92

CNG BO/S 119 + 120 ngy 10-3-2011

NGN HNG NH NC VIT NAM
NGN HNG NH NC
VIT NAM
_________
S: 01/2011/TT-NHNN
CNG HA X HI CH NGHA VIT NAM
c lp - T do - Hnh phc
_________________________
H Ni, ngy 21 thng 02 nm 2011
THNG T
Quy nh vic m bo an ton, bo mt h thng
cng ngh thng tin trong hot ng ngn hng

Cn c Lut Ngn hng Nh n c Vit Nam s 46/2010/QH12 ngy 16/6/2010;
Cn c Lut Cc T chc tn dng s 47/2010/QH12 ngy 16/6/2010;
Cn c Lut Cng ngh thng tin s 67/2006/QH11 ngy 29/6/2006;
Cn c Ngh nh s 96/2008/N-CP ngy 26/8/2008 ca Chnh ph quy nh
chc nng, nhim v, quyn hn v c cu t chc ca Ngn hng Nh nc Vit
Nam;
Ngn hng Nh nc Vit Nam quy nh v vic m bo an ton, bo mt h
thng cng ngh thng tin trong hot ng ngn hng nh sau:
Chng I
QUY NH CHUNG
iu 1. Phm vi iu chnh v i tng p dng
1. Thng t ny quy nh cc yu cu m bo an ton, bo mt h thng cng
ngh thng tin (CNTT) trong hot ng ngn hng.
2. Thng t ny p dng i vi Ngn hng Nh nc Vit Nam; cc t chc tn
dng; chi nhnh ngn hng nc ngoi (sau y gi chung l n v).
iu 2. Gii thch t ng
Trong Thng t ny, cc t ng di y c hiu nh sau:
CNG BO/S 119 + 120 ngy 10-3-2011 93
1. H thng cng ngh thng tin: l mt tp hp c cu trc cc trang thit b
phn cng, phn mm, c s d liu v h thng mng phc v cho mt hoc nhiu
hot ng k thut, nghip v ca ngn hng.
2. Ti sn CNTT: l cc trang thit b, thng tin thuc h thng CNTT ca n
v. Bao gm:
a) Ti sn vt l: l cc thit b CNTT, phng tin truyn thng v cc thit b
phc v cho hot ng ca h thng CNTT;
b) Ti sn thng tin: l cc d liu, ti liu lin quan n h thng CNTT. Ti
sn thng tin c th hin bng vn bn giy hoc d liu in t;
c) Ti sn phn mm: bao gm cc chng trnh ng dng, phn mm h thng,
c s d liu v cng c pht trin.
3. Ri ro CNTT: l kh nng xy ra tn tht khi thc hin cc hot ng lin quan
n h thng CNTT. Ri ro CNTT lin quan n qun l, s dng phn cng, phn
mm, truyn thng, giao din h thng, vn hnh v con ngi.
4. Qun l ri ro: l cc hot ng phi hp nhm xc nh v kim sot cc ri
ro CNTT c th xy ra.
5. Bn th ba: l cc t chc, c nhn c chuyn mn c n v thu hoc hp
tc vi n v nhm cung cp hng ha, dch v k thut cho h thng CNTT.
6. H thng an ninh mng: l tp hp cc thit b tng la; thit b kim sot,
pht hin truy cp bt hp php; phn mm qun tr, theo di, ghi nht k trng thi
an ninh mng v cc trang thit b khc c chc nng m bo an ton hot ng ca
mng, tt c cng hot ng ng b theo mt chnh sch an ninh mng nht qun
nhm kim sot cht ch tt c cc hot ng trn mng.
7. Tng la: l tp hp cc thnh phn hoc mt h thng cc trang thit b,
phn mm c t gia hai mng, nhm kim sot tt c cc kt ni t bn trong ra
bn ngoi mng hoc ngc li.
8. Vi rt: l chng trnh my tnh c kh nng ly lan, gy ra hot ng khng
bnh thng cho thit b s hoc sao chp, sa i, xa b thng tin lu tr trong
thit b s.
9. Phn mm c hi (m c): l cc phn mm c tnh nng gy hi nh vi rt,
phn mm do thm (spyware), phn mm qung co (adware) hoc cc dng tng
t khc.
94
CNG BO/S 119 + 120 ngy 10-3-2011
10. im yu k thut: l v tr trong h thng CNTT d b tn thng khi b tn
cng hoc xm nhp bt hp php.
iu 3. Nguyn tc chung
1. Tng n v phi m bo an ton, bo mt h thng CNTT ca n v mnh
theo cc quy nh ti Thng t ny.
2. Kp thi nhn bit, phn loi, nh gi v x l c hiu qu cc ri ro CNTT
c th xy ra trong n v.
3. Xy dng, trin khai quy ch an ton, bo mt h thng CNTT trn c s hi
ha gia li ch, chi ph v mc chp nhn ri ro ca n v.
4. B tr ngun lc c cht lng ph hp vi quy m nhm m bo an ton,
bo mt h thng CNTT.
5. Xc nh r quyn hn, trch nhim ca th trng n v, cc cp, cc b
phn v tng c nhn trong n v i vi cng tc m bo an ton, bo mt h
thng CNTT.
iu 4. Quy ch an ton, bo mt h thng CNTT
1. Cc n v phi xy dng quy ch an ton, bo mt h thng CNTT ph
hp vi h thng CNTT, c cu t chc, yu cu qun l v hot ng ca n
v. Quy ch an ton, bo mt h thng CNTT phi c th trng n v ph
duyt, t chc thc hin v c trin khai ti tt c cc cn b, nhn vin v
cc bn lin quan.
2. Quy ch an ton, bo mt h thng CNTT phi bao gm cc quy nh c
bn v:
a) Qun l ti sn CNTT;
b) Qun l ngun nhn lc;
c) Quy nh v vt l v mi trng;
d) Quy nh v truyn thng v vn hnh;
) Qun l truy cp;
e) Tip nhn, pht trin, duy tr h thng thng tin;
g) Qun l s c;
h) Lu tr v d phng thm ha.
CNG BO/S 119 + 120 ngy 10-3-2011 95
3. nh k, n v phi r sot, chnh sa, hon thin quy ch an ton, bo mt
h thng CNTT ti thiu mi nm mt ln, m bo s ph hp, y v c hiu
qu ca quy ch. Trong trng hp pht hin nhng bt cp, bt hp l gy ra mt
an ton h thng CNTT hoc theo yu cu ca c quan c thm quyn, n v phi
tin hnh chnh sa, b sung ngay quy ch ca mnh.
Chng II
CC QUY NH V M BO AN TON, BO MT
H THNG CNG NGH THNG TIN
Mc 1
T CHC M BO AN TON, BO MT CNTT
iu 5. Qun l an ton, bo mt CNTT trong ni b n v
1. Th trng n v phi trc tip ch o cng tc m bo an ton, bo mt
CNTT v quy nh r trch nhim trong cng tc m bo an ton, bo mt CNTT
cho cc c nhn, b phn.
2. Cc c nhn trong n v lin quan n bo mt thng tin phi k cam kt bo
mt thng tin.
iu 6. Qun l an ton, bo mt CNTT ca n v i vi bn th ba
1. nh gi v nng lc k thut, nhn s, kh nng ti chnh ca bn th ba
trc khi k kt hp ng cung cp hng ha, dch v.
2. Xc nh r trch nhim, quyn hn v ngha v ca cc bn v an ton, bo
mt CNTT khi k hp ng. Hp ng vi bn th ba phi bao gm cc iu khon
v vic x pht i vi bn th ba do vi phm quy nh an ton, bo mt thng tin
v trch nhim phi bi thng thit hi ca bn th ba trong trng hp c thit hi
do hnh vi vi phm ca bn th ba gy ra.
3. c bit ch n cc vn v tnh b mt, tnh ton vn, tnh sn sng, tin
cy, hiu nng ti a, kh nng phc hi thm ha, phng tin lu tr ca h thng
thng tin.
4. Xc nh y cc ri ro ca n v lin quan ti cc bn th ba c th pht
sinh v p dng cc bin php qun l ri ro.
96
CNG BO/S 119 + 120 ngy 10-3-2011
5. p dng cc bin php gim st cht ch v gii hn quyn truy cp ca bn
th ba khi cho php h truy cp vo h thng CNTT ca n v.
Mc 2
QUN L TI SN CNTT
iu 7. Xc nh trch nhim i vi ti sn CNTT
1. Thng k, kim k cc loi ti sn CNTT ti n v mi nm ti thiu mt ln.
Ni dung thng k ti sn phi bao gm cc thng tin: Loi ti sn, gi tr, mc
quan trng, v tr lp t, thng tin d phng, thng tin v bn quyn.
2. Phn loi, sp xp th t u tin theo gi tr, mc quan trng ca ti sn
CNTT c bin php bo v ti sn ph hp. Xy dng v thc hin cc quy nh
v qun l, s dng ti sn.
3. Gn quyn s dng ti sn cho cc c nhn hoc b phn c th. Ngi s
dng ti sn CNTT phi tun th cc quy nh v qun l, s dng ti sn, m bo
ti sn c s dng ng mc ch.
iu 8. Phn loi ti sn thng tin
1. Phn loi ti sn thng tin theo cc tiu ch v gi tr, nhy cm v tm
quan trng, tn sut s dng, thi gian lu tr.
2. Thc hin cc bin php qun l ph hp vi tng loi ti sn thng tin
phn loi.
Mc 3
QUN L NGUN NHN LC
iu 9. Qun l ngun nhn lc ni b ca n v
1. Trc khi tuyn dng hoc phn cng nhim v
a) Xc nh trch nhim v an ton, bo mt CNTT ca v tr cn tuyn dng
hoc phn cng;
b) Kim tra l lch, xem xt nh gi nghim ngt t cch o c, trnh
chuyn mn khi tuyn dng, phn cng cn b, nhn vin lm vic ti cc v tr trng
yu ca h thng CNTT nh qun tr h thng, qun tr h thng an ninh bo mt,
vn hnh h thng, qun tr c s d liu;
CNG BO/S 119 + 120 ngy 10-3-2011 97
c) Quyt nh hoc hp ng tuyn dng (nu c) phi bao gm cc iu khon
v trch nhim m bo an ton, bo mt CNTT ca ngi c tuyn dng trong
v sau khi lm vic ti n v.
2. Trong thi gian lm vic
a) n v c trch nhim ph bin v cp nht cc quy nh v an ton, bo mt
CNTT cho cn b, nhn vin;
b) Yu cu v kim tra vic thi hnh cc quy nh v an ton, bo mt CNTT ca
c nhn, t chc thuc n v ti thiu mi nm mt ln;
c) p dng cc bin php k lut i vi cn b, nhn vin ca n v vi phm
quy nh an ton, bo mt CNTT;
d) Nhng cng vic quan trng nh cu hnh h thng an ninh mng, thay
i tham s h iu hnh, ci t thit b tng la, thit b pht hin v ngn
chn xm nhp (IPS) phi c thc hin bi t nht hai ngi hoc phi c
ngi gim st;
) Khng c cp quyn qun tr (ngi c th chnh sa cu hnh, d liu,
nht k) trn h thng CNTT chnh v h thng d phng cho cng mt c nhn.
3. Khi chm dt hoc thay i cng vic
Khi cn b, nhn vin chm dt hoc thay i cng vic, n v phi:
a) Xc nh r trch nhim ca cn b, nhn vin v cc bn lin quan v h
thng CNTT;
b) Lm bin bn bn giao ti sn vi cn b, nhn vin;
c) Thu hi hoc thay i quyn truy cp h thng CNTT ca cn b, nhn vin
cho ph hp vi cng vic c thay i.
iu 10. Qun l ngun nhn lc bn th ba
1. Trc khi trin khai cng vic
a) Yu cu bn th ba cung cp danh sch nhn s tham gia;
b) Kim tra t cch php l, nng lc chuyn mn ca nhn s bn th ba ph
hp vi yu cu cng vic;
c) Yu cu bn th ba k cam kt khng tit l thng tin ca n v i vi cc
thng tin quan trng.
98
CNG BO/S 119 + 120 ngy 10-3-2011
2. Trong thi gian trin khai cng vic
a) Cung cp v yu cu bn th ba tun th y cc quy ch, quy nh v an
ton, bo mt CNTT ca n v;
b) Gim st vic tun th cc quy nh an ton, bo mt CNTT ca nhn s bn
th ba;
c) Trong trng hp pht hin du hiu vi phm hoc vi phm quy nh an ton,
bo mt thng tin ca bn th ba, n v cn:
- Tm dng hoc nh ch hot ng ca bn th ba ty theo mc vi phm;
- Thng bo chnh thc cc vi phm v an ton, bo mt CNTT ca nhn s cho
bn th ba;
- Kim tra xc nh, lp bo co mc vi phm v thng bo cho bn th ba
thit hi xy ra;
- Thu hi quyn truy cp h thng CNTT c cp cho bn th ba.
3. Khi kt thc cng vic
a) Yu cu bn th ba bn giao li ti sn s dng ca n v trong qu trnh
trin khai cng vic;
b) Thu hi quyn truy cp h thng CNTT c cp ca bn th ba ngay sau
khi kt thc cng vic;
c) Thay i cc kha, mt khu nhn bn giao t bn th ba.
Mc 4
BO M AN TON V MT VT L V MI TRNG
iu 11. An ton vt l v mi trng
1. Cc khu vc x l, lu gi thng tin v phng tin x l thng tin phi c
bo v an ton bng tng bao, cng ra vo c kim sot.
2. Cc khu vc c yu cu cao v an ton, bo mt nh phng my ch phi p
dng bin php kim sot ra vo thch hp, m bo ch nhng ngi c nhim v
mi c vo khu vc .
3. C bin php bo v phng chng nguy c do chy n, ngp lt, ng t v
cc thm ha khc do thin nhin v con ngi gy ra. Phng my ch phi m bo
CNG BO/S 119 + 120 ngy 10-3-2011 99
v sinh cng nghip: Khng dt, khng thm nc; cc trang thit b lp t trn sn
k thut, khng b nh nng chiu ri trc tip; m, nhit t tiu chun quy
nh cho cc thit b v my ch; trang b y thit b phng chng chy, n, l
lt, h thng chng st.
4. C ni quy, hng dn lm vic trong khu vc an ton, bo mt.
5. Khu vc s dng chung, phn phi, chuyn hng phi c kim sot v cch
ly vi khu vc an ton, bo mt.
iu 12. An ton, bo mt ti sn CNTT
1. Ti sn CNTT phi c b tr, lp t ti cc a im an ton v c bo
v gim thiu nhng ri ro do cc e da, him ha t mi trng v cc xm
nhp tri php.
2. Ti sn CNTT phi c bo m v ngun in v cc h thng h tr khi
ngun in chnh b gin on. Phi c bin php chng qu ti hay st gim in
p, chng st lan truyn; c h thng tip t; c h thng my pht in d phng
v h thng lu in m bo thit b hot ng lin tc.
3. Dy cp cung cp ngun in v dy cp truyn thng s dng trong truyn
ti d liu hay nhng dch v h tr thng tin phi c bo v khi s xm phm
hoc h hi.
4. Tt c cc thit b lu tr d liu phi c kim tra m bo cc d
liu quan trng v phn mm c bn quyn lu tr trn thit b c xa b hoc
ghi khng c kh nng khi phc trc khi loi b hoc ti s dng cho mc
ch khc.
5. Ti sn CNTT ch c a ra bn ngoi n v khi c s cho php ca cp
c thm quyn.
6. Cc trang thit b dng cho hot ng nghip v lp t bn ngoi tr s ca
n v phi c bin php gim st, bo v an ton phng chng truy cp bt hp
php.
Mc 5
QUN L VN HNH V TRUYN THNG
iu 13. Quy trnh vn hnh
100
CNG BO/S 119 + 120 ngy 10-3-2011
1. Ban hnh v trin khai quy trnh vn hnh cc h thng CNTT n ngi s
dng bao gm: Quy trnh bt, tt thit b; quy trnh sao lu, phc hi d liu; quy
trnh bo dng thit b; quy trnh vn hnh ng dng; quy trnh x l s c.
2. Kim sot s thay i ca h thng CNTT gm: Phin bn phn mm, cu
hnh phn cng, ti liu, quy trnh vn hnh; c phng n d phng cho vic phc
hi nu s thay i khng thnh cng hoc gp cc s c khng d tnh c; ghi
chp li cc thay i; lp k hoch thc hin v kim tra, th nghim s thay i
trc khi p dng chnh thc.
3. H thng vn hnh chnh thc phi p ng yu cu:
- Tch bit vi mi trng pht trin v mi trng kim tra, th nghim.
- Ch cho php kt ni Internet i vi h thng CNTT c p dng y
cc gii php an ninh, an ton v kh nng bo v trc cc him ha, tn cng
t bn ngoi.
- Khng ci t cc cng c, phng tin pht trin ng dng trn h thng vn
hnh chnh thc.
4. i vi h thng thng tin nghip v:
a) Khng mt c nhn lm ton b cc khu t khi to n ph duyt mt
giao dch nghip v;
b) Mi tc v trn h thng c lu vt, sn sng cho kim tra, kim sot khi
cn thit.
iu 14. Qun l cc dch v do bn th ba cung cp
1. Phi gim st v kim tra cc dch v do bn th ba cung cp m bo mc
cung cp dch v, kh nng hot ng h thng p ng ng theo tha thun
k kt.
2. m bo trin khai, duy tr cc bin php an ton, bo mt ca dch v do bn
th ba cung cp theo ng tha thun.
3. Qun l cc thay i i vi cc dch v ca bn th ba cung cp bao gm:
Nng cp phin bn mi; s dng cc k thut mi, cc cng c v mi trng pht
trin mi. nh gi y tc ng ca vic thay i, m bo an ton khi c
a vo s dng.
CNG BO/S 119 + 120 ngy 10-3-2011 101
iu 15. Qun l vic lp k hoch v chp nhn h thng CNTT
1. Gim st v ti u hiu sut ca h thng CNTT; lp k hoch v hiu sut,
dung lng ca h thng CNTT trong tng lai nhm m bo tiu chun cn thit.
2. Xy dng cc yu cu, tiu chun nh hiu nng, thi gian phc hi khi gp
s c, m bo tnh lin tc; o to v chuyn giao k thut i vi nhng ni dung
thay i cho ngi s dng v thc hin kim tra nh gi kh nng p ng ca h
thng CNTT mi hoc h thng nng cp trc khi p dng chnh thc.
iu 16. Sao lu d phng
1. Ban hnh v thc hin quy trnh sao lu d phng v phc hi cho cc phn
mm, d liu cn thit.
2. Lp danh sch cc d liu, phn mm cn c sao lu, c phn loi theo thi
gian lu tr, thi gian sao lu, phng php sao lu v thi gian kim tra phc hi
h thng t d liu sao lu.
3. D liu sao lu phi c lu tr an ton v c kim tra thng xuyn m
bo sn sng cho vic s dng khi cn. Kim tra, phc hi h thng t d liu sao
lu ti thiu su thng mt ln.
iu 17. Qun l v an ton, bo mt mng
1. Thc hin vic qun l v kim sot mng nhm ngn nga cc him ha v
duy tr an ton cho cc h thng, ng dng s dng mng:
a) C s logic v vt l v h thng mng;
b) S dng thit b tng la, thit b pht hin v ngn chn xm nhp v cc
trang thit b khc m bo an ton bo mt mng.
2. Thit lp, cu hnh y cc tnh nng ca thit b an ninh mng. S dng
cc cng c d tm v pht hin kp thi cc im yu, l hng v cc truy cp
bt hp php vo h thng mng. Thng xuyn kim tra, pht hin nhng kt ni,
trang thit b, phn mm ci t bt hp php vo mng.
3. Xc nh v ghi r cc tnh nng an ton, cc mc bo mt ca dch v v
yu cu qun l trong cc tha thun v dch v mng do bn th ba cung cp.
iu 18. Trao i thng tin
1. Ban hnh cc quy nh trao i thng tin v phn mm qua mng truyn thng
trong n v v vi cc n v khc. Xc nh trch nhim v ngha v php l vi
cc thnh phn tham gia.
102
CNG BO/S 119 + 120 ngy 10-3-2011
2. C tha thun cho vic trao i thng tin vi bn ngoi.
3. C bin php bo v phng tin mang tin khi vn chuyn.
4. Xy dng v thc hin cc bin php bo v thng tin trao i gia cc h
thng CNTT.
iu 19. Cc dch v thng mi in t
1. C bin php bo v thng tin trong thng mi in t nhm chng li cc
hot ng gian ln, sa i tri php:
a) ng truyn v giao thc truyn thng phi c m ha;
b) S dng cc phng thc xc thc mnh nh xc thc a thnh phn hoc
ch k s cho cc thnh vin tham gia giao dch.
2. Thng tin trong cc giao dch trc tuyn phi c truyn y , ng a
ch, trnh b sa i, tit l hoc nhn bn mt cch tri php.
3. Thng tin cng khai trn cc h thng CNTT phi c bo v nhm ngn
chn s sa i tri php.
iu 20. Gim st v ghi nht k hot ng ca h thng CNTT
1. Ghi nht k v quy nh thi gian lu tr cc thng tin v hot ng ca h
thng CNTT v ngi s dng, li pht sinh v cc s c mt an ton thng tin nhm
tr gip cho vic iu tra gim st v sau.
2. Xem xt v lp bo co nh k v nht k v c cc hot ng x l cc li,
s c cn thit.
3. Bo v cc chc nng ghi nht k v thng tin nht k, chng gi mo v truy
cp tri php. Ngi qun tr h thng v ngi s dng khng c xa hay sa i
nht k h thng ghi li cc hot ng ca chnh h.
4. C c ch ng b thi gian gia cc h thng CNTT.
iu 21. Phng chng vi rt v phn mm c hi
Xy dng v thc hin quy nh v phng chng vi rt, m c p ng cc yu
cu c bn sau:
1. Trin khai h thng phng chng vi rt my tnh cho ton b h thng CNTT
ca n v.
2. Kim tra, dit vi rt, m c cho ton b h thng CNTT ca n v hng ngy
v phng tin mang tin nhn t bn ngoi trc khi s dng.
CNG BO/S 119 + 120 ngy 10-3-2011 103
3. Khng m cc th in t l, cc tp tin nh km hoc cc lin kt trong cc
th l trnh vi rt, m c.
4. Khng vo cc trang web khng c ngun gc xut x r rng, ng ng.
5. Cp nht kp thi cc mu vi rt, m c mi v cc phn mm chng vi rt,
m c mi.
6. Bo ngay cho ngi qun tr h thng x l trong trng hp pht hin nhng
khng dit c vi rt, m c.
7. Khng t ci t cc phn mm khi cha c php ca ngi qun tr h
thng.
Mc 6
CC BIN PHP QUN L TRUY CP
iu 22. Yu cu nghip v i vi kim sot truy cp
1. Xy dng v thc hin cc quy nh v qun l truy cp i vi ngi s
dng, nhm ngi s dng, m bo p ng yu cu nghip v v yu cu an ton,
bo mt. Quy nh v qun l truy cp bao gm cc ni dung c bn sau:
a) ng k, cp pht, gia hn v thu hi quyn truy cp ca ngi s dng;
b) Gii hn v kim sot cc truy cp c quyn;
c) Qun l, cp pht mt khu;
d) R sot, kim tra, xt duyt li quyn truy cp ca ngi s dng.
2. Quy nh v qun l mt khu phi p ng cc yu cu sau:
a) Mt khu phi c di t su k t tr ln, cu to gm cc k t s, ch
v cc k t c bit khc nu h thng cho php. Cc yu cu mt khu hp l phi
c kim tra t ng khi thit lp mt khu;
b) Cc mt khu mc nh ca nh sn xut ci t sn trn cc trang thit b,
phn mm, c s d liu phi c thay i ngay khi a vo s dng;
c) Phn mm qun l mt khu phi c cc chc nng: Thng bo ngi s
dng thay i mt khu sp ht hn s dng; hy hiu lc ca mt khu ht hn s
dng; cho php thay i ngay mt khu b l, c nguy c b l hoc theo yu cu
ca ngi s dng; ngn chn vic s dng li mt khu c trong mt khong thi
gian nht nh.
104
CNG BO/S 119 + 120 ngy 10-3-2011
3. Quy nh trch nhim ngi s dng khi c cp quyn truy cp: S dng
mt khu ng quy nh, gi b mt mt khu, thot khi h thng khi khng lm
vic trn h thng hoc tm thi khng lm vic trn h thng.
iu 23. Qun l truy cp mng
1. Ban hnh cc quy nh s dng mng v cc dch v mng; cc th tc cp
php, xa b quyn kt ni n mng v dch v mng; nhng cch thc, phng
tin truy cp mng, dch v mng. Trong quy nh r:
a) Cc mng v dch v mng c php s dng;
b) Cc iu kin c kt ni mng.
2. S dng cc bin php thch hp xc thc ngi s dng kt ni t bn
ngoi vo mng ni b ca n v m bo an ton, bo mt.
3. Kim sot truy cp cc cng dng cu hnh v qun tr thit b mng.
4. Chia tch h thng mng thnh cc vng mng khc nhau theo i tng s
dng, mc ch s dng v h thng thng tin.
iu 24. Kim sot truy cp h iu hnh
1. C quy trnh kim sot truy cp h iu hnh; quy nh qun l mt khu
truy cp h iu hnh an ton, bo mt.
2. Mi ngi s dng h iu hnh phi c mt nh danh duy nht v c xc
thc, nhn dng, lu du vt khi truy cp h iu hnh.
3. S dng thm cc phng php xc thc khc nh sinh trc hc hoc th i
vi cc my ch quan trng ngoi vic xc thc bng mt khu.
4. Quy nh gii hn v kim sot cht ch nhng tin ch h thng c kh nng
nh hng n h thng v chng trnh ng dng khc.
5. T ng ngt phin lm vic sau mt thi gian khng s dng, nhm ngn
chn s truy cp tri php.
6. Quy nh gii hn thi gian kt ni vi nhng ng dng c ri ro cao.
iu 25. Kim sot truy cp thng tin v ng dng
1. Qun l v phn quyn truy cp thng tin v ng dng ph hp vi chc nng
nhim v ca ngi s dng:
a) Phn quyn truy cp n tng th mc, chc nng ca chng trnh;
b) Phn quyn c, ghi, xa, thc thi i vi thng tin, d liu, chng trnh.
CNG BO/S 119 + 120 ngy 10-3-2011 105
2. Cc h thng thng tin quan trng phi t trong mi trng mng my tnh
ring. Nu cc h thng thng tin cng s dng ngun ti nguyn chung th phi
c ngi qun tr h thng chp nhn.
Mc 7
TIP NHN, PHT TRIN, DUY TR H THNG THNG TIN
iu 26. Yu cu v an ton, bo mt cho cc h thng thng tin
Khi xy dng h thng thng tin mi hoc ci tin h thng thng tin hin ti,
phi a ra cc yu cu v an ton, bo mt ng thi vi vic a ra cc yu cu
k thut, nghip v.
iu 27. m bo an ton, bo mt cc ng dng
Cc chng trnh ng dng nghip v phi t c cc yu cu sau:
1. Kim tra tnh hp l ca d liu nhp vo cc ng dng, m bo d liu c
nhp vo chnh xc v hp l.
2. Kim tra tnh hp l ca d liu cn c x l t ng trong cc ng dng
nhm pht hin thng tin sai lch do cc li trong qu trnh x l hoc cc hnh vi
sa i thng tin c ch .
3. C cc bin php m bo tnh xc thc v bo v s ton vn ca d liu
c x l trong cc ng dng.
4. Kim tra tnh hp l ca d liu xut ra t cc ng dng, m bo qu trnh
x l thng tin ca cc ng dng l chnh xc v hp l.
iu 28. Qun l m ha
1. Quy nh v a vo s dng cc bin php m ha v qun l kha theo cc
chun quc gia hoc quc t c cng nhn bo v thng tin ca n v. S
dng cc gii thut m ha nh:
a) AES: Advanced Encryption Standard;
b) 3DES: Triple Data Encryption Standard;
c) RSA: Rivest-Shamir-Adleman;
d) Gii thut khc.
2. D liu v mt khu khch hng, mt khu ngi s dng v cc d liu nhy
cm khc phi c m ha khi truyn trn mng v khi lu tr.
106
CNG BO/S 119 + 120 ngy 10-3-2011
iu 29. An ton, bo mt cc tp tin h thng
1. Quy nh v qun l, ci t, cp nht cc phn mm ln h thng hin ti,
m bo an ton cho cc tp tin h thng.
2. D liu kim tra, th nghim phi c la chn, bo v, qun l v kim sot
mt cch thn trng.
3. Vic truy cp vo chng trnh ngun phi c qun l v kim sot cht ch.
iu 30. An ton, bo mt trong quy trnh h tr v pht trin
1. Phi c quy nh v qun l v kim sot s thay i h thng thng tin.
2. Khi thay i h iu hnh phi kim tra v xem xt cc ng dng nghip v
quan trng m bo h thng hot ng n nh, an ton trn mi trng mi.
3. Vic sa i cc gi phn mm phi c qun l v kim sot cht ch.
4. Gim st, qun l cht ch vic thu mua phn mm bn ngoi.
iu 31. Qun l cc im yu v mt k thut
1. C quy nh v vic nh gi, qun l v kim sot cc im yu k thut ca
cc h thng CNTT ang s dng. nh k nh gi, lp bo co v cc im yu k
thut ca cc h thng CNTT ang s dng.
2. Xy dng v trin khai cc gii php khc phc cc im yu k thut, hn
ch cc ri ro lin quan.
Mc 8
QUN L CC S C V CNTT
iu 32. Bo co s c
1. Xy dng quy trnh bo co, cc mu bo co v xc nh r ngi nhn bo
co v cc s c CNTT.
2. Quy nh r trch nhim bo co ca cn b, nhn vin v bn th ba v cc
s c CNTT.
3. Cc s c mt an ton phi c lp tc bo co n nhng ngi c thm quyn
v nhng ngi c lin quan c bin php khc phc trong thi gian sm nht.
iu 33. Kim sot v khc phc s c
1. Ban hnh quy trnh, trch nhim khc phc v phng nga s c CNTT,
m bo s c c x l trong thi gian ngn nht v gim thiu kh nng s c
lp li.
CNG BO/S 119 + 120 ngy 10-3-2011 107
2. Qu trnh x l s c phi c ghi chp v lu tr ti n v.
3. Thu thp, ghi chp, bo ton bng chng, chng c phc v cho vic kim
tra, x l, khc phc v phng nga s c. Trong trng hp s c v CNTT c lin
quan n cc vi phm php lut, n v c trch nhim thu thp v cung cp chng
c cho c quan c thm quyn ng theo quy nh ca php lut.
Mc 9
M BO HOT NG LIN TC CA
CC H THNG CNTT
iu 34. m bo hot ng lin tc
1. Cn c quy m v mc quan trng ca tng h thng CNTT i vi hot
ng ca n v la chn ra cc h thng CNTT trng yu, c nh hng ln ti
hot ng ca n v.
2. Xy dng v trin khai k hoch, quy trnh m bo hot ng lin tc ca cc
h thng CNTT trng yu.
3. Ti thiu su thng mt ln, tin hnh kim tra, th nghim, nh gi v cp
nht cc quy trnh m bo hot ng lin tc ca cc h thng CNTT trng yu.
4. K hoch, quy trnh m bo hot ng lin tc phi c kim tra, nh gi
v cp nht khi c s thay i ca h thng.
iu 35. Cng tc d phng thm ha
1. Xy dng h thng d phng cho cc h thng CNTT trng yu ca n v.
Cc h thng d phng cch h thng chnh ti thiu 30 km tnh theo ng thng
ni gia hai h thng.
2. H thng d phng phi thay th c h thng chnh trong vng 4 gi k t
khi h thng chnh c s c khng khc phc c.
3. Ti thiu ba thng mt ln, phi chuyn hot ng t h thng chnh sang h
thng d phng m bo tnh ng nht v sn sng ca h thng d phng.
4. Ti thiu ba thng mt ln, tin hnh kim tra, nh gi hot ng ca h
thng d phng.
108
CNG BO/S 119 + 120 ngy 10-3-2011
Mc 10
KIM TRA NI B V BO CO
iu 36. Kim tra ni b
1. Cc n v phi t t chc kim tra vic tun th cc quy nh ti Thng t
ny ti thiu mi nm mt ln.
2. Kt qu kim tra v cc kin ngh xut phi c lp thnh bo co.
iu 37. Bo co
Cc n v c trch nhim gi bo co v Ngn hng Nh nc Vit Nam (Cc
Cng ngh tin hc) nh sau:
1. Quy ch an ton, bo mt CNTT ca n v:
a) i vi cc n v ban hnh quy ch an ton, bo mt CNTT trc ngy
Thng t ny c hiu lc: Cc n v gi quy ch an ton, bo mt CNTT trong thi
hn 15 ngy k t ngy Thng t ny c hiu lc;
b) i vi cc n v cha ban hnh quy ch an ton, bo mt CNTT k t ngy
Thng t ny c hiu lc: Cc n v phi ban hnh v gi quy ch an ton, bo mt
CNTT trong thi hn 6 thng k t ngy Thng t ny c hiu lc.
2. Bo co nm:
a) Cc chnh sa, b sung quy ch an ton, bo mt CNTT nu c; Bo co kim
tra ni b ca n v theo quy nh ti iu 36 ca Thng t ny;
b) Thi hn gi bo co: Trc ngy 15 thng 3 hng nm;
c) Hnh thc v mu bo co: Theo hng dn ca Ngn hng Nh nc Vit
Nam (Cc Cng ngh tin hc).
3. Bo co t xut:
Khi xy ra cc v, vic mt an ton i vi h thng CNTT, n v gi bo co
t xut bng vn bn, c th nh sau:
a) Thi hn gi bo co: Trong thi hn 10 ngy k t thi im v, vic c
pht hin;
b) Ni dung bo co t xut:
- Ngy, a im pht sinh v, vic;
- Nguyn nhn v, vic;
CNG BO/S 119 + 120 ngy 10-3-2011 109
- nh gi ri ro, nh hng i vi h thng CNTT v nghip v ti ni xy ra
v, vic v nhng a im khc c lin quan;
- Cc bin php n v tin hnh ngn chn, khc phc v phng nga
ri ro;
- Kin ngh, xut.
Chng III
IU KHON THI HNH
iu 38. X l vi phm
Cc t chc, c nhn vi phm quy nh ti Thng t ny, ty theo mc vi
phm s b x l theo cc quy nh ca php lut.
iu 39. Hiu lc thi hnh
1. Thng t ny c hiu lc thi hnh sau bn mi lm ngy, k t ngy k ban
hnh v thay th cc vn bn sau:
- Quyt nh s 04/2006/Q-NHNN ngy 18/01/2006 ca Thng c Ngn
hng Nh nc ban hnh Quy ch an ton, bo mt h thng cng ngh thng tin
trong ngnh Ngn hng;
- Quyt nh s 14/2000/Q-NHNN16 ngy 07/01/2000 ca Thng c Ngn
hng Nh nc v vic ban hnh Quy ch qun l, s dng h thng tin hc trong
ngnh Ngn hng;
- Quyt nh s 864/2003/Q-NHNN ngy 05/8/2003 ca Thng c Ngn
hng Nh nc v vic sa i, b sung mt s iu ca Quy ch qun l, s dng
h thng tin hc trong ngnh Ngn hng ban hnh km theo Quyt nh s 14/2000/
Q-NHNN16 ngy 07/01/2000.
2. Trong qu trnh thc hin nu c vn pht sinh, vng mc, cc n v
lin quan phn nh kp thi v Ngn hng Nh nc Vit Nam xem xt, b
sung, sa i.
iu 40. Trch nhim thi hnh
1. Cc Cng ngh tin hc c trch nhim theo di, kim tra vic thi hnh Thng
t ny ca cc n v.
2. C quan Thanh tra, gim st ngn hng c trch nhim phi hp vi Cc
Cng ngh tin hc kim tra vic thi hnh Thng t ny i vi cc t chc tn dng,
110
CNG BO/S 119 + 120 ngy 10-3-2011
chi nhnh ngn hng nc ngoi v x l vi phm hnh chnh i vi hnh vi vi
phm theo quy nh ca php lut.
3. V Kim ton ni b c trch nhim thc hin kim ton ni b vic thi hnh
Thng t ny i vi cc n v thuc Ngn hng Nh nc Vit Nam.
4. Th trng cc n v lin quan thuc Ngn hng Nh nc Vit Nam; Gim
c Ngn hng Nh nc chi nhnh tnh, thnh ph trc thuc Trung ng; Ch tch
Hi ng qun tr, Tng gim c (Gim c) cc t chc tn dng, chi nhnh ngn
hng nc ngoi c trch nhim t chc trin khai v kim tra vic thi hnh ti n
v mnh theo ng cc quy nh ca Thng t ny./.
KT. THNG C
PH THNG C
Nguyn Ton Thng