DIRECTIVE

IMPROVEMENT TO CYBERINFORMATION SECURITY AND INFORMATION SECURITY FOR SURVEILLANCE CAMERA

Currently, millions of internet protocol cameras (hereinafter referred to as “surveillance cameras”) are being installed and used with increasing popularity. The majority of these equipment has not been governed and thus pose various security risks which can be exploited for the purpose of violating the law, such as: illegally collecting data and/or information of authorities, organizations, or users for the purpose of fraud and/or property appropriation; taking control of equipment and using it for cyberattack or spreading malware; potentially disclosing state secrets, and affecting national security, social order and safety.

In order to rectify the drawbacks and risks pertaining to cyberinformation security and information security of surveillance cameras, the Prime Minister hereby directs:

1. Ministries, ministerial agencies, Governmental agencies, People’s Committees of provinces and central-affiliated cities, groups, state corporations to effectively execute the solutions below:

a) Determining security level of information system and implementing solutions for maintaining information system security based on security level, regulations and law, national standards, and national technical regulations pertaining to level-based information system security upon deploying information systems that utilize security cameras.

Time limit: Determining and approving security level of information system that utilizes surveillance cameras, by the end of March 2023; adequately implementing solutions for maintaining security of information system based on levels in regard to existing information systems that utilize surveillance cameras, by the end of September 2023.

b) Ordering affiliated agencies and entities to inspect and assess cyberinformation security as per the law upon investment or procurement of surveillance cameras or hire information technology that employ surveillance cameras to inspect and assess cyberinformation security as per the law upon investment or procurement of surveillance cameras; inspecting and assessing cyberinformation security on a periodic basis in regard to information systems that utilize surveillance cameras.

...

...

...

d) Satisfying resources and expenditure on maintaining cyberinformation security of information systems that utilize surveillance cameras; being responsible to the Prime Minister of Vietnam for any violation of cyberinformation security, information security, or disclosure of state secrets which originate from information systems that utilize surveillance cameras under their management.

dd) Developing, reviewing, amending, and adding regulations on maintaining cyberinformation security of agencies and entities which prescribe compliance with cyberinformation security in the use of surveillance cameras.

e) Requesting relevant ministries and central departments to research and organize implementation of national technical regulations on basic cyberinformation security requirements for surveillance cameras within their field of governing as soon as these national technical regulations are promulgated.

2. Ministry of Information and Communications is responsible for:

a) Integrating propaganda and guidelines pertaining to maintaining cyberinformation security of surveillance cameras during the implementation of the Scheme for “Disseminating, raising awareness, and popularizing information security knowledge of the period 2021 - 2025” under Decision No. 1907/QD-TTg dated November 23, 2020 of the Prime Minister of Vietnam.

b) Developing criteria for basic cyberinformation security requirements for surveillance cameras. Time limit: by March 2023.

c) Promulgating national technical regulation pertaining to basic cyberinformation security requirements for surveillance cameras and disseminating, popularizing, and organizing the application of this technical regulation. Time limit: by November 2023.

d) Publicizing the list of surveillance cameras that meet national technical regulation pertaining to basic cyberinformation security requirements for surveillance cameras.

dd) Organizing implementation, guiding, expediting, monitoring, and inspecting the implementation of this Directive; submitting report on implementation results to the Government.

...

...

...

a) Preventing, fighting, and taking strict actions as per the law against agencies, organizations, and individuals that exploit surveillance cameras to violate national security or social order and safety.

b) Organizing cyberinformation security assessment for surveillance camera systems in important constructions that are related to national security and important information systems in terms of national security prior to operation and use.

c) Researching and developing regulations pertaining to establishment, management, operation, and maintenance of surveillance camera system to serve security and order control tasks of the People’s Public Security for joint implementation on a nationwide scale.

4. Ministry of Finance is responsible for increasing management of surveillance camera import in accordance with national technical regulation on basic cyberinformation security requirements for surveillance cameras.

5. Ministry of Industry and Trade is responsible for increasing management and inspection of the sale of surveillance cameras and preventing the sale of surveillance cameras that do not meet national technical regulation on basic cyberinformation security requirements for surveillance cameras; taking actions against violations of the law pertaining to counterfeit or illegally imported surveillance cameras.

6. Vietnam Television, Voice of Vietnam, Vietnam News Agency, and other press authorities are responsible for dedicating sections, columns, channels, and screen time to broadcasting programs and news pertaining to cyberinformation security, including contents relating to surveillance cameras in order to raise awareness and teach basic skills for users to maintain cyberinformation security.

7. Enterprises manufacturing, selling, and importing surveillance cameras shall:

a) Manufacture or sell, import surveillance cameras that meet national technical regulation on basic cyberinformation security requirements for surveillance cameras.

b) Manufacturing enterprises shall notify and release software update or upgrade for surveillance cameras upon discovering security breach; cooperate and assist in dealing with cyberinformation security and information security risks relating to their manufactured surveillance cameras at request of competent authorities.

...

...

...

a) Inspect and take actions against surveillance cameras that they have provided and do not meet cyberinformation security requirements on their network infrastructures.

b) Notify users upon discovering their surveillance cameras' failure to meet cyberinformation security.

c) Cooperate with authorities affiliated to the Ministry of Information and Communications in monitoring, discovering, interfering, and dealing with surveillance cameras that do not qualify for cyberinformation security.

d) Cooperate with authorities affiliated to the Ministry of Public Security in discovering and taking actions against organizations and individuals that exploit surveillance cameras to violate national security and social order and safety.

9. Ministers, heads of ministerial agencies, heads of Governmental agencies, Chairpersons of People’s Committees of provinces and central-affiliated cities, heads of agencies, entities, and relevant organizations and individuals are responsible for the strict implementation of this Directive.

PP. PRIME MINISTER
DEPUTY PRIME MINISTER




Vu Duc Dam

...

...

...

Chỉ thị 23/CT-TTg năm 2022 về tăng cường công tác bảo đảm an toàn thông tin mạng, an ninh thông tin cho thiết bị camera giám sát do Thủ tướng Chính phủ ban hành