The business of civil cryptographic products and services is a conditional business sector aimed at ensuring information security and safety in the provision and use of products and services that protect information through cryptographic techniques. Under Vietnamese law, enterprises conducting business in civil cryptographic products and services falling within the regulated list are required to obtain a Business License before commencing operations. What conditions must an enterprise satisfy to obtain a Business License for civil cryptographic products and services? What documents are required, and what procedures must be followed to obtain such License?
In this article, Hong Bang Law Firm provides detailed information on the conditions, required documents, and procedures for obtaining a Business License for civil cryptographic products and services in accordance with the prevailing regulations.
LEGAL BASIS
- Law on Cybersecurity No. 116/2025/QH15;
- Law on Cyber Information Security No. 86/2015/QH13;
- Decree No. 341/2026/ND-CP dated September 01, 2026 of the Government detailing certain articles of and providing measures for implementation of the Law on Cybersecurity regarding civil cryptographic activities;
- Decree No. 211/2025/ND-CP dated July 25, 2025 of the Government on civil cryptographic activities and amending and supplementing certain articles of Decree No. 15/2020/ND-CP dated February 03, 2020 of the Government on penalties for administrative violations in the fields of post, telecommunications, radio frequencies, information technology and electronic transactions, as amended and supplemented by Decree No. 14/2022/ND-CP dated January 27, 2022.
CIVIL CRYPTOGRAPHIC PRODUCTS AND SERVICES
Civil cryptographic products include:
- Products for generating, managing or storing cryptographic keys;
- Products for securing stored data;
- Products for securing data exchanged over networks;
- IP traffic security products;
- Analog and digital voice security products;
- Wireless information security products;
- Fax and telegraph security products.
Civil cryptographic services include:
- Information protection services using civil cryptographic products;
- Civil cryptographic product assessment services;
- Security and network information security consulting services using civil cryptographic products.
CONDITIONS FOR OBTAINING A BUSINESS LICENSE FOR CIVIL CRYPTOGRAPHIC PRODUCTS AND SERVICES
An enterprise may be granted a Business License if it fully satisfies the following conditions:
1. Personnel requirements
The enterprise must have:
- At least 02 technical staff members holding a bachelor’s degree or higher in one of the following fields: electronics and telecommunications, information technology, mathematics, or information security;
- 01 management or executive staff member holding a bachelor’s degree in one of the above-mentioned fields, or holding a bachelor’s degree in another field together with a certificate in information security and protection.
2. Facilities and equipment requirements
The enterprise must have equipment systems and facilities appropriate to the scope, target users, and field of provision of civil cryptographic products and services.
3. Technical plan requirements
The enterprise must have a technical plan conforming to the applicable standards and technical regulations for civil cryptographic products and services.
In addition, civil cryptographic products must undergo inspection and conformity certification before being placed on the market in accordance with applicable regulations.
REQUIRED DOCUMENTS
An application dossier for a new Business License for civil cryptographic products and services includes:
- An application for the Business License according to Form No. 01 of Appendix III issued together with Decree No. 341/2026/ND-CP;
- Copies of professional degrees or certificates in security and information security of the management, executive and technical personnel;
- A technical plan according to Form No. 03 of Appendix III, specifying:
- Technical characteristics and technical parameters of the products;
- Applicable standards and technical regulations;
- Service standards and quality;
- Technical measures and solutions;
- Product warranty and maintenance plans.
The application dossier shall be prepared in 01 set and submitted directly, by postal service, or online through the National Public Service Portal. An online application must be digitally signed in accordance with applicable regulations.
COMPETENT AUTHORITY
The Government Cipher Committee is competent to grant Business Licenses for civil cryptographic products and services.
The specialized authority responsible for receiving and appraising applications is the Authority for Civil Cryptography Management and Cryptographic Product Certification, under the Government Cipher Committee.
PROCEDURES
Step 1: Preparation and submission of the application
The enterprise prepares 01 set of documents as prescribed and submits the application directly, by post, or online to the Government Cipher Committee.
Step 2: Verification of the validity of the application
Within 01 working day from the date of receipt of the application, the Government Cipher Committee shall verify its validity.
If the application is invalid, the competent authority shall notify the enterprise in writing of the documents and contents requiring amendment or supplementation.
The enterprise shall complete the application within 03 working days from the date of receipt of such notice.
If the amended or supplemented application remains non-compliant, or the enterprise fails to complete the application within the prescribed time limit, the Government Cipher Committee shall, within 03 working days, issue a written notice specifying the reasons for refusal to grant the Business License.
Step 3: Appraisal and issuance of the Business License
Within 12 days from the date of receipt of a complete and valid application, the Government Cipher Committee shall appraise the application and grant the Business License for civil cryptographic products and services.
In case of refusal to grant the License, the competent authority shall notify the enterprise in writing and clearly state the reasons.
PROCESSING TIME
The total processing time for the issuance of a new Business License is 12 days from the date of receipt of a complete and valid application, excluding the time required for the enterprise to amend or supplement the application at the request of the competent authority.
FEES
An enterprise granted a Business License for civil cryptographic products and services shall pay the applicable fees in accordance with the laws on fees and charges.
VALIDITY OF THE BUSINESS LICENSE
The Business License for civil cryptographic products and services is valid for 10 years from the date of issuance.
KEY NOTES FOR ENTERPRISES
- The enterprise should accurately determine whether the products and services it intends to provide fall within the list of civil cryptographic products and services subject to licensing requirements.
- Personnel documents must satisfy the requirements concerning relevant educational qualifications and professional certificates.
- The technical plan should be prepared in accordance with the actual characteristics of each product or service and the relevant applicable standards and technical regulations.
- Where a product has both civil cryptographic and cybersecurity functions, the enterprise should determine the applicable licensing mechanism. For dual-use products falling within the cases regulated by Decree No. 341/2026/ND-CP, the Ministry of Public Security shall grant the Business License for cybersecurity products and services after obtaining opinions from the Government Cipher Committee regarding the civil cryptographic functions of such products.
- Licenses granted before July 01, 2026 shall remain valid until the expiry date specified therein in accordance with the transitional provisions of Decree No. 341/2026/ND-CP.
The above is our complete article on Procedures for Obtaining a Business License for Civil Cryptographic Products and Services. Should you require further advice or detailed clarification, or wish to learn more about how to access this service, please contact Lawyer Nguyen Duc Trong via hotline: 0912.35.65.75*, or send your service request to email:* lawyer@hongbanglawfirm.com.
We wish you and your family good health and continued success!
Sincerely,
