Procedure for issuing a business License for civil cryptography products and services

Decree No. 341/2026/NĐ-CP detailing the Law on Cybersecurity regarding civil cryptography activities has established a separate legal framework, distinct from the cybersecurity sector, for the business of civil cryptography products and services. Enterprises trading products and services listed in the Catalog of Civil Cryptography Products and Services (Appendix I of Decree No. 341/2026/NĐ-CP) must obtain a Business License for Civil Cryptography Products and Services issued by the Government Cipher Committee prior to operation.

Scope of application

Civil cryptography products are hardware, software, documents, technical equipment, and cryptographic operations used to protect information that does not fall within the scope of state secrets.

Accordingly, Appendix I of Decree No. 341/2026/NĐ-CP stipulates that the catalog of civil cryptography services comprises 3 main groups, the catalog of conditional civil cryptography products comprises 7 main groups, and 12 groups of products are excluded from conditional management (e.g., operating systems/browsers with integrated cryptographic components that are not the primary function, mobile phones without end-to-end encryption, common SED hard drives, TPM products…).

Catalog of civil cryptography products

Products for cryptographic key generation, key management, or key storage;
Products for stored data security;
Products for network data exchange security;
IP flow security products;
Analog and digital voice security products;
Radio information security products;
Fax and telegraph security products.

Catalog of civil cryptography services

Information protection services using civil cryptography products.
Civil cryptography product evaluation services.
Security and network information safety consulting services using civil cryptography products.

General conditions

Technical personnel: At least 02 technical officers holding a university degree or higher in one of the following fields: electronics – telecommunications, information technology, mathematics, or information security;
Management personnel: 01 managerial and executive officer holding a university degree in the aforementioned fields, or a university degree in another field accompanied by a training certificate in security or information security;
Physical and technical infrastructure: Having a system of equipment and physical facilities suitable for the scope, subjects, and fields of providing civil cryptography products and services;
Technical plan: Having a technical plan compliant with technical standards and regulations.

Sequence for obtaining a business License for civil cryptography products and services

Process	Detailed Description
Step 1	The enterprise prepares and submits 01 set of dossier to the Government Cipher Committee through one of the following methods: directly, via postal service, or through the National Public Service Portal (online submissions must be digitally signed).
Step 2	Within 01 working day from the date of receiving the dossier, the Government Cipher Committee shall inspect the validity of the dossier. If the dossier is invalid, the Government Cipher Committee shall notify in writing the contents that need to be amended or supplemented; The enterprise has 03 working days from the date of receiving the notice to complete the dossier; In cases where the amended or supplemented dossier still fails to meet the requirements or exceeds the completion deadline, within 03 working days the Government Cipher Committee shall notify in writing the reasons for refusing to grant the license.
Step 3	Within 12 days from the date of receiving a complete and valid dossier, the Government Cipher Committee shall appraise the dossier and issue the Business License for Civil Cryptography Products and Services. In case of license refusal, the Government Cipher Committee shall notify in writing and clearly state the reasons.

Processing time

01 working day to inspect and notify the validity of the dossier;
03 working days for the enterprise to supplement the dossier in case of a request;
03 working days to notify in writing the reasons for refusing to grant the license, in cases where the amendment or supplementation still fails to meet requirements or exceeds the completion deadline;
12 working days from the date of receiving a complete and valid dossier for the Government Cipher Committee to appraise and issue the License.

Dossier for requesting a Business License for civil cryptography products and services

Application form for the issuance of a Business License for civil cryptography products and services;
Copies of degrees or professional certificates in security or information security of the management, executive, and technical teams;
Technical plan including: characteristics and technical parameters of the product; technical standards and regulations of the product; service standards and quality; technical measures and solutions; product warranty and maintenance plans.

The dossier consists of 01 set, submitted directly, via postal service, or through the National Public Service Portal to the Government Cipher Committee. Online submissions must be digitally signed in accordance with the law on digital signatures.

Modification, supplementation, temporary suspension, and revocation of Licenses

License modification

Applicable when an enterprise that has been granted a License wishes to change its name or change its legal representative.

Processing time: 05 working days from the date of receiving a complete and valid dossier.

License supplementation

Applicable when an enterprise wishes to change or supplement civil cryptography products and services.

Processing time: 09 working days from the date of receiving a complete and valid dossier.

Temporary suspension and revocation of Licenses

An enterprise may have its business operations temporarily suspended (for no more than 06 months) in the following cases:

Providing products and services inconsistent with the contents of the License;
No longer meeting the licensing conditions;
Falsifying dossiers or providing untrue information in documents for license application; erasing or altering contents of the License;
Failing to deploy services within 01 year from the date of licensing without a legitimate reason; the License expires; or ceasing the business of civil cryptography products and services.

Or have its Business license for civil cryptography products and services revoked in the following cases:

Falsifying dossiers or providing untrue information in documents for license application; erasing or altering contents of the License;
The License was granted beyond authority, or in violation of dossiers and procedures as prescribed;
Failing to deploy the provision of services within the time limit of 01 year from the date of being granted the License without a legitimate reason;
The License has expired;
Failure to remedy the causes of suspension within the temporary suspension period;
Ceasing the business of civil cryptography products and services.

Checklist for Enterprises — Business License for civil cryptography products and services

Step 1. Review and classify products/services: Cross-check the entire portfolio of products and services currently or intended to be traded against the Catalog of Civil Cryptography Products and Services in Appendix I of Decree No. 341/2026/NĐ-CP; simultaneously check whether the products belong to the 12 groups excluded from conditional management;

Step 2. Determine the scope of license registration: The application form includes 02 separate categories — the catalog of civil cryptography products and the catalog of civil cryptography services — enterprises must clearly define whether they are registering for products, services, or both, along with the corresponding scope, subjects, and fields of provision;

Step 3. Check personnel and facility conditions: Review prior to dossier submission to ensure compliance with the conditions under Article 5.1 of Decree No. 341/2026/NĐ-CP regarding technical officers, managerial officers, physical and technical infrastructure, and technical plans compliant with technical standards and regulations;

Step 4. Standardize technical dossiers: Prepare the application form, copies of degrees/professional certificates of the personnel team, and the technical plan describing the characteristics and technical parameters of the product, applicable standards/regulations, and warranty and maintenance plans;

Step 5. Review post-licensing obligations: Establish an internal mechanism to maintain business conditions; ensure civil cryptography products are certified and declared compliant before circulation; retain and secure customer information; report to the Government Cipher Committee before December 31st annually regarding business operations and customer information summaries.

Note: The license has a validity period of 10 years; when there is a need to change the name, legal representative, or add new products/services, the enterprise must complete corresponding modification or supplementation procedures and must not arbitrarily conduct business outside the scope of the granted license.

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Procedure for issuing a business License for civil cryptography products and services

What are “civil cryptographic products” and “civil cryptographic services”?

Civil cryptographic products: These are hardware, software, documents, technical equipment, and cryptographic professional equipment designed and manufactured to protect information.

Civil cryptographic services: These comprise information protection services using civil cryptographic products; civil cryptographic product assessment services; and security and cybersecurity consulting services using civil cryptographic products.

Must foreign enterprises providing services in Viet Nam store data in Viet Nam?

Yes. The law provides that domestic and foreign enterprises providing services on telecommunications networks, the Internet, and value-added services in cyberspace in Viet Nam, if they engage in the collection, exploitation, analsys, or processing of the categories of data within the scope prescribed by the Law, may be required to store such data in Viet Nam for a period prescribed by the Government.

Is the provision of cybersecurity inspection and assessment service a conditional business line?

Yes. The Law lists “cybersecurity inspection and assessment services” within the group of cybersecurity services. In addition, there are other services such as information security using civil cryptography, civil cryptography, cybersecurity consulting, cybersecurity monitoring, incident response, data recover, cyberattack prevention and combat, and other cybersecurity services.

According to Article 29, enterprises trading in cyber security products and services must have a license to trade in cyber security products and services, and at the same time must meet the responsibilities of maintaining business conditions, service quality, confidentiality of customer information, managing records and coordinating with specialized forces when required.

Why are civil cryptographic products required to be inspected, certified and declared conformity before commercial circulation?

Mandatory requirements: Civil cryptography products must be inspected and certified for conformity before being circulated on the market to ensure the quality of cryptography meets standards

Management mechanism: The Government Cipher Committee is responsible for managing the quality of civil cryptography products and services through the appointment and management of activities of civil cryptography conformity assessment and certification organizations

This helps protect end users from products that contain dangerous encryption vulnerabilities or are installed with spyware and protect national security in cyberspace.

What are the necessary and sufficient conditions for an enterprise to be granted a license to export and import civil cryptographic products?

According to Article 10, Clause 1, the enterprise must fully meet the following 03 mandatory conditions:

Having a valid license to trade in corresponding civil cryptographic products and services.
Imported civil cryptographic products must be certified and declared technical-regulation conformity according to Vietnamese technical standards.
The objects to which the products are transferred and the purpose of using these civil cryptographic products do not harm national defense and security and social order and safety.