Procedures for applying for a license to trade in cyber security products and services

Procedures for applying for a license to trade in cyber security products and services

The Law on Cybersecurity and Decree No. 332/2026/ND-CP expressly stipulate the conditions applicable to enterprises seeking a license to trade in cybersecurity products and services, including conditions concerning legal representatives and technical personnel. Accordingly, an enterprise must satisfy the conditions set out in Article 6 and, depending on the type of business activity, the corresponding conditions set out in Article 7 or Article 8 of Decree No. 332/2026/ND-CP.

General conditions – Article 6 of Decree No. 332/2026/ND-CP

An enterprise established under Vietnamese law and do not violate regulations on trading in ANM products and services. For foreign-invested enterprises, the investment term in Vietnam must be more than 05 years from the date of issuance of the License.

The representative/manager/person authorized by the legal representative or manager must not fall within the cases prescribed at point a, clause 2, Article 6, including:

a Vietnamese citizen who is being prosecuted, investigated, indicted, or tried, or who has a criminal record for a crime of infringing national security or another intentional crime that has not yet been expunged;
a person who is during the period of temporary postponement of serving a prison sentence;
a person who is subject to probationary supervision, a residence ban, a prohibition from holding office, or a prohibition from engaging in business lines or occupations subject to conditions on security and order, pursuant to a court decision;
a person who is subject to a measure of education at the commune, ward, or special zone level;
a person who is granted a temporary postponement or temporary suspension of the enforcement of a decision on placement in a compulsory education establishment or a compulsory drug rehabilitation facility.

Overseas Vietnamese holding foreign passports and foreigners must be licensed by competent Vietnamese agencies to reside and work in Vietnam.

Technical personnel: the enterprise must have personnel responsible for technical matters appropriate to the type of business, holding at least a university degree or a professional certificate in cybersecurity, information security, information technology, or electronics and telecommunications.

Material and technical foundations, having a system of equipment, material foundations and technologies suitable to the operation and type of products and services registered.

Conditions for trading, exchanging, importing and exporting ANM products – Article 7 of Decree No. 332/2026/ND-CP

In addition to the conditions prescribed in Article 6, an organization or enterprise that manufactures, trades in, exchanges, imports or exports cybersecurity products must satisfy the following conditions:

Having product categories and scales suitable to the development strategy of the ANM industry;
Having an appropriate business plan, including: import purposes; scope and objects of product supply; relevant technical standards and regulations; basic technical features of products;
Having appropriate means and equipment to inspect and supervise technical parameters for product quality inspection in the production process, ensuring product quality according to standards and technical regulations on ANM protection;
With respect to covert information-gathering products, network information suppression products, digital forensics and digital investigation products, and network system suppression products, only organizations or enterprises of the Ministry of Public Security or the Ministry of National Defence that have been assigned tasks or placed orders in writing, or organizations or enterprises that have contracts with competent authorities of the Ministry of Public Security or the Ministry of National Defence, are permitted to trade in, exchange, import or export such products in order to serve the task of safeguarding national security;
Exports and imports must have clear purposes and objects of use and commitments not to harm national security.

Conditions for the provision of cybersecurity services, Article 8 of Decree No. 332/2026/ND-CP

In addition to the conditions prescribed in Article 6, an enterprise providing cybersecurity services must satisfy the following conditions:

For cybersecurity inspection and assessment services and cybersecurity consulting services: at least five (05) technical personnel holding a university degree or a cybersecurity certificate or higher, with a place of residence in Viet Nam; the legal representative must hold Vietnamese nationality.
For cybersecurity monitoring services: at least twelve (12) personnel holding a university degree or a cybersecurity certificate or higher; the enterprise must have personnel in charge of system administration and information security; the legal representative must hold Vietnamese nationality.
General technical and business requirements: the enterprise must have a technical plan and a contingency plan; a general description of the technical features and the operating procedures of the monitoring system; and a business plan, together with measures to ensure the confidentiality of customer information and the quality of services.

Process	Detailed Description
Step 1	Submit the application dossier to the Ministry of Public Security by one of the following methods: in person, by post, or through the online public service portal. The application dossier shall be prepared as one (01) original set, in Vietnamese, and submitted in person, by post, or through the online public service portal to the Ministry of Public Security. Where the dossier is submitted in person or by post, it must bear all required signatures and confirmation seals; any document prepared by an organization, enterprise, or individual consisting of two (02) or more pages must be sealed across the joins between pages (overlapping seal). Where the dossier is submitted online, the enterprise must apply a digital signature.
Step 2	Within three (03) working days from the date of receipt of the dossier, the receiving agency shall check and notify the validity of the dossier. If the dossier is valid, the receiving authority shall confirm that the dossier has been received and shall proceed to process it; If the dossier requires supplementation, the receiving authority shall notify the applicant of the content to be supplemented. The enterprise shall have ten (10) working days from the date of receipt of the notification to complete the dossier; If the dossier is invalid, the receiving authority shall refuse to receive it and shall state the reasons clearly.
Step 3	Within twenty-eight (28) working days from the date of receipt of a complete and valid dossier, the Ministry of Public Security shall appraise the dossier and issue the License if the enterprise satisfies all of the required conditions. Where the enterprise fails to satisfy the conditions, the Ministry of Public Security shall issue a written refusal to grant the License, stating the reasons clearly.

Processing Time

Pursuant to Article 9 of Decree No. 332/2026/ND-CP:

Three (03) working days to check and notify the validity of the dossier;
Ten (10) working days for enterprises to supplement dossiers in case of request;
Twenty-eight (28) working days from the date of receipt of a complete and valid dossier for the Ministry of Public Security to appraise and grant the License.

Dossier of application for a license to trade in ANM products and services

The application dossier for the License pursuant to clause 2, Article 9 of Decree No. 332/2026/ND-CP shall consist of:

A written request for the License made using Form No. 03 in Appendix I1;
A curriculum vitae declaration and personal identification documents of the legal representative and managers, where such information cannot be retrieved from the information system, comprising a copy of the identity card, citizen identity card, or passport; and a permanent residence card, temporary residence card, or visa with a valid period of stay in Viet Nam; accompanied by a personnel declaration of the organization or enterprise made using Form No. 05 and Form No. 06 in Appendix I;
Diplomas, certificates, or equivalent documents proving that the personnel conditions are met;
Documents explaining the system of equipment, material facilities, and technology appropriate to the registered business operations, products, and services;
A technical plan and a business plan made using Form No. 07 and Form No. 08 in Appendix I;
Where products prescribed at points a, b, c, and d, clause 4, Article 3 are manufactured to serve the task of safeguarding national security, a written assignment of tasks, an order, or a contract with a competent authority of the Ministry of Public Security or the Ministry of National Defence.

Checklist for Technology and System Integration Enterprises

Step 1. Review and classification of products: Cross-check the entire catalogue of equipment and software currently being traded against the twelve (12) categories of excluded products set out in Appendix I and Appendix II promulgated together with Decree No. 341/2026/ND-CP, and concurrently verify the functions, intended purposes, and actual technical characteristics of each product.

Step 2. Deconstructing product features and identifying the licensing authority: Determine whether the product is a purely civil cryptographic product or a dual-use product, and on that basis identify the competent authority responsible for receiving applications and issuing licenses in accordance with the regulations.

Government Cipher Committee: Applicable where the product is a purely civil cryptographic product (whose primary function is data storage encryption, data security, or the provision of standard digital signature services);
Ministry of Public Security: Applicable to dual-use products that possess both civil cryptographic features and cybersecurity features; before issuing a license, the Ministry of Public Security shall solicit the written opinion of the Government Cipher Committee on the civil cryptographic features.

Step 3. Verifying the personnel conditions and the system of equipment and material facilities: Review the personnel structure and the system of equipment and material facilities before submitting the dossier, ensuring that the conditions under Article 5.1 are met, including:

Technical staff: Ensure that there are at least two (02) persons holding a university degree or higher in appropriate fields of specialization as prescribed.
Management and executive staff: At least one (01) person who satisfies the requirements on professional qualifications; where the person has graduated from a university in another field, he or she must additionally satisfy the requirements on training certificates relating to security and information security as prescribed;
Material and technical facilities: The enterprise must have an appropriate system of equipment and material facilities and a technical plan that meets the technical standards and regulations as prescribed.

Step 4. Standardizing the technical dossier: Prepare documents describing the product, its cryptographic functions, intended purposes, and technical specifications, together with documents proving the business conditions, ensuring consistency between the legal dossier and the technical dossier.

Step 5. Reviewing post-licensing obligations: Establish an internal mechanism to maintain the business conditions, manage customer information, perform reporting obligations, and monitor te validity period of the license throughout the course of operations.

Note: The classification must be carried out on the basis of cross-checking the funtions, intended purposes, technical characteristics, and the product lists set out in the Appendices to the Decrees, so as to accurately determine the scope of regulation and the corresponding legal obligations.

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Procedures for applying for a license to trade in cyber security products and services

What are “civil cryptographic products” and “civil cryptographic services”?

Civil cryptographic products: These are hardware, software, documents, technical equipment, and cryptographic professional equipment designed and manufactured to protect information.

Civil cryptographic services: These comprise information protection services using civil cryptographic products; civil cryptographic product assessment services; and security and cybersecurity consulting services using civil cryptographic products.

Must foreign enterprises providing services in Viet Nam store data in Viet Nam?

Yes. The law provides that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value-added services in cyberspace in Viet Nam, if they engage in the collection, exploitation, analsys, or processing of the categories of data within the scope prescribed by the Law, may be required to store such data in Viet Nam for a period prescribed by the Government.

Is the provision of cybersecurity inspection and assessment service a conditional business line?

Yes. The Law lists “cybersecurity inspection and assessment services” within the group of cybersecurity services. In addition, there are other services such as information security using civil cryptography, civil cryptography, cybersecurity consulting, cybersecurity monitoring, incident response, data recover, cyberattack prevention and combat, and other cybersecurity services.

According to Article 29, enterprises trading in cyber security products and services must have a license to trade in cyber security products and services, and at the same time must meet the responsibilities of maintaining business conditions, service quality, confidentiality of customer information, managing records and coordinating with specialized forces when required.

Why are civil cryptographic products required to be inspected, certified and declared conformity before commercial circulation?

Mandatory requirements: Civil cryptography products must be inspected and certified for conformity before being circulated on the market to ensure the quality of cryptography meets standards

Management mechanism: The Government Cipher Committee is responsible for managing the quality of civil cryptography products and services through the appointment and management of activities of civil cryptography conformity assessment and certification organizations

This helps protect end users from products that contain dangerous encryption vulnerabilities or are installed with spyware and protect national security in cyberspace.

What are the necessary and sufficient conditions for an enterprise to be granted a license to export and import civil cryptographic products?

According to Article 10, Clause 1, the enterprise must fully meet the following 03 mandatory conditions:

Having a valid license to trade in corresponding civil cryptographic products and services.
Imported civil cryptographic products must be certified and declared technical-regulation conformity according to Vietnamese technical standards.
The objects to which the products are transferred and the purpose of using these civil cryptographic products do not harm national defense and security and social order and safety.