Thông tư 16/2025/TT-BKHCN quy định Quy chế chứng thực mẫu do Bộ trưởng Bộ Khoa học và Công nghệ ban hành

CIRCULAR

ON MODEL AUTHENTICATION REGULATIONS

Pursuant to Law on Electronic Transactions dated June 22, 2023;

Pursuant to Government's Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services;

Pursuant to Government's Decree No. 55/2025/ND-CP dated March 02, 2025 defining functions, tasks, powers and organizational structures of the Ministry of Science and Technology;

At the request of the Director of the National e-authentication service provider;

The Minister of Information and Communications issues a Circular on model authentication regulations.

Article 1. Model authentication regulations

...

...

...

1. Model authentication regulations of the national e-authentication service provider (The National E-Authentication Centre) and public digital signature authentication service providers in Appendix I attached hereto.

2. Model authentication regulations of trust service providers in Appendix II attached hereto.

3. Model authentication regulations of trust service providers for data message authentication services in Appendix III attached hereto.

4. Model authentication regulations of organizations generating special-use e-signatures in Appendix IV attached hereto

Article 2. Implementation clauses

1. This Circular shall come into force from the day on which it is signed.

2. The Circular No. 31/2020/TT-BTTTT dated October 30, 2020 of the Minister of Information and Communications on authentication regulations of e-signature authentication service providers shall cease to be effective from the effective date of this Circular, except for the case specified in Clause 3 hereof.

3. Except for cases where the provisions of this Circular apply, public digital signature authentication service providers with authentication regulations that operates in accordance with Circular No. 31/2020/TT-BTTTT shall, within 02 years from the effective date of Government’s Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services, review, amend, supplement, or replace their authentication regulations to comply with the provisions of this Circular.

Article 3. Implementation

...

...

...

2. Any difficulties that arise during implementation should be promptly reported to the Ministry of Science and Technology (through the National E-Authentication Centre) for guidance and handling./.

MINISTER




Nguyen Manh Hung

APPENDIX I

MODEL AUTHENTICATION REGULATIONS OF THE NATIONAL E-AUTHENTICATION SERVICE PROVIDER (THE NATIONAL E-AUTHENTICATION CENTRE) AND PUBLIC DIGITAL SIGNATURE AUTHENTICATION SERVICE PROVIDERS
(Enclosed with Circular No. 16/2025/TT-BKHCN dated August 20, 2025 of the Minister of the Science and Technology)

1. INTRODUCTION

1.1. Overview

...

...

...

Authentication regulation documents shall comply with the provisions of the Law on Electronic Transactions dated June 22, 2023, Government’s Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services, and relevant laws.

Description of the scope is based on the service business license (for public digital signature authentication service providers).

1.2. Name and identification marks of documents

1.3. Components in the digital signature authentication service system

1.3.1. The national e-authentication service provider (The National E-Authentication Centre)

1.3.2. Public digital signature authentication service providers

1.3.3. Subscribers

1.3.4. Trusted parties

1.3.5. Other parties

...

...

...

Description of the purposes of using digital signature certificates, scope of use of digital signature certificates. To be specific:

1.4.1. Cases of valid use of digital signature certificates

1.4.2. Cases of invalid use of digital signature certificates

1.5. Management of authentication regulations

Description of the management of authentication regulations. To be specific:

1.5.1. Organization managing authentication regulations

1.5.2. Contact information

1.5.3. Conformity assessment bodies of the compliance of authentication regulations with the law

1.5.4. Procedures for approval and issuance of authentication regulations

...

...

...

List of defined terms and abbreviations are provided in this section.

2. RESPONSIBILITY FOR INFORMATION STORAGE AND DISCLOSURE

2.1. Storage

Description of information storage shall comply with Clause 4 Article 43 of the Decree No. 23/2025/ND-CP.

2.2. Information disclosure

Description of information disclosure on websites shall comply with Clause 1 Article 43 of the Decree No. 23/2025/ND-CP.

2.3. Time and  frequency of information disclosure

Description of time, frequency of information disclosure, and information maintenance shall comply with Clause 1 Article 43 of the Decree No. 23/2025/ND-CP.

2.4. Information access control

...

...

...

3. IDENTIFICATION AND AUTHENTICATION OF APPLICATIONS FOR ISSUANCE OF DIGITAL SIGNATURE CERTIFICATES

3.1. Naming

3.1.1. Types of names

3.1.2. Need for meaningful names

3.1.3. Anonymous or pseudonymous

3.1.4. Rules for interpreting different forms of names

3.1.5. Uniqueness of names

3.1.6. Identification, authentication, and roles of labels

3.2. Verification of applications for issuance of digital signature certificates

...

...

...

3.2.1. Methods of proving ownership of the private key

3.2.2. Identity verification for organizations

3.2.3. Identity verification for individuals

3.2.4. Unverified information

3.2.5. Verification of authority

3.2.6. Interoperability criteria

3.3. Verification of changing key pairs

Description of the process, procedures for verification of changing key pairs. To be specific:

3.3.1. Identity verification and authentication for periodic change of key pairs

...

...

...

3.4. Verification of applications for revocation of digital signature certificates

description of the process, procedures for verifying applications for revocation of digital signature certificates

4. REQUIREMENTS FOR THE LIFECYCLE OF DIGITAL SIGNATURE CERTIFICATES

4.1. Applications for issuance of digital signature certificates

Description of the application for issuance of digital signature certificates. To be specific:

4.1.1. Entities applying for issuance of digital signature certificates

4.1.2. Responsibilities and registration procedures

4.2. Processing applications for issuance of digital signature certificates

Description of the process for handling of application for issuance of digital signature certificates. To be specific:

...

...

...

4.2.2. Approving or rejecting applications for the issuance of digital signature certificates

4.2.3. Processing time for applications for issuance of digital signature certificates

4.3. Issuance of digital signature certificates

Description of the process, procedures for issuance of digital signature certificates. To be specific:

4.3.1. Issuance of digital signature certificates

4.3.2. Notification of the issuance of digital signature certificates

4.4. Confirmation and disclosure of digital signature certificates

Description of the confirmation and disclosure of digital signature certificates. To be specific:

4.4.1. Confirmation of the accurate information on issued digital signature certificates

...

...

...

4.4.3. Notification of the issuance of digital signature certificates to other parties

4.5. Purposes of using key pairs and digital signature certificates

Descriptions for using key pairs and digital signature certificates. To be specific:

4.5.1. Use of key pairs and digital signature certificates

4.5.2. Use of public key and digital signature certificates by trusted parties

4.6. Extension of digital signature certificates

Description of the extension of digital signature certificates. To be specific:

4.6.1. Cases eligible for extension of digital signature certificates

4.6.2. Entities eligible for the extension of digital signature certificates

...

...

...

4.6.4. Notification of the extension of digital signature certificates

4.6.5. Confirmation for the extension of digital signature certificates

4.6.6. Disclosure of extended digital signature certificates

4.6.7. Notification of extended digital signature certificates to other parties

4.7. Key pair changes

Description of key pair changes. To be specific:

4.7.1. Cases eligible for key pair changes

4.7.2. Entities eligible for key pair changes

4.7.3. Handling of key pair changes

...

...

...

4.7.5. Confirmation for the updated digital signature certificates

4.7.6. Disclosure of update of digital signature certificates after key pair changes

4.7.7. Notification of update of digital signature certificates after key pair changes to other parties

4.8. Changes in digital signature certificate information

Description of changes in digital signature certificate information. To be specific:

4.8.1. Cases eligible for changes in digital signature certificate information

4.8.2. Entities eligible for changes in digital signature certificate information

4.8.3. Handling of changes in digital signature certificate information

4.8.4. Notification of update of digital signature certificates

...

...

...

4.8.6. Disclosure of update of digital signature certificates after changes in information

4.8.7. Notification of update of digital signature certificates after changes in information to other parties

49. Suspension, RE, and revocation of digital signature certificates

Description of the suspension, recovery, and revocation of digital signature certificates. To be specific:

4.9.1. Cases eligible for revocation of digital signature certificates

4.9.2. Entities eligible for revocation of digital signature certificates

4.9.3. Process, procedures for the revocation of digital signature certificates

4.9.4. Deadlines for extension of revocation of digital signature certificates

4.9.5. Deadlines for handling of revocation of digital signature certificates

...

...

...

4.9.7. Frequency of publishing Certificate Revocation Lists (CRL) (if applicable)

4.9.8. Delay in publishing CRL (if applicable)

4.9.9. Online status checking/revocation of digital signature certificates

4.9.10. Request for online status check of revoked digital signature certificates

4.9.11. Other revocation notification methods

4.9.12. Special requests related to key pair changes

4.9.13. Cases eligible for suspension and/or recovery of digital signature certificates

4.9.14. Entities eligible for suspension and/or recovery of digital signature certificates

4.9.15. Process, procedures for suspension and/or recovery of digital signature certificates

...

...

...

4.10. Status checking of digital signature certificates

Description of the status checking of digital signature certificates. To be specific:

4.10.1. Status checking methods of digital signature certificates

4.10.2. Service readiness for status checking of digital signature certificates

4.10.3. Other features

4.11. Service termination

Cases of service termination, procedures for service termination.

4.12. Key storage and recovery

Description of key storage and recovery. To be specific:

...

...

...

4.12.2. Policies and practices for encryption and session key recovery.

5. CONTROL, MANAGEMENT, AND OPERATION

5.1. Safety and physical security controls

Description of safety and physical security controls. To be specific:

5.1.1. Location and construction of systems

5.1.2. Physical access

5.1.3. Air conditioning and power sources

5.1.4. Water contact

5.1.5. Fire prevention and protection

...

...

...

5.1.7. Waste management

5.1.8. Backup systems

5.2. Process Controls

Description of process controls. To be specific:

5.2.1. Roles and responsibilities

5.2.2. Number of personnel required for each task

5.2.3. Identification and authentication for each member

5.2.4. Roles and responsibilities of each member

5.3. Personnel Control

...

...

...

5.3.1. Requirements for experience, qualifications, and certifications of system management and operation personnel

5.3.2. Background check procedures

5.3.3. Training requirements for system operation and management personnel

5.3.4. Frequency and requirements for retraining

5.3.5. Frequency and sequence of job rotation

5.3.6. Actions to be taken for unauthorized behavior

5.3.7. Requirements for independent bidders

5.3.8. Provision of documentation for personnel

5.4. System logging processes

...

...

...

5.4.1. Types of events to be logged

Description of events needs to be logged in the system log and the method of logging.

5.4.2. Frequency of handling system logs

5.4.3. Retention period of system logs

5.4.4. Protection of system logs

5.4.5. System log backup procedures

5.4.6. System log collection system (internal vs. external)

5.4.7. Notification to the entity that caused the event

5.4.8. Security vulnerability assessment

...

...

...

Description of data storage . To be specific:

5.5.1. Types of records stored

5.5.2. Record retention period

5.5.3. Protection of records

5.5.4. Record backup procedures

5.5.5. Requirements for timestamping records

5.5.6. Record collection system (internal vs. external)

5.5.7. Access and verification process for record information

5.6. Key pair changes

...

...

...

5.7. Handling of incident and disaster; Recovery

Description of the scenario for handling of incident and disaster and post-disaster recovery. To be specific:

5.7.1. Incident and disaster handling process

5.7.2. Incidents involving computer resources, software, and data

5.7.3. Process for handling compromised secret keys

5.7.4. Ability to recover operations after a disaster

5.8. Service termination

Description of the service termination process and notification of service termination.

6. TECHNICAL SECURITY ENSURANCE

...

...

...

Description of key pair generation and distribution. To be specific:

6.1.1. Key pair generation methods

6.1.2. Transfer of secret keys

6.1.3. Transfer of public keys to the certificate issuers

6.1.4. Transfer of public keys of the certificate issuers to trusted parties

6.1.5. Key size

6.1.6. Generating parameters for public keys and quality checking

6.1.7. Purpose of key usage

6.2. Control and protection of secret keys, cryptographic modules

...

...

...

6.2.1. Standards and controls for cryptographic modules

6.2.2. Multi-party control for secret keys (n out of m)

6.2.3. Transfer of secret keys

6.2.4. Backup of secret keys

6.2.5. Storage of secret keys

6.2.6. Transfer of secret keys into or out of cryptographic modules

6.2.7. Storage of secret keys on cryptographic modules

6.2.8. Method of activating secret keys

6.2.9. Method of deactivating secret keys

...

...

...

6.2.11. Evaluation of cryptographic modules

6.3. Other key management related issues

Description of other key management related issues. To be specific:

6.3.1. Storage of public keys

6.3.2. Certificate validity period and key pair expiration period

6.4. Data Activation

Description of data activation. To be specific:

6.4.1. Initialization and installation of activation data

6.4.2. Protection of activation data

...

...

...

6.5. Computer security controls

Description of computer security controls. To be specific:

6.5.1. Specific technical requirements for computer security

6.5.2. Periodic assessment of computer system security

6.6. Technical lifecycle control

Description of the process, procedures for monitoring and managing the implementation of system operations. To be specific:

6.6.1. System development control

6.6.2. Security management control

6.6.3. System lifecycle control

...

...

...

Description of establishing a network security monitoring system to ensure system safety for detecting external intrusions and attacks.

6.8. Time-stamping

(if applicable)

7. DIGITAL SIGNATURE CERTIFICATE FORMAT, CERTIFICATE REVOCATION LIST (CRL), ONLINE CERTIFICATE STATUS PROTOCOL (OCSP)

7.1. Digital signature certificate format

Regulations on the basic information fields, extended information fields of the digital signature certificate. To be specific:

7.1.1. Version

7.1.2. Extended fields

7.1.3. Algorithm identifier

...

...

...

7.1.5. Constraints, limitations on names

7.1.6. Certificate policy identifier

7.1.7. Use of the Policy Constraint extension field

7.1.8. Syntax and semantics in the certificate policy

7.1.9. Handling semantics for important Certificate Policies extension fields

7.2. Certificate Revocation List (CRL) format

Description of the CRL format used by the organization. To be specific:

7.2.1. CRL version number

7.2.2. CRL and CRL input extension parts

...

...

...

Description of the OCSP format used by the organization. To be specific:

7.3.1. OCSP version number

7.3.2. OCSP extensions

8. COMPLIANCE AND OTHER ASSESSMENTS

8.1. Frequency and situations of technical checks

Regulations on technical checks for digital signature authentication systems (periodic checks; ad-hoc checks); contents of technical and system maintenance checks (including system infrastructure; key management processes; system operation processes; other contents as required by the technical inspection unit).

8.2. Identity and capability of the inspectorate and inspector

8.3. Independence of the inspector from the inspected organization

8.4. Handling when detecting errors

...

...

...

8.5. Disclosure of technical inspection results

8.6. Frequency and cases of evaluation

9. OTHER OPERATIONAL AND LEGAL CONTENTS

9.1. Fees and prices

Description of the fees, prices for providing public digital signature authentication services, and other types of costs (if applicable). To be specific:

9.1.1. Service fees for maintaining the digital signature certificate status checking system

Service fees for maintaining the digital signature certificate status checking system are specified in Circular No. 13/2025/TT-BTC dated March 19, 2025 of the Minister of Finance providing for rates, collection, payment, management and use of fees for online certificate status protocol maintenance.

9.1.2. Prices

- Price for issuing or renewing digital signature certificates.

...

...

...

- Price for accessing revocation information or certificate status.

- Refund policy: Description for the scope for applying the service price refund policy.

9.1.3. Other types of costs

(if applicable)

9.2. Financial responsibility

Description of financial responsibility. To be specific:

9.2.1. Scope of insurance

9.2.2. Other assets

9.2.3. Scope of insurance or warranty for end-users

...

...

...

Description of operational information security. To be specific:

9.3.1. Scope of operational information to be protected

9.3.2. Information beyond the scope of protection

9.3.3. Responsibility for operational information protection

9.4. Personal data protection

Description of content regarding the personal data protection. To be specific:

9.4.1. Measures to protect personal data

9.4.2. Scope of personal data protection

9.4.3. Personal information beyond the scope of protection

...

...

...

9.4.5. Notification and consent for the use of personal data

9.4.6. Information provision upon request from the managing agency

9.4.7. Other situations for information provision

9.5. Intellectual property rights

Description of establishing intellectual property rights for contents of the authentication regulations and other contents stipulated by intellectual property laws.

9.6. Declarations and commitments

Description of declarations and commitments. To be specific:

9.6.1. Declarations and commitments of digital signature certificate issuers

9.6.2. Declarations and commitments of subscribers

...

...

...

9.6.3. Declarations and commitments of trusted entities

9.6.4. Declarations and commitments of other relevant parties

9.7. Disclaimer of warranty

Description of the cases in which service providers may disclaim warranty in accordance with applicable laws and other agreements (if applicable).

9.8. Limitation of liability

Responsibilities of providers during the service provision

9.9. Compensation for damages

Responsibility to compensate damages of providers during the service provision

9.10. Validity of the authentication regulations

...

...

...

9.10.1. Duration

9.10.2. Termination of validity

9.10.3. Impact of termination of validity

9.11. Notification and information exchange with participants

Description of notification and information exchange with participants

9.12. Amendments and modifications

Description of amendments and modifications of authentication regulations. To be specific:

9.12.1. Amendment procedures

Cases that require amendments and supplements to authentication regulations; amendment and supplement procedures for authentication regulations.

...

...

...

9.12.3. Cases requiring changes to Object Identifiers (OIDs)

9.13. Complaint resolution procedures

Description of complaint resolution measures and procedures during the service provision.

9.14. Legal basis system

Authentication regulations are stipulated in the following legislative documents:

- Law on Electronic Transactions dated June 22, 2023;

- The Government's Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services;

9.15. Compliance with applicable laws

- Law on Cyberinformation Security dated November 19, 2015;

...

...

...

- Law on Data dated November 30, 2024;

- The Government’s Decree No. 13/2023/ND-CP dated April 17, 2023 on personal data protection;

- The Government's Decree No. 69/2024/ND-CP dated June 25, 2024 on electronic identification and authentication;

- Circular No. 13/2025/TT-BTC dated March 19, 2025 of the Minister of Finance providing for rates, collection, payment, management and use of fees for online certificate status protocol maintenance.

- ...

Organizations and individuals shall provide information to prevent the misuse of services to commit legal violations.

9.16. General provisions

9.16.1. Entire agreement

9.16.2. Transfer

...

...

...

9.16.4. Implementation

Fees for applying dispute resolution procedures (court, arbitration, mediation, etc.) and the waiver of enforcement rights.

9.16.5. Force majeure events

9.17. Other clauses

(if applicable)

APPENDIX II

REGULATIONS ON MODEL AUTHENTICATION OF TRUST SERVICE PROVIDERS FOR TIME STAMPING SERVICES
(Enclosed with Circular No. 16/2025/TT-BKHCN dated August 20, 2025 of the Minister of Science and Technology)

TERMINOLOGY

...

...

...

General introduction to authentication regulations.

Authentication regulations documents shall comply with the provisions of the Law on Electronic Transactions dated June 22, 2023, Government’s Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services, and relevant regulations.

1. SCOPE

Description of the applicable scope in accordance with service business licenses.

2. REFERENCE DOCUMENTS

2.1. Standard reference documents

2.2. Reference documents

3. TERMINOLOGY, SYMBOLS, ABBREVIATIONS, AND SIGNS

3.1. Terminology

...

...

...

3.3. Abbreviations

3.4. Signs

4. GENERAL DEFINITIONS

4.1. Definitions on general policy requirements

4.2. Time stamping service

4.3. Time Stamping Authority (TSA)

4.4. Subscriber

4.5. Time stamping policy and authentication regulations of time stamping service providers

5. REGULATIONS AND GENERAL REQUIREMENTS FOR TIME STAMPING SERVICES

...

...

...

5.2. Policy names and identifiers

Description of policies and identifiers for TSA.

5.3. Users and applicable scope

Description of users and applicable scope of time stamping polices.

6. POLICIES AND IMPLEMENTATION

6.1. Risk assessment

6.2. Authentication regulations of trusted service providers

6.3. Terms and conditions

6.4. Information security policies

...

...

...

6.5. TSA obligations

6.5.1. Overview

6.5.2. TSA obligations towards subscribers

6.6. Information for trusted parties

7. MANAGEMENT AND OPERATION OF TIME STAMPING SERVICE PROVIDERS

7.1. Introduction

7.2. Internal organization

7.3. Personnel security

7.4. Property management

...

...

...

7.6. Cryptographic control

7.6.1. Overview

7.6.2. Time Stamping Unit’s (TSU) key generation

7.6.3. Private key protection of TSUs

7.6.4. Public key of TSUs

7.6.5. Key pair changes of TSUs

7.6.6. Hardware key lifecycle management

7.6.7. TSU’s key lifecycle end

7.7. Time stamps

...

...

...

7.7.2. Time synchronization with the national standard time source

7.8. Physical and environmental security

7.9. Operational security

7.10. Network security

7.11. Incident management

7.12. Evidence collection

Description of the evidence collection process.

7.13. Regular business operation management

7.14. Termination of TSA’s operation and termination plans

...

...

...

a) Legal basis system

Authentication regulations are stipulated in the following legislative documents:

- Law on Electronic Transactions dated June 22, 2023;

- The Government's Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services;

b) Compliance with applicable laws

- Law on Cyberinformation Security dated November 19, 2015;

- Law on Cybersecurity dated June 12, 2018;

- Law on Data dated November 30, 2024;

- The Government’s Decree No. 13/2023/ND-CP dated April 17, 2023 on personal data protection;

...

...

...

- Circular No. 13/2025/TT-BTC dated March 19, 2025 of the Minister of Finance providing for rates, collection, payment, management and use of fees for online certificate status protocol maintenance.

- ...

Organizations and individuals shall provide information to prevent the misuse of services to commit legal violations.

APPENDIX III

REGULATIONS ON MODEL AUTHENTICATION OF TRUST SERVICE PROVIDERS FOR DATA MESSAGE AUTHENTICATION SERVICES
(Enclosed with Circular No. 16/2025/TT-BKHCN dated August 20, 2025 of the Minister of Science and Technology)

TERMINOLOGIES

INTRODUCTION

General introduction to authentication regulations.

...

...

...

1. SCOPE

Description of the applicable scope in accordance with service business licenses.

2. REFERENCE DOCUMENTS

2.1. Standard reference documents

2.2. Reference documents

3. TERMINOLOGY, ABBREVIATIONS, AND SIGNS

3.1. Terminology

3.2. Abbreviations

3.3. Signs

...

...

...

4.1. Definitions on general policy requirements

4.2. Data message authentication services

4.3. Data message authentication service providers

4.4. Subscribers

4.5. Data message authentication policy and authentication regulations of data message authentication service providers

5. REGULATIONS AND GENERAL REQUIREMENTS FOR DATA MESSAGE AUTHENTICATION SERVICES

5.1. Integrity and security of subscriber contents

5.1.1. General provisions

5.1.2. Regulations for data message authentication service providers

...

...

...

5.2.1. Regulations on initial identity verification for data message authentication service providers

5.2.1.1. General provisions

5.2.1.2. User identification and content delivery

5.2.2. Authentication regulations for data message authentication service providers

5.3. Time reference

5.3.1. General provisions

5.3.2. Regulations for data message authentication service providers

5.4. Events and evidence

5.4.1. General provisions

...

...

...

5.5. Interoperability

6. POLICIES AND IMPLEMENTATION

6.1. Risk assessment

6.2. Authentication regulations of trusted service providers

6.3. Terms and conditions

6.4. Information security policies

Description of information security policies to ensure compliance with laws on cyberinformation security and cybersecurity.

6.5. Obligations of data message authentication service providers

6.5.1. Overview

...

...

...

6.6. Information for trusted parties

7. MANAGEMENT AND OPERATION OF DATA MESSAGE AUTHENTICATION SERVICE PROVIDERS

7.1. Internal organization

7.1.1. Reliability of providers

7.1.2. Work separation

7.2. Personnel management

7.2.1. General provisions

7.2.2. Regulations for data message authentication service providers

7.3. Property management

...

...

...

7.3.2. Handling of storage facilities

7.4. Access controls

7.5. Cryptographic control

7.6. Physical and environmental security

7.7. Operational security

7.8. Network security

7.9. Incident management

7.10. Evidence collection for internal services of data message authentication service providers

Description of regulations for evidence collection for internal services of data message authentication service providers

...

...

...

7.12. Termination of operations of data message authentication service providers and termination plans

7.13. Compliance with regulations

a) Legal basis system

Authentication regulations documents are stipulated in the following legislative documents:

- Law on Electronic Transactions dated June 22, 2023;

- The Government's Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services;

b) Compliance with applicable laws

- Law on Cyberinformation Security dated November 19, 2015;

- Law on Cybersecurity dated June 12, 2018;

...

...

...

- The Government’s Decree No. 13/2023/ND-CP dated April 17, 2023 on personal data protection;

- The Government's Decree No. 69/2024/ND-CP dated June 25, 2024 on electronic identification and authentication;

- Circular No. 13/2025/TT-BTC dated March 19, 2025 of the Minister of Finance providing for rates, collection, payment, management and use of fees for online certificate status protocol maintenance.

- ...

Organizations and individuals shall provide information to prevent the misuse of services to commit legal violations.

APPENDIX IV

REGULATIONS ON MODEL AUTHENTICATION OF ORGANIZATIONS GENERATING SPECIAL-USE QUALIFIED E-SIGNATURES
(Enclosed with Circular No. 16/2025/TT-BKHCN dated August 20, 2025 of the Minister of Science and Technology)

1. INTRODUCTION

...

...

...

General introduction to the authentication regulations, scope, and regulated entities of the regulations.

1.2. Name and identification marks of documents

1.3. Components in systems

1.4. Purposes of establishment and use of special-use qualified e-signatures

1.5. Management of authentication regulations

1.6. Definitions and abbreviations

2. RESPONSIBILITY FOR INFORMATION STORAGE AND PUBLISHING

2.1. Storage

2.2. Information publishing

...

...

...

2.4. Information access control

Control of access to the information disclosed on websites such as authentication regulations, list of special-use e-signature certificates, revoked certificates, etc.

3. IDENTIFICATION AND VERIFICATION OF APPLICATIONS FOR SPECIAL-USE QUALIFIED E-SIGNATURES

Identification of organizations and/or individuals applying for using special-use qualified e-signatures/e-signature certificates

3.2. Verification of applications for using special-use qualified e-signatures/e-signature certificates

3.3. Verification of applications for changes of special-use qualified e-signatures/e-signature certificates

3.4. Verification of applications for termination of the use of special-use qualified e-signatures/e-signature certificates

4. REQUIREMENTS FOR THE LIFECYCLE OF SPECIAL-USE QUALIFIED E-SIGNATURES/E-SIGNATURE CERTIFICATES

4.1. Applications for using special-use qualified e-signatures/e-signature certificates

...

...

...

4.3. Generation of special-use qualified e-signatures/e-signature certificates

4.4. Verification of special-use qualified e-signatures/e-signature certificates

4.5. Use of special-use qualified e-signatures/e-signature certificates

4.6. Modification of information of special-use qualified e-signatures/e-signature certificates

4.7. Termination of the use of special-use qualified e-signatures/e-signature certificates

4.8. Inspection of special-use qualified e-signatures/e-signature certificates

4.9. Storage of information of special-use qualified e-signatures/e-signature certificates

5. CONTROL, MANAGEMENT, AND OPERATION

5.1. Safety and physical security controls

...

...

...

5.3. Personnel control

5.4. System logging processes

5.5. Data storage

5.6. Key change

5.7. Handling of incident or disaster; Recovery

5.8. Shut down of organizations generating special-use qualified e-signatures for security assurance.

6. TECHNICAL SECURITY ENSURANCE

6.1. Data control and protection

6.2. Computer security control

...

...

...

6.4. Network system security monitoring

7. TECHNOLOGY SOLUTION FOR SPECIAL-USE QUALIFIED E-SIGNATURES

7.1. Solution, technology for generating special-use qualified e-signatures

7.2. Purposes of generation and use of special-use qualified e-signatures

7.3. Procedures for checking special-use qualified e-signatures

8. COMPLIANCE AND OTHER ASSESSMENTS

8.1. Frequency and situations of technical checks

Regulations on technical checks for special-use qualified e-signature generation systems (periodic checks; ad-hoc checks); contents of technical and system maintenance checks (including system infrastructure; key management processes; system operation processes; other contents as required by the technical inspection unit).

8.2. Identity and capability of the inspectorate and inspector

...

...

...

8.4. Handling when detecting errors

Description of the scenario for handling errors and incidents when detected.

8.5. Disclosure of technical check results

8.6. Frequency and cases of evaluation

9. OTHER OPERATIONAL AND LEGAL CONTENTS

9.1. Financial responsibility

9.2. Protection of operational information

The scope of business information to be kept confidential and the responsibility to keep business information confidential.

9.3. Personal data protection

...

...

...

9.4. Declarations and commitments

9.5. Disclaimer

Cases where the organization is exempt from liability during the generation and use of special-use qualified e-signatures.

9.6. Limitation of liability

Responsibility of organizations during the generation and use of special-use qualified e-signatures.

9.7. Compensation for damages

Responsibility to compensate for damages of organizations during the generation and use of special-use qualified e-signatures.

9.8. Validity of the authentication regulations

9.9. Notification and information exchange with participants

...

...

...

9.11. Complaint resolution procedures

Description of measures, procedures for resolving complaints during the generation and use of special-use qualified e-signatures.

9.12. Legal basis system

Authentication regulations documents are stipulated in the following legislative documents:

- Law on Electronic Transactions dated June 22, 2023;

- The Government's Decree No. 23/2025/ND-CP dated February 21, 2025 on digital signatures and trust services;

9.13. Compliance with applicable laws

- Law on Cyberinformation Security dated November 19, 2015;

- Law on Cybersecurity dated June 12, 2018;

...

...

...

- The Government’s Decree No. 13/2023/ND-CP dated April 17, 2023 on personal data protection;

- The Government's Decree No. 69/2024/ND-CP dated June 25, 2024 on electronic identification and authentication;

- ...

Organizations and individuals shall provide information to prevent the misuse of special-use qualified e-signatures to commit legal violations.

9.14. General provisions

9.15. Other clauses

(if applicable)