-level agencies, Governmental agencies; People's Committees of provinces and centrally affiliated cities to:

- Complete the implementation of “4 layers of security” for the information system before September 30, 2020;

- Send periodical reports before the 25th of each month on the implementation (send to email: [email protected]);

- Appoint a person in charge to report and exchange expertise with the person in charge of the Ministry of Information and Communications before April 30, 2020.

Difficulties that arise during the implementation of this document should be reported to the Ministry of Information and Communications (the Authority of Information Security) for further guidance, coordinate and support.

Contact point: Mr. Nguyen Thanh Phuc, Director of Authority of Information Security under Ministry of Information and Communications, phone number: 0913235417, email address: [email protected]. Sincerely./.

---------------

This document is handled by Dữ Liệu Pháp Luật . Document reference purposes only. Any comments, please send to email: [email protected]