1. Scope of Regulation of Circular No. 47 and QCVN 12

- Applicable to Information Systems Storing Electronic Documents Not Containing State Secrets: This Technical Regulation specifies in detail the technical standards for the management, operation, and cybersecurity protection of information systems used to store electronic documents of Party and State agencies that do not contain information classified as state secrets.

- Non-Applicability to Documents Containing State Secrets and Cipher Sectors: Technical Regulation QCVN 12:2026/BCA excludes all information systems storing electronic documents that contain information classified as state secrets. Concurrently, security and authentication solutions in archiving operations under state management of ciphers and specialized digital signatures for official use fall outside the scope of regulation of this document. (Legal basis: Sections 1.1 and 1.2 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

2. Core Technical Requirements Mandated for Agencies and Units

- Periodic Cybersecurity Risk Management: System owners of Level 3, 4, and 5 information systems are required to establish a structured cybersecurity risk management process, archive evaluation results into dossiers, and conduct periodic reviews and updates at least 01 time per year or upon significant changes in system architecture. Risk analysis must encompass storage media (including both primary and backup media) to verify security compatibility levels. (Legal basis: Section 2.2.1 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

- Data Integrity Protection via Automated Hashing: The system must ensure that document structure and content are not unlawfully altered from the moment of receipt. The Regulation mandates the use of secure hashing algorithms to generate a unique hash value for each document, store hash values in the database, and run automated periodic scans to compare current hash values against original values, detecting unauthorized tampering and triggering automated recovery. (Legal basis: Section 2.2.5 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

- Strict Backup Rules: For Level 3, 4, and 5 systems, system owners must retain a minimum of 03 backup copies of the same information. These backup copies must be stored on at least 02 different storage media with geographical separation. Crucially, at least 01 backup copy must be written on Write Once Read Many (WORM) non-rewritable media located outside the primary data facility and subject to complete physical isolation (air-gap). (Legal basis: Section 2.2.12 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

- Immutable Audit Log Management via WORM/Immutable Technologies: Logs recording system access and operation history must be protected for integrity using Write Once Read Many (WORM) technology, object locking, or immutable storage infrastructure to eliminate any possibility of unauthorized modification or trace erasure. Audit logs must fully retain source address, destination address, service account, and timestamp information for a minimum period of 12 months. (Legal basis: Section 2.2.9 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

3. Stringent Regulations for Product, Service, and Cloud Storage Providers

- Mandatory Physical Infrastructure Location in Vietnam: Cybersecurity product/service and information storage providers must possess transparent legal entity status, corporate electronic identification, and mandatory legal representatives, branches, or representative offices operating within Vietnam. For cloud storage services, service providers must execute a written agreement committing to locate all physical infrastructure (servers, storage equipment) and data centers within Vietnam. (Legal basis: Section 2.2.16 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

- Prohibition of Automated "Call-Home" Software and Strict Remote Connection Controls: The Technical Regulation strictly prohibits devices and software from automatically initiating remote connections or transmitting diagnostic data back to foreign manufacturers (call-home mechanisms). Any remote technical support connection by providers must be granted time-bound authorization, adhere to the principle of least privilege, enforce Multi-Factor Authentication (MFA), and be continuously monitored. (Legal basis: Section 2.2.16 of QCVN 12:2026/BCA issued attached to Circular No. 47/2026/TT-BCA)

4. Immediate Actions Required for Enterprises and State Agencies

Faced with the rigorous and legally binding technical standards of QCVN 12:2026/BCA, Party and State agencies, alongside the IT business community offering storage solutions, must act without delay. To ensure compliant system operations and eliminate non-compliance liabilities, entities must immediately execute the following steps:

- Assess and Classify System Levels: Review all existing document storage information systems within the unit to accurately determine the management level (Levels 1 to 5), thereby identifying the mandatory completion deadline (12 months or 18 months).

- Re-architect Data Security Infrastructure: Immediately integrate automated hashing algorithms to safeguard document integrity, activate Write Once Read Many (WORM) mechanisms to protect system logs, and establish redundant storage infrastructure strictly adhering to the "3 copies, 2 media types, 1 air-gapped copy" model.

- Standardize Vendor Control Processes: Work with storage providers to review contractual terms, enforce commitments regarding physical server locations in Vietnam, close all unauthorized background "call-home" ports on equipment, and establish access policies enforced via Multi-Factor Authentication (MFA).

Strict compliance with QCVN 12:2026/BCA is not merely a statutory obligation to maintain operational legality, but a vital imperative to establish an advanced security barrier protecting the nation's "digital assets and records" against large-scale cyberattacks.