The Cybersecurity Law 116/2025/QH15 — effective from 1 July 2026, replacing the entire 2018 Cybersecurity Law and the 2015 Law on Network Information Security — sets a new framework of obligations for information systems, particularly information systems critical to national security. Companies operating or outsourcing information systems should note the following seven legal points when assessing their compliance.
1. Determine your system level: the 5-level classification (Article 8)
Article 8 of Law 116/2025/QH15 requires information systems to be classified into 5 levels. This is the mandatory starting point: a system’s classification level determines the scope of cybersecurity obligations its owner must fulfill.
- Classification must follow statutory criteria — systems must not be arbitrarily “downgraded” to avoid obligations;
- When a system changes in scale or nature, its classification should be re-reviewed;
- The classification dossier is the first document authorities check in a compliance review.
2. “Information systems critical to national security” — a narrow definition, no broad inference
Article 9 defines information systems critical to national security with a narrow definition covering 8 sectors (Clauses 1 and 2 of Article 9). A system falls into this group only if it meets the statutory criteria and is listed in the catalogue decided by the Prime Minister (Clause 4, Article 9).
Key note: not every information system of an FDI company is critical to national security. Broad inferences such as “all foreign-invested companies are covered” are wrong and can misdirect compliance assessments and waste resources.
3. Mandatory cybersecurity appraisal and qualification certification BEFORE operation
Under Clause 3, Article 9, owners of information systems critical to national security must conduct a cybersecurity appraisal and obtain certification of cybersecurity qualification before putting the system into operation.
- This is a precondition, not a paperwork exercise to complete afterwards;
- Operating a system before appraisal and certification are complete breaches a legal obligation;
- Companies should build the appraisal milestone into project plans from the design stage to avoid cost overruns and delays.
4. Annual recurring duty: self-inspection, assessment and reporting before October
Point b, Clause 1, Article 11 requires system owners to self-inspect and assess cybersecurity conditions annually and to report in writing before October each year.
- The assessment must cover all cybersecurity conditions of the system, not be a mere formality;
- The written report must reach the competent authority on time — late reporting breaches the duty;
- Self-inspection results form the basis for remediation and upgrade plans for the following year.
5. Continuous monitoring, alert mechanisms and incident response plans
Points c and d, Clause 1, Article 11 require system owners to monitor cybersecurity continuously, maintain alert mechanisms, and have incident response plans in place.
- Monitoring must be continuous, with logs and event-recording procedures;
- Alert mechanisms need clear thresholds, designated recipients and notification channels;
- Response plans should be drilled periodically and updated when the system changes.
6. Cooperate with unannounced inspections by authorities
Point dd, Clause 1, Article 11 obliges system owners to cooperate with authorities during unannounced cybersecurity inspections. Companies should keep ready:
- Level-classification dossiers, appraisal results and qualification certificates;
- Annual self-inspection and assessment reports with remediation plans;
- Monitoring logs, incident response plans and drill records;
- A designated contact for the inspection team.
7. Sanctions and prohibited acts
Sanctions: administrative violations in cybersecurity are penalized under Decree 330/2026/ND-CP, with maximum fines of VND 200 million for organizations and VND 100 million for individuals (companies should consult the original text of the Decree to identify the specific provisions applicable to each violation).
Prohibited acts are set out in Article 7 of Law 116/2025/QH15 — companies should review their operations to avoid breaches.
Note on personal data: if the system processes personal data, the company must also comply with the Personal Data Protection Law 91/2025/QH15. Detailed implementation of Law 116/2025/QH15 is provided in Decree 333/2026/ND-CP.
Warning on expired legislation: the 2018 Cybersecurity Law, the 2015 Law on Network Information Security and Decree 15/2020/ND-CP must no longer be cited as current authority. All internal documents, contracts and compliance policies citing article numbers of the 2018 Law (e.g. “Articles 11 and 12 of the Cybersecurity Law”) should be reviewed and updated under Law 116/2025/QH15.
Frequently asked questions
Is an FDI company’s information system automatically “critical to national security”?
No. Only systems meeting the Article 9 criteria and listed in the Prime Minister’s catalogue (Clause 4, Article 9) fall into this group. No broad inference.
Can a system operate first and complete the cybersecurity appraisal later?
No. Clause 3, Article 9 requires appraisal and qualification certification to be completed before operation.
When is the annual cybersecurity assessment report due?
In writing, before October each year (Point b, Clause 1, Article 11).
What are the maximum fines for cybersecurity violations?
Under Decree 330/2026/ND-CP: up to VND 200 million for organizations and VND 100 million for individuals — consult the original text for the applicable provisions.
Sources
- Cybersecurity Law 116/2025/QH15 — effective 1/7/2026, replacing the 2018 Cybersecurity Law and the 2015 Law on Network Information Security: Article 7 (prohibited acts); Article 8 (5-level classification); Article 9 (information systems critical to national security; pre-operation appraisal and certification; Prime Minister’s catalogue); Article 11 (system owner responsibilities);
- Decree 333/2026/ND-CP — detailed implementation of Law 116/2025/QH15;
- Decree 330/2026/ND-CP — administrative sanctions in cybersecurity;
- Personal Data Protection Law 91/2025/QH15 — applies when the system processes personal data.
For reference only; not legal advice. This article was drafted by AI and quality-checked by the AI Legal Council of FLAT Law Firm; it has not been reviewed or approved by a human lawyer. Regulations may change; please check the current legal texts before applying.
Related articles
Does your company need a cybersecurity and data protection review for its information systems? Contact FLAT Law Firm for advice.