ExtendMax – What is civil cryptography? What are the requirements for obtaining a civil cryptography products trading license (CCP trading license) ? How long does it take to get the CCP license? Which company provides the best service? These are common questions that many companies have during the process of importing IT and LAN network equipment. These are critical issues as they greatly impact import planning, customs declaration, and clearance of shipments on schedule without being subject to administrative penalties. In this article, we will provide you with a comprehensive overview of definitions, legal bases, licensing conditions, practical tips for product classification, and why customers rate ExtendMax as the #1 trusted service provider for CCP licensing.
ExtendMax is the #1 agency in CCP licensing and consulting
What is civil cryptography?
The Law on Cybersecurity No. 86/2015/QH13 defines:
"Civil cryptography refers to cryptographic techniques and cryptographic products used to secure or authenticate information that does not fall within the scope of state secrets."
Thus, civil cryptography consists of cryptographic techniques and products applied in the civilian sector. Cryptographic techniques and products used in areas involving state secrets (such as military, security, and defense) are not considered civil cryptography.
What is a civil cryptographic product (CCP)?
According to the Law on Cybersecurity,
"A civil cryptographic product refers to documents, technical equipment, and cryptographic operations used to protect information that does not fall within the scope of state secrets."
In simpler terms, civil cryptographic products are products that generate encryption keys or secure stored data and data exchanged over the internet using encryption keys. These products convert image, audio, voice, and stored data from their regular format into an encrypted format. Terminal devices receiving the encrypted data cannot read it without the appropriate tools, techniques, or decryption software.
Civil cryptographic products can exist in the form of software or hardware, using either symmetric or asymmetric encryption algorithms. They are commonly applied in IT systems of large enterprises and industries requiring high-security features, such as banks, financial institutions, large corporations, and high-tech factories.
The list of civil cryptographic products
The list of civil cryptographic products is divided into two groups:
-
Group 1: Civil cryptographic products that require a trading license, as specified in Appendix 1 of Decree No. 58/2016/NĐ-CP.
-
Group 2: Civil cryptographic products that require both a trading license and an import/export license, as specified in Decree No. 32/2023/NĐ-CP.
(Note from ExtendMax: Group 2 is a subset of Group 1.)
What is a civil cryptographic product trading license?
A civil cryptographic product trading license is a conditional trading license issued by the Government Cipher Committee to regulate the trading of civil cryptographic products and services. In English, it is referred to as a "civil cryptographic product trading license" or "civil cryptographic items dealer license."
To obtain this license, businesses must meet specific requirements given in below part of this article
Note: The civil cryptographic product trading license is different from the Business Registration Certificate issued by the Department of Planning and Investment to enterprises.
Template for the civil cryptographic product trading license
(Includes an appendix detailing the specific product models or series models allowed to trade)
Conditions for obtaining a CCP trading license
To be granted a license for trading civil cryptographic products, businesses must meet the following requirements:
Personnel requirements: Have at least 03 engineers who graduated in one of the following fields: electronics and telecommunications, information technology, mathematics, or cybersecurity. (This is the most critical condition.)
Management requirements: The executive management personnel must meet qualifications related to information security and cryptographic expertise.
Facilities and equipment: Have appropriate facilities and equipment that align with the scale of the business.
Technical plan: Develop a technical plan that complies with applicable standards and technical regulations for civil cryptographic products and services.
Business plan: Prepare a business plan specific to trading civil cryptographic products and services.
Alex Phuong Tran - CEO ExtendMax is the leading expert in Vietnam for CCP licensing
Application dossier and procedures for obtaining a CCP license
CCP license application dossier
The application dossier for a civil cryptographic product trading license includes the following documents:
-
Application form: A request for licensing following the prescribed template in Decree No. 58/2016/NĐ-CP.
-
Business registration certificate: A certified copy of the Enterprise Registration Certificate or an equivalent certificate of legal entity status.
-
Qualifications and certifications: Certified copies of university degrees and relevant certificates related to information security and cybersecurity for technical staff and management personnel.
-
Technical plan: A description of the product's technical specifications, service quality, and technical solutions.
-
Information security plan: A plan ensuring cybersecurity during the provision of civil cryptographic products and services.
-
Business plan: A detailed business plan for trading civil cryptographic products and services.
-
Warranty and maintenance plan: A plan outlining the warranty and maintenance services for products provided to the market.
ExtendMax team sharing experience to each other
Civil cryptographic products licensing authority
After preparing applications dossier, applicant send a hard copy set of application dossier to National Agency of Cryptography And Information Security (NACIS) of Government Cipher Committee (GCC) under Vietnam Ministry of Defense. Process to review application documents should take around 1.5 month – 2 months depending how well the application documents were prepared.
Civil Cryptographic Products and Services Trading License has validity of 10 years. If license holder would like to modify, add more products/services scope, license holder need to apply for license modification. After having the trading license, importer shall have also apply for import permit for importing encryption products
Submission methods for applying CCP licenses
Previously, the submission of applications for a civil cryptographic product license had to be done in paper form. Since 2021, the Department of Civil Cryptographic Management and Cryptographic Product Evaluation has implemented an online submission portal. Currently, public services related to civil cryptographic licenses are at Level 4, including online payment of licensing fees.
Procedures for submitting an application:
-
Register an account on the one-stop portal of the Department of Civil Cryptographic Management and Cryptographic Product Evaluation at:
https://dichvucong.nacis.gov.vn/. The account name must be the enterprise registration number. -
Log in to the enterprise's e-service account.
-
Manually sign and stamp all documents in the application dossier.
-
Digitally sign (using an electronic signature) the scanned copies of the application documents.
-
Upload the digitally signed documents to the one-stop portal.
-
Upon completion, the enterprise will receive an email from dichvucong@nacis.gov.vn, confirming successful submission and providing a temporary dossier code.
-
After preliminary review, if the dossier is accurate and complete, the Department will send an official acceptance email with the official dossier code and inform the enterprise of the expected result issuance date.
-
Upon receiving the original civil cryptographic license, the enterprise completes the payment of related fees and will receive an electronic fee receipt via the registered email within a few days.
Civil cryptographic product import-export license
Once a business has obtained the Civil Cryptographic Product Trading License, it must prepare an application dossier for the Civil Cryptographic Product Import License, which includes:
- Application form requesting the issuance of the import license.
- A copy of the Civil Cryptographic Product Trading License.
- A copy of the Certificate of Conformity for civil cryptographic equipment for products featuring IP stream security using IPSec or TLS technology (this is currently not mandatory).
Previously, the Civil Cryptographic Product Import-Export License was issued with a validity of 2 years. However, since the beginning of 2019, the Government Cipher Committee has limited the validity period to 1 year. This change is believed to prepare for the upcoming requirement for Product Conformity Certification of civil cryptographic equipment.
Once the import license expires, the importing enterprise must reapply for the license, provided that the Civil Cryptographic Product Trading License remains valid.
Template for the civil cryptographic product import/export license
(Includes an appendix detailing the specific products and quantities authorized for import/export.)
Civil cryptographic product conformity certification
According to the Law on Cybersecurity, the Certificate of Conformity for Civil Cryptographic Products is a required document for obtaining an import/export license for civil cryptographic products. Currently, the relevant authorities are in the process of implementing a conformity assessment system (including testing and certification of conformity) for civil cryptographic products. It is expected that by 2025 or 2026, civil cryptographic products will be required to undergo conformity certification procedures before being granted an import license.
>>> Read more: Guidelines on Civil Cryptographic Product Conformity Certification
FAQ about civil cryptographic product licensing
While this article provides detailed guidance, fully understanding the procedures and requirements for importing and exporting civil cryptographic products can still be challenging. Do you have specific concerns about whether these procedures apply to your company’s case? Or are you wondering why your company, which imports civil cryptographic products for production or internal use, still needs to obtain a trading license? Are there any exemptions for civil cryptographic product import/export licenses?
All frequently asked questions related to the trading and import/export of civil cryptographic products are addressed thoroughly in our FAQs and in-depth guidance, with detailed explanations and citations of the relevant legal regulations.
>>> Read more: FAQs and in-depth guidance on civil cryptographic products
ExtendMax’s consulting services for CCP licenses
How does ExtendMax support you in obtaining a CCP license?
As a veteran company with years of experience in consulting and supporting businesses in obtaining civil cryptographic product trading licenses, ExtendMax offers the following specialized services:
→ Our team of legal experts and cryptographic/IT specialists assists clients in evaluating the technical specifications of products. We help businesses identify whether their products fall under the scope requiring a civil cryptographic license or cybersecurity license, or confirm if their products are exempt from licensing for import.
→ Conduct a preliminary assessment of the business's current conditions in comparison to licensing requirements. We provide guidance and solutions for businesses to address any deficiencies that may prevent them from meeting the licensing criteria.
→ Receive and process information from businesses, providing consulting and support to prepare necessary documents, including the technical plan for civil cryptographic products, business plans, cybersecurity plans, and other required documents. All of this is completed as quickly as possible, in full compliance with the authorities' requirements.
→ For products not requiring a license, ExtendMax supplies the relevant legal grounds to support businesses and advises on accurate customs declaration procedures to ensure smooth and prompt customs clearance.
→ In case you are not qualified to be license (not meet the above licensing conditions), ExtendMax can provide Importer of Record services to help you import CCP product into Vietnam.
>>> Read more: How our Importer of Record service can help you to import CCP
Contact ExtendMax now for CCP licensing
Consulting process for obtaining a CCP license with ExtendMax
Step 1: The client sends the Business Registration Certificate and technical documents (datasheet) of the product to ExtendMax.
Step 2: ExtendMax conducts a preliminary evaluation of the licensing conditions and identifies products requiring a license.
Step 3: ExtendMax provides a quotation for the consulting service, including service fees and state administrative fees.
Step 4: Both parties sign a service agreement, and the client makes an advance payment for the service fee.
Step 5: ExtendMax collaborates with the client to prepare the license application dossier.
Step 6: ExtendMax supports the client in creating a public service account (if the client does not already have one).
Step 7: ExtendMax guides and supports the client in submitting the application via the Government Cipher Committee’s public service portal.
Step 8: ExtendMax works with the client to monitor the application process, providing additional documents and information if requested.
Step 9: ExtendMax guides the client in paying the licensing fee to the Department of Civil Cryptographic Management.
Step 10: ExtendMax processes final payments, closes the contract, and issues a VAT invoice.
Step 11: The original license is sent directly by the Department of Civil Cryptographic Management to the client’s registered address.
Contact information for CCP consulting and licensing services
EXTENDMAX VIETNAM COMPANY LIMITED
Hotline: +84 915 836 555 | Hanoi: +84 24 6666 3066
Email: consultant@extendmax.vn | phuong.tran@extendmax.vn
HO: ExtendMax Villa, C01-L18 An Vuong, Duong Noi urban area, Duong Noi ward, Ha Dong district, Hanoi City, Vietnam
If you find our article useful and valuable in practice applications, please support us by rating it, leaving your comment at the bottom of this article, and sharing it with your colleagues or the industry. Your review will be a great motivation for us to write more detailed and valuable procedural guides for importing, exporting organizations.
↓ ↓ ↓ ↓ ↓ ↓ ↓
