CIRCULAR

COORDINATING AND RESPONDING TO NATION-WIDE CYBER INFORMATION SECURITY INCIDENTS

Pursuant to the Law on Cyberinformation Safety dated November 19, 2015;

Pursuant to Decree No. 85/2016/ND-CP dated July 1, 2016 of the Government on level-based information system safety;

Pursuant to Decree No. 17/2017/ND-CP dated February 17, 2017 of the Government on functions, tasks, powers, and organizational structures of Ministry of Information and Communications;

Pursuant to Decision No. 05/2017/QD-TTg dated March 16, 2017 of the Prime Minister on system of emergency response measures for national cyber information security;

At request of Director of the Vietnam Cybersecurity Emergency Response Center;

The Minister of Information and Communications promulgates Circular on coordination and response to nation-wide cyber information security incidents.

...

...

...

GENERAL PROVISIONS

Article 1. Scope and regulated entities

1. This Circular prescribes coordination and response to nation-wide cyber information security incidents (not including coordination and response to serious cyber information security incidents specified under Decision No. 05/2017/QD-TTg dated March 16, 2017 of the Prime Minister on emergency response system for national cyber information security (hereinafter referred to as ”Decision No. 05/2017/QD-TTg”);

Incidents occurring within information systems under the management of the Ministry of National Defense and Ministry of Public Security are not prescribed by this Circular.

2. Regulated entities are agencies, organizations, individuals related to coordination and response to cyber information security incidents.

Article 2. Definitions

1. Cyber information security incident means an attack on information, information system or damage, violation to integrity, security, or usability (hereinafter referred to as “incident”).

2. Response to cyber information security incident means efforts to deal with and rectify cyberinformation security incidents, including: monitoring, collecting, analyzing, detecting, warning, investigating, verifying incidents, preventing incidents, restoring data, and restoring normal operation of information system.

3. Incident response liaison means a unit or an individual authorized by members of national cyber information security incident response network to represent the members in communicating and exchanging information with National incident response and coordination agency or other members in incident coordination and response.

...

...

...

Entities responding to nation-wide cyber information security incidents are agencies, organizations, and entities responding to national cyber information security incidents specified under Decision No. 05/2017/QD-TTg. Agencies and organizations engaging in coordination and response to nation-wide incidents include:

1. The Ministry of Information and Communications - Standing authority for emergency response and assurance of national cyber information security (hereinafter referred to as “National standing authority”) and Coordinating Committee for emergency response for national cyber information security (hereinafter referred to as “National coordinating committee”); Vietnam Cybersecurity Emergency Response Center VNCERT - National coordinating authority for incident response (hereinafter referred to as "National coordinating authority”).

2. Steering Committee for emergency response to cyber information security incidents of ministries, ministerial agencies, Governmental agencies, and People's Committees of provinces and central-affiliated cities (hereinafter referred to as “Ministerial/Provincial steering committees”);

3. Entities specializing in responding to cyber information security incidents (hereinafter referred to as “incident response specialists”); incident response teams or units in ministries, ministerial agencies, Governmental agencies, and People’s Committees of provinces and central-affiliated cities (hereinafter referred to as “incident response teams/units”).

4. Network for response to national cyber information security incidents (hereinafter referred to as “incident response network”); and Network Operating Committee.

5. Presiding entities of information system; operating entities of information system; agencies, organizations, and specializing entities designated or summoned by National standing authority, National coordinating authority, or Ministerial/Provincial steering committees to participate in incident response.

Article 4. Rules for incident coordination and response

1. Regulations and law on coordination and response to cyber information security incidents shall be complied with.

2. Active, prompt, quick, accurate, synchronous, and effective shall be required.

...

...

...

4. Incident response shall be implemented and dealt with by readily available forces and as primary responsibilities of presiding entities of information system.

5. Conditions and order of priority in maintaining operation of information system approved by competent authority under incident response plan shall be adhered to.

6. Information exchanged within the network shall be examined and verified prior to further steps.

7. Information confidentiality shall be guaranteed when engaging and implementing incident response efforts of National coordinating authority or agencies, organizations, individuals that encounter the incidents.

Chapter II

INCIDENT RESPONSE NETWORK

Article 5. Incident response network

1. Incident response network operates on a nation-wide scale and consists of members that are incident response specialists, relevant agencies, organizations, and enterprises specified under Article 7 of Decision No. 05/2017/QD-TTg.

2. Incident response network operates in accordance with Network Operating Regulations and relevant guidelines of National coordinating authority (Vietnam Cybersecurity Emergency Response Center). Network Operating Committee shall be established by the Ministry of Information and Communications under Article 7 of Decision No. 05/2017/QD-TTg

...

...

...

Article 6. Responsibilities and powers of network members

1. Network members have the responsibility and power to:

a) exercise responsibilities and powers under Decision No. 05/2017/QD-TTg;

b) assign competent, qualified liaisons with appropriate certifications and professional skills to implement cooperation in incident response; maintain throughout and around-the-clock communication; publicize incident report address on website/web portal; provide and update information on incident response liaisons, technicians for information security, incident response under their management to National coordinating authority; update information on incident response liaison within 24 hours from the time in which changes occur;

c) consolidate, develop, and submit 6-monthly report (before June 20), annual report (before December 15) using Form No. 5 to National coordinating authority; provide irregular report at request of National coordinating authority;

d) report to National coordinating authority upon receiving information or discovering incidents of information systems under their management;

dd) develop and implement incident response plans, guidelines on incident response operations; organize and coordinate operation of incident response teams under their management;

e) request network members to guide, assist in dealing with and responding to incidents when necessary; participate in seminars, conferences, meetings, trainings, advanced trainings, drills, and other activities in the network;

g) share information, experience, and warnings regarding incidents and cyber information security in Vietnam and in other countries;

...

...

...

2. National coordinating authority has the responsibility and power to:

a) exercise responsibilities and powers under Decision No. 05/2017/QD-TTg;

b) publicize their phone number, fax, email address, hotline on their website, ensure resources to maintain round-the-clock hotline, promptly receive and deal with incidents; consolidate contact information (address, phone number, fax, email address) and information on incident response liaisons, technicians for information security, incident response of network members and incident response teams of network members;

c) develop, implement, and operate network website, technical system assisting communication and information exchange within the network and other technical systems serving incident coordination, response, rectification;

d) provide guidelines on notifying and inquiring nation-wide cyber information safety incidents; coordinate network; study and propose solutions for improving resources to ensure effective implementation of the network;

dd) consolidate, receive, process, prepare, and send information and warnings to competent individuals and agencies, organizations, relevant entities regarding cyber information security incidents and prevention, deterrence, handling solutions;

e) organize seminars and meetings, publicize and exchange information, provide trainings, advanced trainings, drills regarding response to cyber information security incidents; organize general operations of the network.

Article 7. Primary operations of incident response network

Network Operating Committee shall organize and implement tasks of incident response network, including primary operations below:

...

...

...

2. Cooperating in responding to, dealing with, preventing, and rectifying incidents; inspecting and promoting development, implementation of plans for cyber information security incidents and implementation of responsibilities, obligations of network members;

3. Developing and improving capacity of network members and incident response teams, including:

a) providing training, advanced trainings to improve qualifications, skills, professional operations; organizing domestic and foreign business trips for the purpose of survey, experience learning, exchange, and cooperation;

b) organizing periodic meetings, conferences, seminars, and conversations to exchange information, experience regarding incident coordination and rescue, cyber information security assurance;

c) providing support in developing and adopting information system management, operation procedures in accordance with national standards, national technical regulations, and international standards regarding information security and incident response.

d) organizing specialized studies, developing reports, instruction manuals, statistical reports on information security and issues relating to sharing and communication in the network.

4. Participating in communication and popularization to raise awareness regarding incident prevention, response, and cyber information security assurance.

5. Organizing and maintaining operation of Network Operating Committee; implementing other operations related to incident coordination and response and cyber information security assurance.

Chapter III

...

...

...

Article 8. Incident coordination and response

1. Incident coordination and response are implemented by National coordinating authority and competent authorities in order to mobilize, operate, and jointly cooperate resources, including: personnel, materials (equipment), financial (finance, budget) to prevent, monitor, collect, discover, and warning against incidents; receive, analyze, verify, and classify incidents; operate, cooperate, and organize incident response, stay ready to respond and rectify incidents in order to minimize risks and damage caused by the incidents.

2. National coordinating authority shall issue warning, coordinate nation-wide incident response efforts; mobilize and coordinate network members and relevant organizations, entities to cooperate in preventing, dealing with, and rectifying nation-wide incidents; promulgate and assume responsibility for orders/request for coordination using Form No. 6 attached hereto;

3. Activities involved in incident coordination and response:

a) Monitoring, analyzing, discovering, warning about risks, threats, holes, incidents, cyber attacks and solutions for incident prevention;

b) Developing, proposing incident response solutions and plans;

c) Organize trainings and drills regarding incident response and cyber information security assurance;

d) Operating and mobilizing resources to respond to incidents within their competence; providing technical support and taking measures to respond to and prevent cyber attack;

dd) Investigating, analyzing, identifying origin, methods, and form of attack in order to deal with, prevent, issue warnings and guidelines to prevent widespread incidents; collecting, developing incident summary reports;

...

...

...

g) Conducting other activities relating to incident response according to Decision of the Ministry of Information and Communications.

4. Information exchange regarding incident coordination and response shall be implemented via: Official dispatch, electronic mail, telephone, fax, multimedia messages, advanced technical communication systems; and compliant with relevant law provisions regarding exchanging of confidential information.

Article 9. Notifying and reporting cyber information security incidents

1. Methods of notifying, reporting incidents

a) Methods of notifying incidents: Official dispatch, fax, electronic mail, multimedia messages, or technical system for reporting cyber information security incident according to guidelines of the National coordinating authority;

b) Methods of reporting incident: Physical document or electronic document (bearing signature and seal or digital signature of competent individual).

2. Reporting cyber information security incident

a) Within 5 days from the date on which incidents are discovered, entities and individuals operating information system are responsible for sending information on the incidents according to Point a Clause 3 of this Article (Incident Notification) to: Entities presiding the information system, National coordinating authority, incident response specialists, and relevant members of incident response network (if any). If incident rectification has not been completed at the time of reporting, entities and individuals operating information systems shall send update on the incident to previous recipients as soon as rectification completes;

b) If entities or individuals operating information system deem the incidents exceed their capability, they shall submit Initial incident report to entities presiding information system, relevant incident response specialists (if any), and National coordinating authority; entities or individuals operating information system shall send Final incident report to entities presiding information system and National coordinating authority within 5 days from the date on which incident response is complete. National coordinating authority shall only acknowledge completion of incident response efforts after receiving Final incident report;

...

...

...

3. Types of incident notification, report:

a) Incident notification consists of: Name, address of entities, individuals sending the notification; name or domain name, IP address of information system to which incidents occur; name, address of entities and individuals operating, presiding information system to which incidents occur (if known); description of the incident and time in which the incident is discovered; incident resolution results, propositions, recommendations, and other relevant information (if any);

b) Initial incident report shall conform to Form No. 3 under Appendix I attached hereto;

c) Situation report;

d) Specific response solution report;

dd) Assistance and cooperation request;

e) Final incident report, using Form No. 4 under Appendix I attached hereto.

4. Throughout incident response process, entities and individuals operating information system shall take charge and cooperate with relevant agencies, entities in developing and maintaining incident response reports as per the law and at request of competent authority.

Article 10. Discovering, receiving, verifying, taking initial actions, and classifying cyber information security incidents

...

...

...

a) Upon discovering incidents: Monitor, record, and gather information relating to the incidents, organizations sending incident notification or report in accordance with Article 9 hereof;

b) Upon receiving incident notification: Immediately inform organizations, individuals sending incident notification about received notification;

c) Verify incidents and take initial actions: Take charge, cooperate with entities responsible for information security (if any), relevant incident response specialists, telecommunication enterprises, internet service providers (ISP) in analyzing, verifying, and evaluating the incidents; perform initial response activities, implement response procedures according to cyber information security incident response procedures approved by competent authority or procedures under Article 11 hereof; if the incidents are possibly serious incidents, immediately report to entities presiding information system, relevant incident response specialists in order to classify the incidents as serious incidents and report to National coordinating authority.

2. Incident response specialists or members of incident response network shall have the responsibility to:

a) Upon discovering incident: Immediately inform entities, individuals operating information systems and presiding information system, and National coordinating authority about the incidents;

b) Upon receiving incident notification or reports: Acknowledge, receive as per the law, and respond to incident notification or report senders after receiving;

c) Organizing verification and incident resolution: Cooperate with entities and individuals operating information system in assessing, verifying, and dealing with the incidents within their capability and responsibility; if the incidents exceed their capability or are possibly serious incidents, report to entities presiding information system and National coordinating authority;

d) Supervise development of incident response operations, report or propose, request direction of entities presiding information system and Ministerial/Provincial steering committees if the incidents exceed the scope of their powers and responsibilities or capabilities;

dd) Consolidate and report to National coordinating committee regarding incident development when requested.

...

...

...

a) acknowledge, receive incident notification, report according to procedures;

 b) respond to incident notification, report senders upon receiving incident notification, report;

c) assess, identify, and classify incidents in order to issue warnings, coordinate, choose solutions, organize response, report, and request Standing authority to consider, decide on serious incidents and appropriate emergency response solutions. If an incident is classified as a serious incident, National coordinating authority shall take charge and cooperate with relevant authorities in implementing subsequent steps in serious incident response procedures under Decision No. 05/2017/QD-TTg;

d) organize cooperation with international cyber information response organizations in receiving early warnings, information on incidents, risk of cyber information security violation, and cooperation in responding to cross-border incidents, attacks;

dd) implement other responsibilities of National coordinating authority, report and propose to Standing authority regarding issues that exceed their capability.

Article 11. Cyber information security incident response procedures

Cyber information security incident response procedures according to chart under Appendix II include:

1. Receiving, analyzing, providing initial response, and notifying incident

a) Receiving and verifying incident

...

...

...

Cooperating entities: Incident response specialists, National coordinating authority.

Details: Monitoring, receiving, analyzing warnings, signs of incidents from internal and external sources. If the incident is verified to have occurred, acknowledging, collecting evidence, and identifying origin of the incident.

b) Implementing initial response steps

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists, relevant network members, and National coordinating authority.

Details: Once the incident has been verified to occur, entities and individuals operating information system shall rely on the nature and signs of the incident in order to implement initial steps to deal with the incident according to incident response plan approved by competent authority or according to instructions of incident response specialists or National coordinating authority.

c) Implementing response solutions

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists, relevant network members, and National coordinating authority.

...

...

...

d) Directing incident resolution (if necessary)

Presiding entities: Ministerial/Provincial steering committees.

oCooperating entities: Entities presiding information system.

Details: Based on report and proposition of entities and individuals operating information system, Ministerial/Provincial steering committees shall cooperate with entities presiding information system and consult National coordinating authority (if necessary) in order to direct incident response specialists, summon incident response teams/units within their management to implement incident response efforts; direct and coordinate communication, information disclosure. Depending on situation development throughout response procedures, Ministerial/Provincial steering committees shall decide to expand the compositions of incident response teams/units, adjust incident response plans.

dd) Filing incident report

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Relevant/responsible incident response specialists, telecommunication enterprises, ISP.

etDetails: When initial response steps have been implemented, entities operating information system shall send incident notification and report to their relevant internal and external organizations, individuals according to Article 9 hereof and internal regulations (if any).

e) Coordinating response efforts

...

...

...

Cooperating entities: Entities and individuals operating information system, incident response specialists, relevant network members.

Details: Depending on the nature of the incident and request for assistance of entities and individuals operating information system and incident response specialists, Ministerial/Provincial steering committees and National coordinating authority shall coordinate, supervise cooperation and information sharing within their functions, powers, and tasks in order to mobilize incident response resources.

2. Implementing incident response, prevention, and handling

Presiding entities: Entities and individuals operating information system; incident response specialists.

Cooperating entities: Entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details:

a) Collecting evidence, analyzing, identifying scope and affected entities.

)b) Analyzing, identifying origin of the attack, responding, preventing, and minimizing impact, damage to information system.

3. Handling incident, removing, and restoring

...

...

...

Presiding entities: Entities and individuals operating information system; incident response specialists.

Cooperating entities: Entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details: After preventing the incident, entities and individuals operating information system, incident response specialists, incident response teams/units shall remove eliminate and remove malware, harmful software, and rectify information security weaknesses of information system.

b) Restoring

Presiding entities: Entities, individuals operating information system;

Cooperating entities: Incident response teams/units, entities responsible for maintaining information security for the system to which the incident occurs, incident response specialists, relevant network members, and National coordinating authority.

Details: entities and individuals operating information system shall take charge and cooperate with relevant entities in restoring information system, data, and connection; configuring safe system; adding equipment, hardware, and software to ensure information security for information system.

c) Inspecting and evaluating information system

Presiding entities: Entities, individuals operating information system.

...

...

...

Details: Entities and individuals operating information system and relevant entities shall inspect, evaluate operation of the entire information system after the incident has been rectified. If stable operation of the system has not been achieved, continue to collect, re-identify the causes, and take steps specified under Clause 2 and Clause 3 of this Article in order to extensively rectify and restore normal operation of information system.

4. Concluding and evaluating

Presiding entities: Entities, individuals operating information system.

Cooperating entities: Incident response specialists; incident response teams/units; entities presiding information system; Ministerial/Provincial steering committees; National coordinating authority.

Details: Entities and individuals operating information system to which the incident occurs shall cooperate with incident response specialists and incident response teams/units in consolidating information, report, analysis relating to the incident, the implementation of incident response efforts, sending to entities presiding information system, Ministerial/Provincial steering committees, and National coordinating authority; analyzing causes, learning from experience in incident response, and proposing additional solutions in order to prevent and respond to similar incidents in the future.

Chapter IV

SOLUTIONS FOR ASSURING RESPONSE TO CYBER INFORMATION SECURITY INCIDENTS

Article 12. Developing and implementing cyber information security incident response plans

1. Agencies, organizations, and enterprises shall develop and implement cyber information security incident response plans of their agencies, organizations, and enterprises, in which:

...

...

...

b) In regard to information systems not specified under Point a Clause 1 of this Article, conform to Appendix III attached hereto.

2. Entities presiding information systems and competent agencies, authorities approving incident response plans shall identify conditions and order of priority in order to maintain operation of information system when deploying incident response and consider this a requirement in incident response plan.

3. National coordinating authority shall provide guidelines on developing and implementing incident response plans, implementing response provision, dealing with cyber information security incidents; organizing regional, sectoral, national, and international trainings and drills; developing plans and organizing periodic inspection, evaluation of implementation of cyber information response plans of ministries, central departments, local governments, organizations and enterprises.

Article 13. Expenditure

Expenditure on coordinating and responding to nation-wide cyber information security incidents shall conform to Article 17 of Decision No. 05/2017/QD-TTg and relevant guiding documents.

Chapter V

ORGANIZING IMPLEMENTATION

Article 14. Entry into force

1. This Circular comes into force from November 1, 2017 and annuls Circular No. 27/2011/TT-BTTTT dated October 4, 2011 of the Ministry of Information and Communications.

...

...

...

MINISTER




Truong Minh Tuan

APPENDIX I

LIST OF FORMS IN COORDINATION AND RESPONSE TO NATION-WIDE CYBER INFORMATION SECURITY INCIDENTS
(Attached to Circular No. 20/2017/TT-BTTTT dated September 12, 2017 of the Minister of Information and Communications)

No.

Form number

Form title

...

...

...

Form No. 01

Declaration of members of incident response network

2

Form No. 02

Application for participation in incident response network

(Applicable to organizations, enterprises, and individuals voluntarily participating in incident response plan)

3

Form No. 03

Initial cyber information security incident report

...

...

...

Form No. 04

Final incident report

5

Form No. 05

Report on receipt and handling of cyber information security incidents

6

Form No. 06

Cooperation order/request

...

...

...

Form No. 1
Attached to Circular No. 20/2017/TT-BTTT dated September 12, 2017 of the Minister of Information and Communications

ORGANIZATION
...............................
-------

SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
----------------

DECLARATION OF MEMBERS OF INCIDENT RESPONSE NETWORK

1. General information on the organization

▪ Name of organization: .......................................................................................................

▪ Name of presiding authority: ..............................................................................................

...

...

...

▪ Phone: …………………………………………………… ▪ Fax: ..................................................

▪ Email: ……………………………………………………….... ▪ Website: .....................................

▪ Information security officer: ………………………………………………… Position: ..................

2. Incident notification recipient information

▪ Address: ..........................................................................................................................

▪ Fixed telephone: …………………………………….▪ Mobile phone: ........................................

▪ Fax: ……………………………………………………..▪ Email: ..................................................

3. Incident response liaison

3.1 Primary incident response liaison

...

...

...

▪ Address: ..........................................................................................................................

▪ Fixed telephone: ………………………………………… ▪ Mobile phone: ..................................

▪ Fax: ……………………………………………………… ▪ Email: ................................................

4. Introduction to operation of the organization

(Provide National coordinating authority with information on incident response capacity of the organization such as human resources, technology, experience, serving targets, etc.)

...........................................................................................................................................

5. Name of information systems under their management or provided as service:

▪ Level 1:

1.

...

...

...

….

▪ Level 2:

1.

2.

….

▪ Level 3:

1.

2.

….

...

...

...

1.

2.

….

▪ Level 5:

1.

2.

….

6. Information on List of personnel and experts in information security, information technology, and similar

(Provide information on information security, information technology personnel of the entity or relevant entities using summary form under Form No. 1)

...

...

...

, (Location and date)
LEGAL REPRESENTATIVE
(Signature, seal, or digital signature)

[sample] CONSOLIDATED LIST OF PERSONNEL, EXPERTS IN INFORMATION TECHNOLOGY, INFORMATION SECURITY, OR SIMILAR FIELDS
(Attached to Form No. 1)

1. Number of personnel relating to information technology, information security, or similar fields

No.

Category

Quantity (person)

...

...

...

Number of officials by fields of training

a)

Information technology

b)

Information security

c)

...

...

...

1.2

Number of officials by levels of training

a)

Postgraduate

b)

Graduate

...

...

...

c)

College

d)

Intermediate education

1.3

Number of officials holding certificates relating to information technology, information security, or similar fields

...

...

...

uNumber of officials holding international certificates

b)

Number of officials holding domestic certificates

2. Number of personnel with experience, training regarding information security

No.

Category

Quantity (person)

...

...

...

Information security experts

a)

High-level information security administration

b)

Information security management system

c)

...

...

...

d)

Cyber security and infrastructure administration

dd)

Information security policy-making

2.2

Defense and counter-attack technical experts

...

...

...

a)

Cyber attack and counter-attack, counter-terrorism and anti-cyberwarfare techniques

b)

Malware analysis, defense against malware and spyware

c)

Response to information security incidents

...

...

...

System examination, supervision, and analysis, security vulnerability scan

dd)

Information security incident analysis

e)

Investigation and collection of incident information and electronic evidence

g)

...

...

...

h)

Monitoring and controlling online information

2.3

System, application security and protection experts

a)

Encryption, cryptanalysis, information hiding and security

...

...

...

b)

gDigital signature, identification, authentication

c)

Information security system integration

d)

Safe network system counseling, design, and development

...

...

...

Safe programming (Web application, information portal)

e)

Safety assurance for telecommunication system, mobile network, wireless network

g)

Safety assurance in electronic transactions, online payment, electronic commerce

h)

...

...

...

2.4

Information security inspection and evaluation experts

a)

Information security conformity counseling

b)

Risk analysis and management, maintaining of operation of information system

...

...

...

c)

Safety evaluation of information technology system and products

d)

Safety inspection and evaluation of Web applications and web portal

3. List of personnel specializing in information security, information technology, or similar fields

No.

Full name

...

...

...

Training major

Certificates, degrees, qualifications relating to information technology, information security, or similar fields

Month/year of completion

1

...

...

...

…

...

...

...

Note: Degree: Doctor of Science, Bachelor, Master, Engineer, etc.

Form No. 2
Attached to Circular No. 20/2017/TT-BTTT dated September 12, 2017 of the Minister of Information and Communications

SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
--------------------

APPLICATION FOR PARTICIPATION IN INCIDENT RESPONSE NETWORK
(Applicable to organizations, enterprises, and individuals voluntarily participating in incident response network)

I. General information on the applicant

...

...

...

2. Address: .................................................................................................................

3. Telephone: ..............................................................................................................

4. Fax: ........................................................................................................................

5. Email: .....................................................................................................................

II. Introduction to operation of the applicant

1. Introduction to operation of the applicant

(Provide National coordinating authority about brief information on fields of operation of the applicant, incident response capacity of the applicant, human resources, technology, experience, serving targets, etc.)

...................................................................................................................................

...................................................................................................................................

...

...

...

▪ Level 1:

1.

2.

….

▪ Level 2:

1.

2.

….

▪ Level 3:

...

...

...

2.

….

▪ Level 4:

1.

2.

….

▪ Level 5:

1.

2.

...

...

...

3 Information on personnel and experts in information security, information technology, and similar fields

(Provide information on their human resources, information security, information technology using schedule under Form No. 1 hereof)

III. Communication and contact information in the network

1. Website address: ....................................................................................................

2. Email address⁽¹⁾:

PGP/GPG Public Key of PoC email address of the applicant:⁽²⁾

a) User ID: ..................................................................................................................

b) Fingerprint : ............................................................................................................

c) Connection to Public key of the applicant⁽³⁾: .............................................................

...

...

...

⁽²⁾ If the applicant does not have this, it is permissible to leave this field empty or request the VNCERT to provide instructions to create one.

⁽³⁾ The applicant may send Public Key to the VNCERT via csirts@vncert.vn

3. Contact liaison during working hours

a) Name of department/individual in charge: .................................................................

b) Fixed telephone: …………………………… c) Mobile phone: .......................................

d) Fax: ........................................................................................................................

4. Contact liaison outside of working hours

a) Name of department/individual in charge: .................................................................

b) Fixed telephone: …………………………… c) Mobile phone: .......................................

...

...

...

5. Information security officer of the applicant ⁽⁴⁾

a) Name of department/individual in charge: .................................................................

b) Fixed telephone: …………………………… c) Mobile phone: .......................................

⁽⁴⁾ Information security officer of the applicant shall only be reached if other liaisons cannot be contacted or in serious situations

6. Post mail and official dispatched receipt address:

a) Name of receiving department/individual: ..................................................................

b) Position, title: ..........................................................................................................

c) Name of applicant: ..................................................................................................

d) Address: .................................................................................................................

...

...

...

7. Other means of communication ⁽⁵⁾

Other means of communication via instant messaging system

a) Yahoo ID:

b) Skype:

c) Google Talk:

d) Hotmail:

...

...

...

dd) Others:

⁽⁵⁾ Not mandatory

We hereby guarantee to adhere to responsibilities and powers of network members, regulation on coordination and response to incidents according to regulations and law and instructions of National coordinating authority.

 (Location and date)
LEGAL REPRESENTATIVE
(Signature and seal)

...

...

...

INITIAL CYBER INCIDENT REPORT

INFORMATION ON ORGANIZATION/INDIVIDUAL REPORTING THE INCIDENT

▪ Name of organization/individual reporting the incident (*) .............................................

▪ Address: (*) ..............................................................................................................

▪ Phone (*) ……………………………………….Email (*) ...................................................

CONTACT INDIVIDUAL

▪ Full name (*) ………………………………… Position: ....................................................

▪ Phone (*) …………………………………… Email (*) ......................................................

...

...

...

Name of entity operating information system (*):

Specify entity operating or hired to operate information system

Presiding authority:

Specify presiding authority

System to which the incident occurs

Specify the system to which the incident occurs, relevant domain name and IP address

Level of the information system (if any)

□ Level 1

□ Level 2

...

...

...

□ Level 4

□ Level 5

Information security service provide (if any):

Specify service provider

External connection service provider (if any)

Specify service provider

Specify supplier

Specify supplier’s information

...

...

...

Provide brief description of the incident, including initial assessment of whether the attack has occurred and risk leading to further damage or service disruption. Identify sensitiveness of relevant information or entities affected by the incident: ...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...

...

...

/

/

Time in which the incident is discovered (*):

…… ……… (hour and minute)

CURRENT SITUATION OF THE INCIDENT (*)

□ Has been handled

□ Has not been handled

MEANS OF DISCOVERY * (Tick methods employed to discover the incident)

...

...

...

□ Notification sent by: .................................................................................................

□ Others, elaborate ......................................................................................................

INCIDENT NOTIFICATION SENT TO *

□ Network members responsible for responding to incident

□ ISP providing the service

□ Coordinating authority

ADDITIONAL INFORMATION ON THE SYSTEM TO WHICH THE INCIDENT OCCURS

▪ Operating system ……………………………… Version .................................................

▪ Services available on the system (Tick services used on the system)

...

...

...

□ Other services, elaborate ..........................................................................................

▪ Information security measures deployed (Tick measures that have been implemented)

□ Antivirus □ Firewall □ Intrusion detective system

□ Others:

▪ IP address of the system (List all IP address on the Internet, do not list internal IP address)

...................................................................................................................................

▪ Domain names of the system

...................................................................................................................................

▪ Main usage of the system .........................................................................................

...

...

...

▪ Additional information

□ System log □ Sample virus / malware □ Others: …………………………………..

▪ Is confidentiality required for information provided in this notification? □ Yes □ No

ASSISTANCE PROPOSITION AND REQUEST

Description of the proposition and request

Provide a summary of assistance proposition and request (if any) ............................................

...........................................................................................................................................

...........................................................................................................................................

...........................................................................................................................................

...

...

...

...........................................................................................................................................

INCIDENT REPORT TIME *: …………………….. (date and time)

LEGAL REPRESENTATIVE
(Signature and seal)

Note: 1. The (*) indicates mandatory information. Other sections can be left empty if no information is available.

2. Email subject shall start with “[TBSC]”

3. See more on website of VNCERT (www.vncert.gov vn)

...

...

...

Form No. 4
Attached to Circular No. …/2017/TT-BTTT dated ……, 2017 of the Minister of Information and Communications

FINAL INCIDENT REPORT

INFORMATION ON ORGANIZATION/INDIVIDUAL FILING THE REPORT

▪ Name of organization/individual reporting the incident (*) .............................................

▪ Address: (*) ..............................................................................................................

▪ Phone (*) …………………………………… Email (*) ......................................................

INITIAL INCIDENT REPORT NUMBER: Number …………… Reporting date: …………/ 201…

...

...

...

Name of entity operating information system (*):

Specify entity operating or hired to operate information system

Presiding authority:

Specify presiding authority

System to which the incident occurs

Specify the system to which the incident occurs

Level of the information system (if any)

□ Level 1

□ Level 2

...

...

...

□ Level 4

□ Level 5

Name/Description of the incident

...

...

...

Date on which the incident is discovered (*) (dd/mm/yy)

 / /

Time in which the incident is discovered (*):

…….. ……… (hour and minute)

Incident handling results

Provide and summarize the situation, handling solutions, proposed response solutions in order to rapidly handle the incident, mitigate risks and damage in case of similar incidents in the future…

...

...

...

Attachments

List all relevant attachments (incident development report; handling solutions, log file, etc.)

LEGAL REPRESENTATIVE
(Signature and seal)

...

...

...

Form No. 5
Attached to Circular No. 20/2017/TT-BTTT dated September 12, 2017 of the Minister of Information and Communications

SOCIALIST REPUBLIC OF VIETNAM
Independence - Freedom - Happiness

To: Vietnam Cybersecurity Emergency Response Center

6-MONTHLY/ANNUAL SUMMARY REPORT ON INCIDENT RECEPTION AND HANDLING

□ From ……/201… to ……/201…

Name of agency/organization: ......................................................................................

Address: .....................................................................................................................

...

...

...

1. Number of incidents and handling solutions

Type of incident/cyber attack

Quantity

Number of self-handled incidents

Number of incidents handled via assistance from other organizations

Number of incidents handled via assistance from foreign organizations

Number of incidents requested for assistance from VNCERT

Estimated damage

Denial-of-service attack

...

...

...

Phishing attack

...

...

...

Malware attack

...

...

...

Defacement attack

...

...

...

Encryption of software, data, equipment

...

...

...

Damage to information, data, software

Eavesdropping attack, cyber espionage, information or data theft

...

...

...

Attacks combining multiple methods

...

...

...

Other forms of attack

Total

...

...

...

2. List of organizations assisting in the incident handling

...................................................................................................................................

3. List of foreign organizations assisting in the incident handling

...................................................................................................................................

...

...

...

...................................................................................................................................

(Location and date)
LEGAL REPRESENTATIVE
(Seal or digital signature)

Form No. 6
Attached to Circular No. 20/2017/TT-BTTT dated September 12, 2017 of the Minister of Information and Communications

MINISTRY OF INFORMATION AND COMMUNICATIONS VIETNAM CYBERSECURITY EMERGENCY RESPONSE CENTER
-------

...

...

...

No. /VNCERT-NV
On coordination and response to cyber security incident

(Location and date)

To: ……………………………………………

Pursuant to tasks and powers, on the basis of practical request, the Vietnam Cybersecurity Emergency Response Center - VNCERT hereby requests Agency/Entity to execute coordination order/request below:

1. Type of coordination request

□ Notifying risks, incident situations, and preventive measures

□ Requesting incident handling

□ Requesting technical assistance, implementing administrative, technical measures

...

...

...

□ Requesting resource mobilization (personnel, resources, technology, etc.)

2. Organizations/systems related to the incident

...................................................................................................................................

...................................................................................................................................

3. Specific request

...................................................................................................................................

...................................................................................................................................

...................................................................................................................................

...................................................................................................................................

...

...

...

...................................................................................................................................

4. Expiry of coordination request: ………………… (date)

(Location and date)
DIRECTOR
(Seal or digital signature)

APPENDIX II

REGULAR INCIDENT RESPONSE PROCEDURES
(Attached to Circular No. 20/2017/TT-BTTTT dated September 12, 2017 of the Minister of Information and Communications)

...

...

...

APPENDIX III

SCHEME FOR CYBER INFORMATION SECURITY INCIDENT RESPONSE
(Attached to Circular No. 20/2017/TT-BTTTT dated September 12, 2017 of the Minister of Information and Communications)

1. General provisions

a) Scope and regulated entities of the plan.

b) Conditions, general principles, order of priority in maintaining operation of the system when responding to incidents; rules in responding to incidents.

c) Forces participating in incident response.

d) Functions, tasks, responsibilities, and cooperation regulations, procedures between agencies and entities

- Entities and individuals operating information system;

- Contractors providing cyber information security services (if any);

...

...

...

- Incident response teams;

- Ministerial/Provincial steering committees;

- National coordinating authority;

- Standing authority;

- Other relevant entities.

2. Evaluation of cyber information security risks and incidents

a) Evaluating current situations and possibility of cyber information security assurance of information systems and entities requiring protection under the plan;

b) Evaluating and predicting possible cyber risks, incidents, attacks of information systems and entities requiring protection;

c) Evaluating and predicting possible consequences, damage, and impact if incident occurs;

...

...

...

3. Response, handling measures for specific situations

In regard to each information system and application program, develop specific situations and scenarios, provide corresponding response solutions. Within response solutions, indicators shall be set forth in order to rapidly identify nature and severity of the incident. Development of incident response solutions shall satisfy regulations below:

a) Implementation procedures and initial response when incident occurs to information system, based on type of incidents.

b) Methods of rapidly, promptly identifying causes, origin of the incidents in order to take appropriate response solutions

- Incidents caused by cyber attack;

- Incidents caused by error of system, equipment, software, technical infrastructure, electric line, transmission, hosting, etc.;

- Incidents caused by errors of system administrators or operators;

- Incidents relating to natural disasters such as storms, flood, inundation, earthquake, fire, etc.

c) Response, rectification solutions for any or some of the situations below:

...

...

...

+ Denial-of-service attack;

+ Phishing attack;

+ Malware attack;

+ Hijack;

+ Defacement attack;

+ Encryption of software, data, equipment;

+ Damaging to information, data, software;

+ Eavesdropping attack, cyber espionage, information or data theft;

+ Attacks combining multiple methods

...

...

...

- Incidents caused by errors of the system, equipment, software, technical infrastructures

+ Incidents caused by electricity transmission;

+ Incidents caused by Internet connection;

+ Incidents caused by errors of software, hardware, or application of information system;

+ Incidents relating to system overloading;

+ Other incidents caused by errors of system, equipment, software, technical infrastructures.

- Incidents caused by error of system administrators, operators

+ Errors in updates, changes, configuration of hardware;

+ Errors in update, changes, configuration of software;

...

...

...

+ Errors relating to mandatory suspension of services;

+ Other errors relating to system administrators, operators.

- Incidents relating to natural disasters such as storms, flood, inundation, earthquake, fire, etc.

d) Arrangement, coordination, and cooperation between forces, organizations in responding to, preventing, handling the incidents;

dd) Solutions regarding human resources, equipment, software, instruments, tools, and expected expenditure on executing, responding to, and handling specific incidents.

4. Implementing regular operation, incident coordination, response

a) Implement activities within responsibilities of relevant agencies, entities under Article 9 through Article 11 and other relevant provisions of this Circular;

b) Implement provision expenditure, standby personnel and equipment for incident response; implement cooperation in responding to, preventing, and rectifying incidents.

5. Implementing incident prevention training, drills, monitoring, ensuring conditions for incident response and rectification

...

...

...

a) Implementing training and drill programs:

- Provide training and drills for incident response solutions corresponding to specific scenarios, specific incidents under Section 4;

- Provide advanced training and drills for cooperation, response, counter-attack, malware defense, and incident handling operations;

- Participate in regional, area, national, and international trainings, drills.

b) Implementing tasks and regulations for the purpose of preventing and discovering incidents:

- Implement incident, risk supervision and early discovery;

- Inspect, evaluate cyber information security; scan, remove, analyze, and eliminate malware;

- Prevent incidents, manage risks; study, analyze, verify, issue warnings for cyber information security incidents, risks, malware;

- Develop and apply information security protocols, regulations, and standards;

...

...

...

c) Implementing provisions and tasks for the purpose of ensuring conditions for immediately responding to and rectifying incidents:

- Procure, upgrade, extend copyright of equipment, software, instruments, and tools serving incident response and rectification;

- Fulfill conditions for ensuring and arranging backup of human resources, material resources, and financial resources in order to immediately respond to and rectify incidents;

- Organize operation of incident response teams, incident response units; hire technical services and organize, maintain incident response specialists;

- Organize and participate in operation of incident response network.

6. Implementing solutions for ensuring and organizing plans, expenditure

a) Solutions for plan execution;

b) Resources and conditions for guaranteeing plan execution;

c) Expenditure and funding sources for plan execution;

...

...

...

Provisions and tasks hereunder shall be implemented internally or by hiring service contractors or by combining both of these methods./.

Thông tư 20/2017/TT-BTTTT quy định về điều phối, ứng cứu sự cố an toàn thông tin mạng trên toàn quốc do Bộ trưởng Bộ Thông tin và Truyền thông ban hành