EXTENDMAX - Recently, the Ministry of Defense issued Circular 23/2022/TT-BQP and QCVN 12:2022/BQP - National technical regulation on cryptographic technical specifications used in civil cryptography products under IP security products group with IPsec and TLS and QCVN xx:2023/BQP for civil cryptographic products under data storage security product group. Pursuant to the Circular 23/2022/TT-BQP and QCVN 12:2022/BQP, Civil Cryptographic Products shall need Type Approval certificate (for VPN IPSec and TLS or data storage security encryption function) to access Vietnam market. Pursuant to the Law on Cyberinformation Security, a certificate of conformity is a mandatory document in the application for a license to export and import civil cryptographic products (CCP). Therefore, organizations will need to apply for Type Approval certificate (certificate of conformity) for the IP security products using IPsec and TLS technologies or data storage security, and the importer must have a Type Approval certificate for civil cryptographic products to apply for a CCP import and export permits. So what will be market access requirements to export civil cryptographic items to Vietnam? What are the procedures, requirements, and costs of CCP type approval? We would like to provide some preliminary information as below
(Formerlly the QCVN 12:2022/BQP was issued with name as QCVN 01:2022/BQP, but it has been re-named to QCVN 12:2022/BQP by MD Decision No. 1008/QĐ-BQP dated 21 May 2022)
.jpg)
1) Legal backgrounds and the need to certify the conformity of civil cryptography products
Certification of conformity is an activity of assessing the conformity of products and services with applicable national technical regulations. The certification of conformity for civil cryptographic products has been mentioned in the Law on Cyber Information Security No. 86/2015/QH13, but as of May 20, 2022 backward, it has not been applied in practice because authorities need time to prepare corresponding regulations and national technical regulations. For importers and consumers, the conformity certification of civil cryptography products creates a technical barrier to filter out low-quality products, thereby providing benefits to consumers. Legal backgrounds for certification of conformity of civil cryptography products include:
1.1 Clause 3, Article 34 of the Law on Cyber Information Security No. 86/2015/QH13:
An application file for a license to export or import civil cryptography products includes the following documents:
a) An application form for a license to export or import civil cryptography products;
Note: Application form according to Form No. 04 attached to Decree No. 58/2016/ND-CP (amended and supplemented by Decree No. 53/2018/ND-CP)
b) A copy of the civil cryptography products trading license (dealer license);
Note: The product listed in the CCP trading license must include the products the enterprise intends to import. If the license is not available, the enterprise needs to carry out additional procedures for a CCP dealer license first).
c) A copy of the certificate of conformity for imported civil cryptography products:
1.2 National technical regulations in the field of civil cryptography issued by the Ministry of Defense:
QCVN 4:2016/BQP: National technical regulation on civil cryptography used in the banking sector.
QCVN 5:2016/BQP: Digital signatures used in banking.
QCVN 6:2016/BQP: Management of keys used in the banking sector.
QCVN 12:2022/BQP: National technical regulation on cryptographic technical specifications used in civil cryptography products under IP security products group with IPsec and TLS.
QCVN xx:2023/BQP: National technical regulation on cryptographic technical specification used in civil cryptography products under data storage security products group
Whereby:
→ All civil cryptography products in the group of IP security products using IPsec and TLS technologies will be required to obtain type approval according to QCVN 12:2022/BQP
→ All civil cryptography products under data storage security products group will be required to be obtain type approval according to QCVN xx:2023/BQP
→ Based on the operation model and technical specifications (on encryption technology) of the product, civil cryptography products used in the banking sector must also meet QCVN 4:2016/BQP, QCVN 5:2016/BQP, QCVN 6:2016/BQP as above mentioned. During the appraisal phase of the application for a license to trade civil cryptography products, products used in the banking sector that do not meet these standards will not be licensed, or be licensed but does not include the field used for banking.
2) What kind of civil cryptographic products which need Type Approval certificate?
Civil cryptographic products using VPN IPsec and TLS technology
Pursuant to the QCVN 12:2022/BQP, civil cryptographic products using IPsec and TLS technology will be under its scope. Typical products are:
- Firewall (it is likely at 100% percent that firewall need CCP approval).
- Security gateway using VPN or IPsec or TLS
- Sercurity router having VPN or IPsec or TLS
- Certain kind of security server
- Certain kind of eithernet switch (usually it must be L3 Switch)
- Certain kind of wireless router having VPN or IPsec or TLS
Civil cryptographic products under data storage security products group
The civil cryptographic product under data storage security products group, as the name suggests, has the main function of storing data and uses cryptographic encryption techniques to secure the stored data. Typical civil cryptographic products in this group include:
- Storage servers, storage systems, appliances that stores data
- Tokens used to authenticate payments, used in the banking sector
- Some other information technology products have storage memory and use cryptographic techniques to protect stored data
3) Who must be the applicant for the conformity certification for civil cryptographic products?
From ExtendMax's point of view, organizations and individuals engaged in the business activities of civil cryptographic products are classified into the following groups and have respective responsibilities and obligations in ensuring that products are imported and certificate of conformity according to regulations.
a. Manufacturer (domestic or oversea)
The manufacturer is the main subject to ensure that the product has technical characteristics that meet the limits of the cryptographic specification specified in the Technical Regulations. A domestic manufacturer is an organization that must carry out procedures for certification of conformity with products manufactured in Vietnam. The foreign manufacturer is an organization that ensures the quality of the product, assisting the importing companies and distributors to carry out the conformity certification procedures for civil cryptographic products.
b. Importer and distributor (at the same time)
For civil cryptographic products imported from abroad, importing traders are required to carry out procedures for applying for licenses to import civil cryptographic products. The CCP Type Approval certificate is a required document in the application for a license to import and export civil cryptographic products, so importers must be the applicant for the certification of conformity procedures.
c. Distributors only (not importers)
Traders who distribute (wholesale and retail) but do not carry out import and export activities of civil cryptographic products are not subject to the procedures for certification of conformity for civil cryptographic products. However, distribution traders (wholesalers and retailers) are involved in the business of civil cryptographic products, so they are still subject to the management of state management agencies (NACIS). When a distribution trader buys a civil cryptographic product from an importer or a domestic manufacturer, the distributing trader (wholesale or retail) must request the importing trader or domestic manufacturers provide certificates of conformity for products according to regulations.
d. Organizations and individuals who use the product (end-user)
The organization or individual using the product (end-user) is not the person performing business activities. However, according to Clause 4, Article 35 of the Law on Cyberinformation Security, end-users have the following obligations:
"Organizations and individuals using civil cryptographic products, that are not provided by enterprises licensed to trade in civil cryptographic products, must declare to the Government Cipher Committee, except for diplomatic missions and agencies, consular offices of foreign countries and representative offices of international intergovernmental organizations in Vietnam"
Therefore, organizations and individuals that use products should only buy products from distributors who have a license to trade in civil cryptographic products, and need to ask the distributor to provide a certificate of conformity applied for the civil cryptographic products to ensure compliance with relevant laws
4) The procedure to apply for certificate of conformity for products having cryptography function
Currently, we do not have much information about the process of certifying the conformity of civil cryptography products. We will update in near future when authority annouce it
5) How much does it cost to get Type Approval certificate for civil cryptographic products?
According to preliminary information, the cost of certifying the conformity of civil cryptography products includes 2 parts:
→ Product testing fee according to national technical regulations;
→ Civil cryptography product conformity certification fee
→ Consulting and service handling fee (in case customer needs our service)
In addition to the above costs, enterprises need to estimate the cost of transporting sample equipment to the laboratory and the cost of lifting and lowering sample products.
6) How long is the lead time to get type approval for civil cryptography products?
According to the method of certifying the technical-regulation conformity by the method of typical sample testing, the certificate of conformity of civil cryptography products has a maximum validity of 03 years (or until the Ministry of National Defense changes its regulation, upgrade, or apply additional technical regulations to which products fall within the scope of application of such technical regulations)
7) The testing laboratory and the certification authority for civil cryptography products
At present, only the Civil Cryptography Management and Cryptography Product Testing Laboratory has the scope of cryptography product testing. Simultaneously, the National Agency of Cryptography and Information Security (NACIS) of the Government Cipher Committee (GCC) is also the organization certifying conformity for civil cryptography products and devices.
8) What can ExtendMax offer you or help you in getting type approval for CCP?
With many years of experience in applying for business licenses and import and export licenses of civil cryptography products for many organizations, we can assist you:
→ Classify products into groups and finalized market access requirements needed for each group of products.
- Group of products that use encryption techniques but are not considered as CCP to be subject to management. For this group, enterprises should ask for a written confirmation that the product is not required to apply for a civil cryptographic license to facilitate the customs clearance process.
- The product group must apply for a license to trade in civil cryptography, but it is not required to certify the conformity according to the technical regulations on civil cryptography.
- The product group is required to apply for both a license to trade in civil cryptography and to certify the conformity and apply for a license to export and import civil cryptographic products.
→ In case the products are not considered as CCP, we support clients to obtain CCP Exemption Letter to make sure there will be no trouble in customs clearance
→ Support clients to prepare documents in the fastest time according to the requirements of the authorities in order to obtain CCP trading license and import license
→ Representing customers in carrying out testing and certification procedures for civil cryptography products to obtain Type Approval certificate.
→ Support other legal procedures related to imported products such as applying for licenses and ICT Type Approval certificate from the MIC (where applicable)
→ In case the customer is not yet eligible to apply for a license to trade in civil cryptography products, ExtendMax can provide Importer of Record (IOR) or Exporter of Record services to support import and export CCP.
Contact information services and consulting
EXTENDMAX VIETNAM COMPANY LIMITED
Hotline: 0915 836 555 | Hanoi: 024 6666 3066
Email: consultant@extendmax.vn | phuong.tran@extendmax.vn
HO: ExtendMax Villa, C01-L18 An Vuong, Duong Noi urban area, Duong Noi ward, Ha Dong district, Hanoi City, Vietnam
Test laboratory: BT02-21, An Hung urban area, To Huu street, La Khe ward, Ha Dong district, Hanoi City, Vietnam
If you find our article useful and valuable in practice applications, please support us by rating it, leaving your comment at the bottom of this article, and sharing it with your colleagues or the indutry. Your review will be a great motivation for us to write more detailed and valuable procedural guides for importing, exporting organizations.
↓ ↓ ↓ ↓ ↓ ↓ ↓
