Scenario: a foreign cybersecurity firm wins a contract to provide penetration testing for a Vietnamese bank, assuming its global certifications are enough to start work. They are not: providing cybersecurity services in Vietnam is a conditional business line requiring its own license, and the bank — as an operator of an important information system — faces separate data obligations under the 2018 Cybersecurity Law.
The service license comes before the contract
The Cybersecurity Law 24/2018/QH14 and its guiding Decree 53/2022/ND-CP establish licensing for cybersecurity service businesses. The conditions focus on capability rather than capital: qualified personnel, technical infrastructure, and security procedures. Investors should read this as a competence gate, not a capital gate — the decree asks ‘can you do the work safely’, not ‘how much capital do you hold’.
No sector-specific foreign ownership ratio is published for cybersecurity services. Foreign investors satisfy the general market access conditions (Article 8, Investment Law 143/2025/QH15) and then the same service license as domestic providers — the license, not the equity split, decides market entry.
The second front: data obligations of the client
A trap for foreign providers is signing a service contract without mapping the client’s own duties. Under the Cybersecurity Law framework, operators of important information systems face requirements on data storage in Vietnam and cooperation with authorities. A penetration-testing or monitoring contract that moves client system data offshore can put both provider and client in breach.
Practical discipline: the service agreement should define where security data is stored and processed, who may access it, and how incident data is handed to Vietnamese authorities when the law requires — before the first test begins.
What to prepare before applying
- Personnel dossiers: qualifications and background of the technical team that will perform the services.
- Technical infrastructure: description of tools, labs and secure facilities used in service delivery.
- Security procedures: internal rules for handling client systems and data during engagements.
- Investment file: the foreign-invested enterprise meeting market access conditions, then the sectoral service license.
Frequently asked questions
1. Is there a foreign ownership cap for cybersecurity service companies?
No published sector-specific ratio; the gate is the service license plus general market access conditions.
2. Can we provide services remotely from abroad without a Vietnamese entity?
Providing cybersecurity services to Vietnamese clients as a business requires proper licensing; cross-border remote provision without local presence carries regulatory risk.
3. What does the license assessment focus on?
Personnel competence, technical infrastructure and security procedures — capability, not capital.
4. Do we need to store client security data in Vietnam?
It depends on the client’s system classification and the engagement scope; map data flows against the Cybersecurity Law framework before signing.
5. Can one license cover both consulting and product sales?
Services and product trading are different business lines with different licensing tracks; check that the license scope covers each activity actually performed.
Related articles
- Foreign Investment in Employment Services in Vietnam: Don't Confuse It with Labor Export
- Foreign Investment in Express Delivery in Vietnam: The Equity Battle Was Won in 2012
- Foreign Investment in Agriculture and Fisheries in Vietnam: Land Is the Gate, Not Capital Ratio
- Foreign Investment in Cinema and Film Distribution in Vietnam: Three Gates, Not One
- Foreign Investment in Casino Business in Vietnam: The USD 2 Billion Gate
