I. Legal Basis

• Law on Cybersecurity No. 116/2025/QH15, effective from July 01, 2026.

• Decree No. 332/2026/ND-CP detailing regulations on the business of cybersecurity products and services.

• Law No. 03/2022/QH15 amending and supplementing a number of articles of the Law on Public Investment, the Law on Public-Private Partnership Investment, the Law on Investment, the Law on Housing, the Law on Bidding, the Law on Electricity, the Law on Enterprises, the Law on Special Excise Tax, and the Law on Civil Judgment Enforcement.

• Other relevant legal documents currently in force.

II. Conditions for doing business in cybersecurity products and services

Pursuant to Articles 6, 7, and 8 of Decree 332/2026/ND-CP, an enterprise must satisfy the following conditions:

• General conditions for doing business in cybersecurity products and services:

– Legal status: The enterprise must be lawfully established in Vietnam and have no violations of regulations in the field of cybersecurity business.

– Operation term (applicable to foreign-invested enterprises): The investment term in Vietnam must have more than 05 years remaining from the date of issuance of the License for trading in cybersecurity products and services.

– Personnel:

+ The legal representative and managers must have a judicial record that meets statutory requirements: not being subject to criminal prosecution, having no unspent criminal convictions, etc.

+ Personnel in charge of technical matters: must possess a bachelor’s degree or higher, or specialized certificates in cybersecurity, information security, information technology, or electronics and telecommunications.

– Technical conditions: Having a system of equipment, material facilities, and technology suitable for the investment and business activities and the types of cybersecurity products and services registered for business.

• Specific conditions for trading in cybersecurity products:

– The product categories must conform to development strategies, accompanied by a suitable business plan, means, and equipment in accordance with cybersecurity technical standards.

– For the import and export of cybersecurity products: There must be clear purposes and end-users, along with a commitment not to prejudice national security.

• Specific conditions for providing cybersecurity services:

– Having a technical plan that meets cybersecurity requirements – Form No. 07 in Appendix I of Decree 332/2026/ND-CP.

– Having a contingency plan to ensure the maintenance of safe and continuous operations and incident response.

– Having a comprehensive description of the technical features of the cybersecurity monitoring system; and the cybersecurity monitoring operation process.

– Having a suitable business plan that includes the following contents: Scope and subjects of service provision, types of services intended to be provided, customer information confidentiality plan, and service quality assurance plan.

III. Application dossier for the License for trading in cybersecurity products and services

• An application form in accordance with Form No. 03 – Appendix I of Decree 332/2026/ND-CP;

• Curriculum vitae attached with personal identification documents of the legal representative and the enterprise’s managers;

• Diplomas, certificates, or equivalent documents recognized by laws on education and training to prove the fulfillment of personnel conditions;

• Explanatory documents on the system of equipment, material facilities, and technology suitable for the registered business activities, products, and services;

• Technical plan and business plan: Form No. 07, Form No. 08 – Appendix I of Decree 332/2026/ND-CP.

IV. Procedures for applying for the License for trading in cybersecurity products and services

• Step 1: Review the enterprise’s conditions for doing business in cybersecurity products and services.

• Step 2: Prepare and submit the application dossier.

– Licensing authority: Ministry of Public Security (MPS).

– Processing time: Within 28 working days from the date of receipt of a valid and complete dossier.

– License validity: 10 years from the date of issuance.

• Step 3: The Ministry of Public Security appraises the dossier and issues the License for trading in cybersecurity products and services.

• Step 4: Receive the License and deliver it to the Client.

The above is our entire article on the Procedures for applying for a License to trade in cybersecurity products and services. Should Clients require further detailed consultation, clarification, or wish to engage our services, please contact Lawyer Nguyen Duc Trong directly via hotline: 0912.35.65.75, or send a service request via email: lawyer@hongbanglawfirm.com.

Wishing our Clients and your families good health, peace, and success!

Best regards, Hong Bang Law Firm./.