A data center in Vietnam has no separate “information security audit season” of the financial-audit kind; instead, three mechanisms overlap: cybersecurity-conditions assessment before operation if the facility serves critical systems, periodic annual cybersecurity inspection and assessment for systems under management, and reassessment whenever the system changes fundamentally. The cycle an operator must put on the compliance calendar is: once a year.
The three assessment mechanisms over one data center
The first mechanism is conditions assessment: if the data center hosts information systems critical to national security — for example infrastructure for the central bank, critical telecommunications, state agencies — the system owner must be assessed and certified for cybersecurity conditions under Decree 333/2026/ND-CP before operation, and reassessed on major change. The second mechanism is level-based protection under Decree 331/2026/ND-CP: every system must determine its level, build a protection plan and self-inspect execution of that plan.
The third mechanism — the one creating the cycle — is periodic cybersecurity inspection and assessment: systems under cybersecurity management must be inspected and assessed periodically every year. For a commercial data center operator, the “system” inspected includes the facility’s shared infrastructure insofar as it serves customers under management, because the protection plans of bank and telecom customers will pull the operator into their inspection scope.
Who may audit — is there an accredited list?
There is no publicly operated list of “accredited information security auditors” as in financial audit. The subject system has two tiers: the State tier is the specialised cybersecurity agency of the Ministry of Public Security — the authority that assesses and certifies cybersecurity conditions for critical systems and inspects owners’ compliance; the market tier is organisations providing cybersecurity inspection and assessment services — cybersecurity service business is a conditional business line under Cybersecurity Law No. 116/2025/QH15, and providers must meet conditions and be correspondingly licensed.
The practical consequence when choosing an assessor: a report from an ordinary security consulting firm has internal-governance and customer-diligence value, but cannot substitute the competent authority’s assessment where the system is in certification scope. The operator should keep three document types clearly separate in its file — the State conditions certificate (if in scope), periodic inspection reports, and commercial assessment reports serving customers — so as not to present the wrong paper when regulators or financial customers ask.
Is there a penalty for not auditing?
Yes. Decree 330/2026/ND-CP, in clause 4 of Article 26, fines individuals VND 50 to 70 million for failing to perform the annual periodic cybersecurity inspection for a system under management; under the base convention in Article 7 of the Decree, the organisational fine is double the individual level — VND 100 to 140 million. Related conduct includes failing to assess cybersecurity conditions before operation for a critical system, fined in clause 3 of Article 26 at VND 40 to 50 million for individuals.
Beyond fines, the heavier consequence for a commercial data center is contractual and reputational: customers in managed sectors — banking, telecommunications, energy — must diligence and monitor their providers, and an operator unable to produce periodic inspection and assessment files will be struck from their supply chains before the State ever sanctions it. The compliance risk of security audits is therefore a revenue risk, not only an administrative one.
Must audit results be reported to State authorities?
Two situations must be distinguished. For systems in the cybersecurity-conditions certification scope, the entire assessment file and certification result form part of a State process under Decree 333/2026/ND-CP — the owner files the dossier with the competent authority and the result is established by that authority, not an internal document kept at discretion. For periodic inspection, assessment and level-based self-inspection, results belong to the system owner’s compliance file: they must be documented, retained at the unit, and produced and reported when the specialised cybersecurity agency requires during inspection and supervision.
An operating recommendation: a data center operator should maintain a single cybersecurity compliance register for each facility, comprising level-determination decisions for systems, protection plans, each year’s periodic inspection records, assessment reports and remediation records for findings. When authorities or large customers ask, this register is produced as-is — it is the most valuable compliance evidence, far above scattered commercial certificates.
Frequently asked questions
How often must a data center undergo an information security audit?
On the cycle of the cybersecurity inspection and assessment regime: information systems under management must be inspected and assessed periodically once a year. Beyond the annual cycle, reassessment is required on fundamental change — large expansion, protection-architecture change, system level change — and critical national-security systems must separately be assessed and certified for cybersecurity conditions under Decree 333/2026/ND-CP before operation. A data center serving customers in managed sectors is also pulled into those customers’ own inspection cycles.
Which entities may perform audits and is there a recognized list?
Two tiers: the specialised cybersecurity agency of the Ministry of Public Security is the authority that assesses and certifies critical systems and inspects compliance; organisations providing cybersecurity inspection and assessment services that meet the conditions — cybersecurity service business being a conditional line under Cybersecurity Law No. 116/2025/QH15 — perform technical inspection and assessment activities. There is no public list of “accredited information security auditors” as in financial auditing; when hiring an assessor, verify their operating conditions in cybersecurity services and the extent to which results are recognised by the competent authority.
Is there a penalty for not auditing?
Yes. Failing to perform the annual periodic cybersecurity inspection for a system under management is fined VND 50 to 70 million for individuals under clause 4 of Article 26 of Decree 330/2026/ND-CP, with organisations fined double under Article 7 of the Decree — VND 100 to 140 million. Failing to assess cybersecurity conditions before operating a critical system is fined VND 40 to 50 million for individuals under clause 3 of Article 26. For a commercial data center, being struck from managed-sector customers’ vendor lists usually arrives first and hurts more than the fine.
Must audit results be reported to state authorities?
It depends on the result type. The assessment and cybersecurity-conditions certification result for a critical system is part of a State process under Decree 333/2026/ND-CP — the dossier is filed with the competent authority and the result is established by it. Periodic inspection, assessment and level-based self-inspection results belong to the owner’s compliance file: they must be documented, retained, and produced and reported when the specialised cybersecurity agency requires during inspection and supervision — they are not documents that may be kept entirely internal.
This article has been quality-reviewed by the FLAW AI Legal Council