Guide to Procedures for Obtaining Business and Import-Export Licenses for Civilian Cryptographic Products

1. What are Civilian Cryptographic Products?

Civilian cryptographic products include documents and equipment using cryptographic techniques to protect non-national security information. These products are commonly used in large enterprises' information technology systems, especially in sectors like banking, finance, and other high-security areas.

Civilian cryptographic products can be in the form of software or hardware, using either symmetric or asymmetric encryption algorithms. However, not all products using cryptography techniques are considered civilian cryptographic products. Common devices like laptops, smartphones, or operating systems with pre-installed encryption are not classified as civilian cryptographic products.

2. Categories of Civilian Cryptographic Products

Civilian cryptographic products are divided into two main groups:

• Group 1: Products requiring a business license, as listed in Annex 1 of Decree 58/2016/ND-CP.

• Group 2: Products requiring both a business license and an import-export license, as stipulated in Decree 32/2023/ND-CP.(Note: Group 2 is a subset of Group 1)

3. Conditions for Obtaining a Business License for Civilian Cryptographic Products

According to Article 4 of Decree 58/2016/ND-CP, the following conditions must be met to obtain a business license for civilian cryptographic products:

• Professional Team: Businesses must have a team with expertise in security and information safety. At least two engineers should have a university degree in fields such as electronics, telecommunications, information technology, mathematics, or information security.

• Technical Infrastructure: Suitable equipment and facilities must be available based on the scale of the products and services being offered.

• Security Plan: Businesses must have a comprehensive security plan to protect network information during product management and delivery.

• Business Plan: A business plan must be in place, reflecting the scale, scope, and customer base of the company.

4. Documentation and Procedure for Applying for a Business License for Civilian Cryptographic Products

4.1. Documents for Business License Application

• Application form as per the model in Decree 58/2016/ND-CP.
• A copy of the enterprise registration certificate or equivalent legal certificate.
• Copies of university degrees and certifications related to security and information safety for technical staff and managers.
• Technical plans (describing product specifications, service quality, and technical solutions).
• Network security plans.
• Business plans for cryptographic products and services.
• Warranty and maintenance plans for products.

4.2. Receiving Agency and Application Process

The National Cryptography and Certification Authority (NACIS) under the Government Cipher Committee is the responsible body for receiving and processing applications for business and import-export licenses for civilian cryptographic products. The review process for first-time applications typically takes 1.5 to 2 months, depending on the completeness and detail of the application.

The business license for civilian cryptographic products is valid for 10 years. If the company wishes to expand its product range or make changes related to the license, it must submit supplementary documents or modifications according to the Cybersecurity Law No. 86/2015/QH13.

4.3. Submission Method and Application Process

Previously, the application had to be submitted in paper form. However, since 2021, NACIS has allowed online submission via the one-stop portal. The service now supports online payments.

The application process is as follows:

• Register an account on NACIS's one-stop portal (https://dichvucong.nacis.gov.vn/).
• Log into the company's account.
• Sign and stamp the application documents.
• Digitally sign the scanned copies of the documents.
• Upload the signed documents to the portal.
• Once completed, the company will receive an email with a temporary application number.
• After review, NACIS will send an email with an official receipt code and the expected result date.
• After receiving the original business license, the company will pay the relevant fees and receive an electronic receipt via email.

Important Notes:

• If a product has both civilian cryptography features and network security features, only one cryptographic license and the corresponding import-export license are required (according to Circular 10/2020/TT-BTTTT).
• Some products must apply for a civilian cryptographic business license (Annex 1 of Decree 58/2016/ND-CP), even if an import-export license is not necessary.
• Secondary distributors of civilian cryptographic products must also obtain a business license, even if they do not directly import the products.

5. Conditions for Obtaining an Import-Export License for Civilian Cryptographic Products

To obtain an import-export license for civilian cryptographic products, businesses must meet the following conditions, as stipulated in Clause 2 of Article 34 of the Cybersecurity Law 2015:

• Possess a business license for civilian cryptographic products.

• The imported product must meet the compliance certification requirements as per Article 39 of the Cybersecurity Law 2015.

• The product must not pose a risk to national defense or security.

6. Documentation and Procedures for Applying for an Import License for Civilian Cryptographic Products

Once a business license is obtained, the company must prepare documentation for the import license, which includes:

• Application form for an import license.
• A copy of the business license for civilian cryptographic products.
• A copy of the compliance certification for cryptographic devices, for products featuring IP encryption technologies like IPSec or TLS (currently not mandatory).

Note: The import license is valid for one year. Companies must apply for an extension before the license expires.

7. Compliance Certification for Civilian Cryptographic Products

Under the Cybersecurity Law, compliance certification for civilian cryptographic products is required when applying for an import-export license. Regulatory bodies are currently establishing a system for evaluating compliance, which includes testing and certification for civilian cryptographic products. It is expected that from 2025 or 2026, all civilian cryptographic products will need to complete the compliance certification process before being granted an import license.

8. Comprehensive Customs Services for Civilian Cryptographic Products

Real Logistics offers comprehensive customs services for civilian cryptographic products, covering everything from obtaining industry licenses to customs clearance and delivery. With an experienced team well-versed in customs procedures and legal regulations in Vietnam, Real Logistics helps you overcome obstacles in the import process, saving time and costs.

If you wish to expand your import operations for civilian cryptographic products, contact Real Logistics for advice and pricing. We are ready to assist you!

—————————————

Real Logistics Co.,Ltd

👉 Facebook: Real Logistics Co.,Ltd

☎️ Hotline: 028.3636.3888 | 0936.386.352

📩 Email: info@reallogistics.vn | han@reallogistics.vn

🏡 Address: 39 - 41 B4, An Loi Dong, Thu Duc, HCM City

                     51 Quan Nhan, Nhan Chinh, Thanh Xuan, Ha Noi City