Cybersecurity levels in Vietnam: Requirements for businesses

4 days ago

11 min read

Cybersecurity levels in Vietnam apply to individual information systems, based on their functions, data, users, and the consequences of a security incident. Businesses should identify the appropriate classification before purchasing equipment, preparing compliance documentation, or selecting a security provider.

On October 22, 2026, Vietnam’s cybersecurity authorities and the National Cybersecurity Association advised businesses to review PHP-based websites following the disclosure of two critical vulnerabilities rated 9.2 out of 10. On October 23, AlmaLinux also warned about Linux vulnerability ZDI-CAN-33367, which could enable local privilege escalation.

These alerts demonstrate why system protection requires continuous attention. Security equipment alone cannot compensate for missing patches, unattended alerts, or untested recovery procedures.

Which cybersecurity level applies to your systems? Can your internal team handle the requirements? When should you outsource, and what are the risks of noncompliance?

Important: This article provides general reference information. Determining the applicable classification, legal obligations, and suitable services requires direct consultation based on your actual systems and applicable regulations.

1. How are cybersecurity levels in Vietnam determined?

Vietnamese regulations classify information systems rather than assigning one security level to an entire company.

cybersecurity-levels-vietnam-businesses — 5 cybersecurity levels in Vietnam

A business may operate several systems with different classifications, including HR software, an e-commerce website, a customer application, and industrial control systems.

Revenue, employee numbers, company size, or foreign ownership alone do not determine the applicable cybersecurity level.

Key considerations include:

Whether the system supports internal operations or provides online services.
The types of information it processes.
The number of personal data subjects.
Whether the online service falls within a conditional business sector.
The system’s scope and the consequences of disruption or compromise.

Two important legal references are the Cybersecurity Law No. 116/2025/QH15, effective July 1, 2026, and Decree No. 331/2026/ND-CP, effective August 19, 2026.

If a system meets criteria associated with different levels, the highest applicable level must be considered. System boundaries must reflect actual functions, data dependencies, and operations.

2.Which businesses should review Vietnam’s cybersecurity requirements?

Article 2 of Decree 331 establishes its scope for parties involved in information systems in Vietnam supporting IT applications in state agencies and organizations, and the provision of online services to individuals and businesses. Other relevant organizations and individuals are encouraged to apply its provisions.

2.1. Cybersecurity requirements for online service providers

E-commerce businesses, SaaS providers, transaction platforms, and online financial, healthcare, and educational services should proactively review their obligations.

The assessment should examine the actual service, relevant business conditions, data categories, and system functions. An industry label or company size is insufficient to establish a classification.

2.2. Cybersecurity requirements for contractors and system operators

Software contractors, infrastructure providers, and organizations operating systems for state agencies should clarify their responsibilities in project documentation, assigned duties, and contracts.

When IT services are outsourced, the parties should identify the system owner, operator, and responsibilities for accounts, data, monitoring, backups, and incident response.

2.3. Cybersecurity protection for internal business systems

Businesses using only internal software should check the decree’s scope before concluding that particular classification procedures are mandatory.

Nevertheless, HR, accounting, and CRM systems still require appropriate protection. Processing employee or customer information may also create personal data protection obligations.

3. Understanding the 5 cybersecurity levels in Vietnam

The following indicators support an initial assessment. They do not replace a complete classification review.

The suggested technologies and services are practical recommendations. Mandatory controls must be established against the applicable standards, technical regulations, sector-specific rules, and approved protection plan.

3.1. Cybersecurity level 1: Internal systems processing public information

3.1.1. Typical classification indicator

A representative criterion is a system supporting internal operations and processing only public information.

If it contains personnel records, confidential contracts, customer data, or other nonpublic information, its classification should be reassessed. A corporate website does not automatically qualify as Level 1 simply because its content is publicly accessible.

3.1.2. Recommended security priorities

Account management, secure configuration, software updates, endpoint protection, and backups of necessary content.

3.1.3. Internal management or outsourcing?

Internal management may be suitable when IT personnel have the necessary skills and documented procedures.

Businesses can outsource configuration assistance or periodic reviews when specialist knowledge is unavailable internally.

Level 1 does not automatically require an outsourced 24/7 SOC. Applicable assessment and classification procedures must still be followed.

3.1.4. Risk to avoid

Leaving the system without an assigned administrator, updates, or backups because it is considered unimportant.

3.2. Cybersecurity level 2: Systems processing private or personal information

3.2.1. Typical classification indicators

Representative criteria include internal systems processing private or personal information without processing state secrets, and certain online service systems that do not meet higher-level criteria.

For the relevant category of other online services processing data, businesses should examine the thresholds below 100,000 basic personal data subjects or below 10,000 sensitive personal data subjects.

These figures concern data subjects, not website visits or database rows. Other criteria may still require a higher classification.

3.2.2. Recommended security priorities

A firewall appropriate to the architecture.
Multifactor authentication for important accounts.
Endpoint protection and patch management.
Data access controls and account provisioning and removal.
Independent backups, recovery testing, and necessary logging.

3.2.3. Internal management or outsourcing?

Internal operation may be appropriate if the IT team can manage assets, accounts, updates, backups, and incidents.

Where staff have multiple responsibilities, a shared operating arrangement may be more practical. The business retains an accountable contact and decision-making authority while a provider supports administration or specialist reviews.

Businesses can explore security solutions for small and medium-sized enterprises to define a suitable scope.

3.2.4. Risk to avoid

Installing antivirus software while neglecting privileged accounts, former employees’ access, or cloud configuration.

3.3. Cybersecurity level 3: Conditional online services or significant data volumes

3.3.1 Typical classification indicators

Businesses should prioritize a Level 3 review when a system:

Provides online services falling within conditional business sectors.
Provides other online services processing data relating to at least 100,000 basic personal data subjects or at least 10,000 sensitive personal data subjects.
Meets the relevant criteria for infrastructure or industrial control systems.

For industrial control systems, a relevant criterion concerns systems directly controlling or operating construction works classified as Grade II, III, or IV under construction regulations.

For example, an online platform processing health information relating to 12,000 people should examine the sensitive personal data criterion. An online service in a conditional business sector should also review the relevant criterion even when its user base is small.

3.3.2. Recommended Level 3 security priorities

Appropriate classification documentation, policies, and protection plans.
Network segmentation and controls over connections and remote access.
Website, API, server, and endpoint protection.
Privileged account management.
Log collection, monitoring, and alert handling.
Security testing, remediation, and retesting.
Incident response, backup, and recovery plans.

3.3.3. Internal management or outsourcing?

Businesses may organize internal operations when they have sufficient personnel and expertise.

There is no universal rule that every Level 3 system must use an outsourced SOC or undergo quarterly penetration testing.

When internal resources are insufficient, businesses may combine their team with a 24/7 SOC service for monitoring and penetration testing services for an agreed testing scope.

Operations, security assessment, and formal appraisal and approval are separate activities. A penetration test report or SOC contract does not replace all classification procedures.

3.3.4. Risk to avoid

Having approved documentation that does not match actual configurations, leaving alerts unresolved, or failing to establish who can isolate a compromised device.

3.4. Cybersecurity level 4: Systems with serious potential consequences

3.4.1. Typical classification indicators

Representative criteria concern nationwide information infrastructure serving agencies and organizations with stringent continuous-operation requirements, industrial control systems serving Grade I construction works, and other systems meeting the prescribed serious-impact criteria.

Having multiple branches or operating a website 24/7 is not sufficient by itself to establish Level 4.

3.4.2. Recommended security priorities

Resilient architecture, system separation, privileged access controls, continuous monitoring, and scenario-based recovery testing.

Manufacturers should assess office IT separately from operational technology, or OT. Testing, scanning, and changes affecting OT must account for operational safety.

3.4.3. Internal management or outsourcing?

An internal team may manage the system if it meets the applicable requirements.

A shared operating model can add specialist expertise and incident-response capacity. The business should retain incident command, change approval, and control over provider access.

Relevant options include PAM and bastion solutions and a documented disaster recovery plan.

3.4.5. Risk to avoid

Purchasing redundant equipment without testing failover, or allowing multiple systems to depend on a single administrative account, infrastructure component, or backup.

3.5. Cybersecurity level 5: Systems of exceptional national importance

3.5.1. Typical classification indicators

The criteria concern strategic systems, particularly important national data, infrastructure connecting Vietnam internationally, and industrial control systems serving special-grade works or works important to national security, as prescribed.

A large company, foreign-invested enterprise, or business conducting cross-border transactions does not automatically qualify as Level 5.

3.5.2. Security solutions require a dedicated design

Architecture, personnel, products, monitoring, resilience, and response arrangements must meet the applicable requirements.

Level 5 systems or systems listed as important to national security that use data center or cloud services are also subject to prescribed physical separation requirements for relevant components.

3.5.3. Internal management or outsourcing?

The organization must establish accountable personnel and coordinate with the competent authorities. External providers may be involved where the applicable requirements permit.

For inspection and assessment, internal self-assessment alone is insufficient. Article 31 of Decree 331 provides for assessment by appropriately licensed specialist organizations, public service organizations with suitable functions, or designated organizations, as applicable.

3.5.4. Risk to avoid

Applying a standard commercial outsourcing package without checking provider conditions, separation requirements, and mandatory procedures.

4. Internal cybersecurity management versus outsourcing in Vietnam

Businesses should distinguish four activities before choosing an operating model.

Security operations: Managing configurations, accounts, patches, backups, and alerts. These activities may be handled internally or with a provider, subject to applicable system requirements.
Internal self-assessment: This must meet independence and methodological conditions. Article 31 of Decree 331 requires the assessing unit to be independent of the unit directly operating the system.
Specialist assessment: Businesses must check when an appropriate professional organization is required, including for Level 5 systems, systems important to national security, serious incidents, major changes, or requests from competent authorities.
Classification appraisal and approval: These must follow the prescribed authority. Hiring a consultant or penetration tester does not transfer formal approval powers to that provider.

Outsourcing cybersecurity does not remove the system owner’s statutory responsibilities. The business should maintain an accountable contact with decision-making authority.

5. Penalties for failing to meet cybersecurity requirements in Vietnam

Under Decree No. 330/2026/ND-CP, reading Article 7 together with Articles 23 and 24, selected penalties applicable to organizations include:

VND 40–60 million: Failure to prepare classification documentation or organize its appraisal and approval as required.
VND 40–60 million: Operating a Level 3–5 system before its classification has been approved.
VND 40–60 million: Failure to fully implement protection measures in the approved documentation for Level 3–5 systems.
VND 60–100 million: Failure to check or monitor compliance, retain required logs, or assess the effectiveness of protection measures.

These amounts are stated for organizations. They should not be mechanically added together for the same conduct.

Personal data protection is subject to separate penalty provisions. The Personal Data Protection Law establishes maximum penalties that may reach:

Ten times the proceeds obtained from unlawful personal data trading.
Five percent of the preceding year’s revenue for violations involving cross-border personal data transfers.
VND 3 billion for other personal data protection violations.

The applicable conditions and specific conduct must be examined.

A cyberattack or the absence of an outsourced SOC does not automatically result in a five-percent revenue penalty.

6. Business cybersecurity risks extend beyond regulatory fines

On September 24, 2026, Vietnam’s Ministry of Public Security reported a case involving approximately 120 million items of personal data discovered on suspects’ devices. The information concerned multiple sectors, including banking, telecommunications, healthcare, and businesses.

This figure represents data discovered. It does not mean 120 million unique individuals or establish that the information came from one intrusion.

Businesses may also face investigation, restoration, notification, complaint-handling, and operational disruption costs.

For illustration, if every hour of downtime affects VND 50 million in revenue, an eight-hour incident could affect VND 400 million in revenue before remediation costs. This is a hypothetical calculation, not a general loss statistic.

Businesses should define their maximum acceptable downtime and data loss to guide protection and recovery investment.

7. Business cybersecurity solutions to include in your protection plan

No single equipment package suits every cybersecurity level in Vietnam. A protection plan should consider the following areas.

7.1. Business network security with Firewalls and segmentation

Physical or virtual firewalls, network segmentation, and remote-access controls can restrict connections and reduce the spread of an incident.

They require appropriate configuration, maintenance, and monitoring. Businesses without sufficient personnel may consider managed firewall services.

7.2. Server and endpoint security through patch management

The October 2026 PHP and Linux alerts demonstrate the importance of identifying affected systems, assigning update responsibilities, and verifying that fixes are effective.

A web application firewall may reduce exposure but does not replace PHP security updates. For Linux, the appropriate response depends on the distribution, version, and configuration.

Businesses using hosting or cloud services should ask providers to confirm what has been addressed and which responsibilities remain with the customer.

7.3. Website and API security through appropriate testing

Businesses should combine access controls, secure configuration, web application protection, and testing within an agreed scope.

DDoS protection should be considered according to exposure and availability requirements.

After a penetration test, findings should be remediated and retested. Businesses can review this guidance on remediating vulnerabilities identified in penetration testing reports.

7.4. Personal data security and privileged access management

Prioritize multifactor authentication for administrative accounts, email, cloud platforms, and remote access.

Manage account creation, role changes, and access removal. Avoid shared administrative accounts where possible.

Encryption, key management, and data loss prevention should reflect the information being processed and its actual movement between systems.

7.5. Cybersecurity monitoring and incident recovery

Businesses need to establish who receives alerts, who can isolate devices, and who coordinates restoration.

Backups must be protected and recovery tested. Possessing backup files does not establish that an application can be restored within the required timeframe.

8. Preparing information system security classification documentation

For systems within scope, businesses should prepare system descriptions, classification justifications, protection plans, internal policies, and the other documents required by the applicable procedure.

Level 1 and 2 systems have appraisal and approval arrangements involving the system owner’s designated cybersecurity unit. For Level 3, the designated unit conducts appraisal and the system owner approves. Level 4 and 5 involve competent authorities as prescribed.

Article 39 of Decree 331 provides transitional arrangements for systems already under investment or construction before July 1, 2026.

For those systems, classification appraisal and approval under Decree 85/2016 must be completed within six months of the new law taking effect. Corresponding conditions, standards, and protection measures must be ensured within twelve months.

These arrangements are not a general extension available to every business.

9. What to check before outsourcing business cybersecurity?

Before selecting a provider, businesses should clarify:

The systems, data, and activities included.
Relevant capabilities, licenses, or service eligibility conditions.
Incident intake, response, and handling times.
Authority to isolate devices, disable accounts, and change configurations.
Protection of administrative credentials and business data.
Reporting, evidence, and acceptance criteria.
Incident coordination, handover, and access removal at contract termination.

Budget separately for assessment and documentation, technology deployment, and recurring operations.

A quote for one security appliance does not represent the full cost of compliance.

---------

Frequently asked questions about cybersecurity levels in Vietnam

Do small businesses automatically require level 3 cybersecurity?

No. Company size alone does not establish the classification.

A small business may operate an online service meeting Level 3 criteria, while other systems require a different assessment.

Does ISO 27001 satisfy Vietnam’s security classification requirements?

Not automatically. ISO 27001 supports information security management but does not replace classification procedures or the corresponding legal requirements.

Does hiring a SOC complete cybersecurity compliance?

No. A SOC supports monitoring and response within the contracted scope.

The organization must still address applicable management, technical, documentation, and accountability requirements.

Can a business conduct its own cybersecurity assessment?

Internal assessment may be possible where permitted and when the applicable conditions are met.

The assessment must maintain the required independence from operations. Businesses must also check whether a specialist organization is required.

Get advice on cybersecurity classification and business security solutions

To identify the cybersecurity level your systems need to meet, start with a list of systems, online services, data categories, data subject numbers, and existing controls.

Businesses can contact IPSIP Vietnam to discuss assessment scope, responsibilities that can remain internal, and activities requiring specialist support.

Contact IPSIP Vietnam | IT Managed Services & Security Consulting

The proposed engagement should clarify the preliminary classification, requirements to examine, identified gaps, remediation priorities, operating responsibilities, and acceptance evidence.

This article is for general reference as of its update date. It does not replace legal advice, a technical assessment, or a determination by the competent authorities. Please contact IPSIP directly to assess your systems and identify suitable services before selecting a solution.

---------------

References