Procedures for applying for a license to export and import cyber security products

In addition to the License to trade in cyber security products and services (ANM), organizations and enterprises when exporting or importing ANM products on the List of ANM products exported and imported under the license must also apply for a separate License for export and import of ANM products issued by the Ministry of Public Security.

With respect to dual-use products, being products that simultaneously possess both civil cryptographic functions and cybersecurity functions, the authority to issue the License rests with the Ministry of Public Security; however, the Ministry of Public Security must first obtain the written opinion of the Government Cipher Committee regarding the civil cryptographic functions before issuing the License.

Scope of application

According to Clause 1, Article 13 of Decree No. 332/2026/ND-CP, organizations and enterprises that export or import cybersecurity products included in the List of Cybersecurity Products Subject to Export/Import Licensing set out in Appendix II to Decree No. 332/2026/ND-CP must obtain an Export/Import License for Cybersecurity Products issued by the Ministry of Public Security.

Duration and Method of Licensing: The Export/Import License for Cybersecurity Products is valid for two (02) years and is issued on a per-consignment basis for each export or import shipment.

Note: Under the new regulations, licenses are currently issued on a per-consignment basis. Accordingly, enterprises must plan their export/import activities and the expected timeframe for implementation, so that these can be specifically recorded in the application dossier for the export/import license. As a result, whether an enterprise remains permitted to export or import will not depend solely on the remaining validity period of the license, but must also be assessed by reference to the number of consignments for which the enterprise has been licensed and whether such consignments have actually been exported or imported. An enterprise shall be entitled to export or import only within the quantity of consignments approved and during the period in which the license remains valid.

Conditions for issuance of the export/import for ANM products

Having a valid license to trade in ANM products and services, the contents of the license clearly state that the enterprise is allowed to trade, export and import products;
For imported products: the products must comply with international standards or Vietnamese standards in the field of cybersecurity, in accordance with the law on standards and technical regulations;
The purpose and object of using the product are clear and do not harm national security.

Dossier of application for License to export and import ANM products

Written request for issurance of the export/import license;
Documents certifying compliance with international standards or Vietnamese standards in the field of ANM;
Documents proving the purpose and object of the import, for example:
- Commercial contracts with end-users;
- Documents proving import for research;
- Documents proving import for warranty.

Procedures for applying for a license to export and import cyber security products

Process	Detailed Description
Step 1	The enterprise prepares and submits one (01) set of application dossier to the Ministry of Public Security by one of the following methods: in person, by post, or via the online public service portal.
Step 2	Within three (03) working days from the date of receipt of the dossier, the Ministry of Public Security examines the validity of the dossier. In case the dossier needs to be supplemented, the enterprise shall supplement it according to the notice of the receiving agency.
Step 3	Within five (05) working days from the date of receipt of a valid dossier, the Ministry of Public Security shall consider and grant a license for export and import of cyber security products. In case of refusal to grant a license, the Ministry of Public Security shall notify in writing and clearly state the reason.

Processing time

Three (03) working days for examining the dossier and notifying the applicant of its validity;
Five (05) working days from the date the dossier is deemed valid for the Ministry of Public Security to consider and issue the License, or to refuse issuance and state the reasons.

Therefore, the prescribed processing time is five (05) working days from the date the dossier is valid, excluding the time for the enterprise to prepare or supplement the dossier.

Checklist for Enterprise — License to import and export cybersecurity products, dual-use products

Step 1. Review and classification of export/import products: Cross-check the entire list of equipment and software intended for export/import against the List of Cybersecurity Products Subject to Export/Import Licensing set out in Appendix II to Decree No. 332/2026/ND-CP, and additionally check against Appendices I and II to Decree No. 341/2026/ND-CP to determine whether the products also possess civil cryptographic functions;

Step 2. Define features, identify licensing agencies: Determine whether the product is a specialized ANM or a dual-use product, thereby determining the right competent authority (Ministry of Public Security or the Government Cipher Committee) and the application process;

Step 3. Inspection of personnel conditions and facilities: Ensure that the conditions on the License to trade in ANM products and services/civil cipher code are satisfied before submitting the application for the Import and Export License;

Step 4. Standardization of technical documents: Prepare documents describing products, functions, purposes of use, specifications, documents proving the purpose and objects of export/import, ensuring consistency between legal and technical documents;

Step 5. Track Shipment Number and License Duration: Establish an internal mechanism to monitor the number of licensed shipments, the number of batches actually exported/imported, the validity period of the Export and Import License with a term of 02 years for ANM products and 03 years for civil cryptographic products to ensure continuous compliance.

Note: The correct classification of products as specialized ANM or dual-use products determines whether the dossier must be supplemented with documents identifying civil cryptography features and directly affects the actual processing time because it has to wait for the opinion of the Government Cipher Committee.

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Procedures for applying for a license to export and import cyber security products

What are “civil cryptographic products” and “civil cryptographic services”?

Civil cryptographic products: These are hardware, software, documents, technical equipment, and cryptographic professional equipment designed and manufactured to protect information.

Civil cryptographic services: These comprise information protection services using civil cryptographic products; civil cryptographic product assessment services; and security and cybersecurity consulting services using civil cryptographic products.

Must foreign enterprises providing services in Viet Nam store data in Viet Nam?

Yes. The law provides that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value-added services in cyberspace in Viet Nam, if they engage in the collection, exploitation, analsys, or processing of the categories of data within the scope prescribed by the Law, may be required to store such data in Viet Nam for a period prescribed by the Government.

Is the provision of cybersecurity inspection and assessment service a conditional business line?

Yes. The Law lists “cybersecurity inspection and assessment services” within the group of cybersecurity services. In addition, there are other services such as information security using civil cryptography, civil cryptography, cybersecurity consulting, cybersecurity monitoring, incident response, data recover, cyberattack prevention and combat, and other cybersecurity services.

According to Article 29, enterprises trading in cyber security products and services must have a license to trade in cyber security products and services, and at the same time must meet the responsibilities of maintaining business conditions, service quality, confidentiality of customer information, managing records and coordinating with specialized forces when required.

Why are civil cryptographic products required to be inspected, certified and declared conformity before commercial circulation?

Mandatory requirements: Civil cryptography products must be inspected and certified for conformity before being circulated on the market to ensure the quality of cryptography meets standards

Management mechanism: The Government Cipher Committee is responsible for managing the quality of civil cryptography products and services through the appointment and management of activities of civil cryptography conformity assessment and certification organizations

This helps protect end users from products that contain dangerous encryption vulnerabilities or are installed with spyware and protect national security in cyberspace.

What are the necessary and sufficient conditions for an enterprise to be granted a license to export and import civil cryptographic products?

According to Article 10, Clause 1, the enterprise must fully meet the following 03 mandatory conditions:

Having a valid license to trade in corresponding civil cryptographic products and services.
Imported civil cryptographic products must be certified and declared technical-regulation conformity according to Vietnamese technical standards.
The objects to which the products are transferred and the purpose of using these civil cryptographic products do not harm national defense and security and social order and safety.