With the explosion of science and technology in the 4.0 era, cyberspace is developing with breakthroughs such as artificial intelligence, the Internet of things, quantum computers, cloud computing, and data systems. Parallel to bringing great benefits to the economy, the outstanding development of cyberspace also poses the problem of ensuring cyber information security and demand for trading-related products and services. Accordingly, cyberinformation security means the protection of information and information systems in cyberspace from being illegally accessed, utilized, disclosed, interrupted, altered, or sabotaged to ensure the integrity, confidentiality, and usability of the information. Therefore, doing business in the field of cyber information security is a conditional business sector, including trading cyber information security products and services. The following article will present the business conditions in the field of cyber information security so investors can have an overview before choosing this service to invest in.
According to Vietnam’s commitments in the WTO Schedule of Commitments, trading in cyberinformation security products and services is a wholesale service (CPC 622).
Accordingly, this service currently has no restrictions on the form of commercial presence as well as the percentage of capital contributed by foreign investors.
According to the provisions of the Law on Cyberinformation Security and Decree 108/2016/ND-CP, trading in cyberinformation security products and services is a conditional business sector. Therefore, regardless of the establishment process, when conducting trading activities in the field of cyberinformation security), an enterprise (Vietnamese or foreign-owned enterprises alike) must obtain a License for trading in Cyberinformation security products and services.
Types of products:
Types of services:
Requirements for Conformity: The trading plan of the enterprise shall comply with the national strategy, and plan for cyberinformation security development.
Regarding the business plan: It ncludes the contents of the description of the equipment system, the facilities of the enterprise, the description of the personnel’s experience, the range of products provided; the type of product being traded; the fulfillment of relevant technical standards and regulations for each type of product.
Facilities: Having facilities, equipment and production technology that are appropriate for the business method available
Personnel: Having a management team satisfying professional requirements for information security and technicians with bachelor’s degrees in information security or certificates of information security or certificates of information technology or certificates of electronics and telecommunications with a sufficient number of employees for the scale and requirements of the business plan
Regarding application forms:
A dossier for issuance of the License for trading in cyberinformation security products and services shall be made in five sets, including :
– An application specifying the types of cyberinformation security products and services to be traded.
– A copy of the enterprise registration certificate, investment registration certificate or another paper of equivalent validity.
– A written explanation of the technical equipment system compliant with the law.
– A business plan specifying the scope, users, standards and quality of the products and services.
– Copies of information security diplomas or certificates of managerial, administrative and technical employees.
To establish a company trading in cyberinformation security products and services, investors need to take the following steps:
Step 1: Apply for an investment registration certificate
Step 2: Apply for an enterprise registration certificate
Step 3: Apply for the License for trading in cyberinformation security products and services.
The article is based on applicable law at the time noted as above and may no longer be appropriate at the time the reader approaches this article as the applicable law has changed and the specific case that the reader wishes to apply. Therefore, the article is only for reference.