Materials below are only for reference
THE MINISTRY OF INFORMATION AND COMMUNICATION No: 37/2009/TT-BTTTT | SOCIALIST REPUBLIC OF VIET NAM Independence - Freedom - Happiness Ha Noi, day 14 month 12 year 2009 | ||||||
CIRCULAR PRESCRIBING DOSSIERS AND PROCEDURES FOR LICENSING, REGISTRATION AND ACCREDITATION OF INSTITUTIONAL PROVIDERS OF DIGITAL SIGNATURE
CERTIFICATION SERVICES THE MINISTER OF INFORMATION AND COMMUNICATIONS Pursuant to the November 29, 2005 Law on E- Transactions; STIPULATES: Chapter I GENERAL PROVISIONS Article 1. Scope of regulation This Circular prescribes dossiers and procedures for licensing, registration and accreditation of institutional providers of digital
signature certification services, including: 1. Licensing of provision of public digital signature certification services; 2. Suspension or revocation of licenses for provision of public digital signature certification services; 3. Issuance of digital certificates to institutional providers of public digital signature certification services; 4. Registration of operation of institutional providers of specialized digital signature certification services; 5. Issuance of certificates of qualification to assure safety for digital signatures; 6. Recognition of foreign digital signatures and certificates. Article 2. Subjects of application This Circular applies to organizations providing public digital signature certification services; authorities and organizations providing
specialized digital signature certification services; and foreign organizations providing digital signature certification services
which apply for digital signature recognition papers and digital certificates in Vietnam. Chapter II SPECIFIC PROVISIONS Section 1 DOSSIERS Article 3. Dossiers of application for licenses for provision of public digital signature certification services 1. A dossier of application for a license for provision of public digital signature certification services as specified in Article
16 of Decree No. 26/2007/ND-CP comprises: a/ An application for a license, made according to a set form provided in Appendix I to this Circular; b/ Certification rules compliant with Decision No. 59/2008/QD-BTTTT of December 31, 2008, promulgating the list of standards compulsorily
applicable to digital signatures and digital signature certification services; c/ Detailed information on personal identity, qualifications, degrees and diplomas of the head, the person responsible for management
of the system of service-providing equipment, the person in charge of issuance of digital certificates and other relevant staff members. 2. A dossier of application for modification of a license as specified in Clause 2, Article 18 of Decree No. 26/2007/ND-CP comprises: a/ An application for modification of a license, made according to a set form provided in Appendix II to this Circular; b/ A report on operation, covering the general situation, number of issued digital certificates classified, number of revoked digital
certificates and total number of valid digital certificates classified according to their types. 3. In case of application for re-issuance of licenses under Clause 5, Article 18 of Decree No. 26/2007/ND-CP, applications for re-issuance
of licenses shall be made according to a set form provided in Appendix III to this Circular. 4. A dossier of application for extension of a license as specified in Clause 2, Article 19 of Decree No. 26/2007/ND-CP comprises: a/ An application for extension of a license for provision of public digital signature certification services, made according to a
set form provided in Appendix IV to this Circular; b/ A copy of the license for provision of public digital signature certification services which remains valid for at least 60 days
from the date of submission of the dossier; c/ A report on service provision in the last 3 years under Point b. Clause 2 of this Article. Article 4. Dossiers of application for digital certificates for institutional providers of public digital signature certification services Such a dossier comprises: 1. A copy of the license for provision of public digital signature certification services issued by the Ministry of Information and
Communications. 2. The papers specified in Article 21 of Decree No. 26/2007/ND-CP, including: a/ An application for a digital certificate, made according to a set form provided in Appendix V to this Circular. b/ The papers specified in certification rules of the Root Certification Authority of digital signature certification services posted
on its website at http://www.rootca.gov.vn. 3. A request for issuance of a digital certificate in electronic form, made according to the digital signature standards promulgated
by the Ministry of Information and Communications. Such a request must be made by the institutional provider of public digital signature
certification services and compatible with its key pair. Article 5. Dossiers for registration of operation of institutional providers of specialized digital signature certification services Such a dossier comprises: 1. An application for registration of operation of the institutional provider of specialized digital signature certification services,
made according to a set form provided in Appendix VI to this Circular. Contents of registration of operation of institutional providers of specialized digital signature certification services comply with
Article 46 of Decree No. 26/2007/ND-CP. 2. Documents evidencing that entities provided with services have the same operational characteristics or working purposes and associated
with one another by their operation rules or a legal document which defines their common organizational structure or forms of association
and operation satisfying the requirements specified in Clause 2, Article 4 of Decree No. 26/2007/ND-CP. Article 6. Dossiers of application for certificates of qualification to assure safety for digital signatures of institutional providers of specialized
digital signature certification services A dossier application for a certificate of qualification to assure safety for digital signatures complies with Article 49 of Decree
No. 26/2007/ND-CP and comprises: 1. An application for a certificate, made according to the form provided in Appendix VII to this Circular. 2. The Ministry of Information and Communications' written approval of the registration of operation of the institutional provider. 3. Detailed information on personal identity, qualifications, degrees and diplomas of the head, the person responsible for management
of the service-providing equipment system, the person in charge of issuance of digital certificates and other relevant staff members. Article 7. Dossiers of application for papers of recognition of foreign digital signatures and certificates A dossier of application for a paper of recognition of foreign digital signatures and certificates complies with Article 53 of Decree
No. 26/2007/ND-CP and comprises: 1. An application for recognition of foreign digital signatures and certificates, made according to a set form provided in Appendix
VIII to this Circular. 2. The original full text and a Vietnamese translation of the bilateral treaty providing the recognition of foreign signatures and
certificates to which Vietnam has signed or acceded with the country where the institutional provider of digital signature certification
services has registered its operation. 3. A valid copy (notarized or otherwise legally certified) of the license or the certificate of qualification for provision of digital
signature certification services in the host country. 4. A certificate of operation of the institutional provider of digital signature certificate services issued by a competent authority
of the host country within 3 months before the date of submission of the registration dossier. 5. Technical documents proving that the reliability of digital signatures and certificates issued by the foreign institutional provider
of digital signature certificate services is not lower than that of digital signatures and certificates issued by a Vietnamese institutional
provider of public digital signature certification services and at least satisfies the standards on the list of standards compulsorily
applicable to digital signatures and digital signature certification services promulgated by the Ministry of Information and Communications. 6. A valid copy of the license for a Vietnam-based representative office. Section 2 ORDER AND PROCEDURES Article 8. Procedures for licensing provision of public digital signature certification services 1. Submission and receipt of dossiers Organizations applying for licenses for provision of public digital signature certification services (issuance of new licenses, modification,
re-issuance or extension of issued licenses) shall send their dossiers by post to or directly file them with the Ministry of Information
and Communications (the Department for Information Technology Application), at 18 Nguyen Du street, Hai Ba Trung district, Hanoi. Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the
dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant
for modification or supplementation of the dossier. 2. Verification of dossiers The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units under regulations. Consulted
agencies and units shall give their written verifications and take responsibility for these dossiers' matters under their management. 3. Decision on licensing Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall issue a license; modify,
re-issue or extend an issued license. Licenses for provision of digital signature certification services are made according to a
set form provided in Appendix IX to this Circular. In case of refusal to issue a license, the Ministry of Information and Communications shall notify such in writing to the applicant,
clearly stating the reason. Article 9. Procedures for suspension or revocation of licenses for provision of public digital signature certification services 1. Institutional providers of public digital signature certification services shall have their licenses suspended in any of the cases
specified in Clause 1, Article 20 of Decree No. 26/2007/ND-CP; or revoked in any of the cases specified Clause 2, Article 20 of Decree
No. 26/2007/ND-CP. 2. Within 15 working days after the date of issuance of a decision on suspension of a license, if the organization with a suspended
license fails to satisfy the condition for the lack of which the license is suspended, the Ministry of Information and Communications
shall revoke the license under Point d, Clause 2, Article 20 of Decree No. 26/2007/ND-CP. For other cases of license revocation specified at Points a, b and c, Clause 2, Article 20 of Decree No. 26/2007/ND-CP, the Ministry
of Information and Communications shall issue decisions on license revocation after notifying it in writing to these organizations. 3. The Ministry of Information and Communications shall restore licenses if organizations with suspended licenses can satisfy
the condition for the lack of which their licenses have been suspended within the prescribed time limit. 4. The Root Certification Authority shall publicize the suspension, restoration or revocation of licenses on its website at http://www.rootca.gov.vn., and notify them in writing to concerned organizations and individuals. Article 10. Procedures for issuance of digital certificates to institutional providers of public digital signature certification services 1. Submission and receipt of dossiers An institutional provider of public digital signature certification services applying for a digital certificate shall send 5 dossier
sets (1 original and 4 copies) by post to or file them directly with the head office of the Root Certification Authority at 6 Chua
Mot Cot street, Ba Dinh district, Hanoi. Within 5 working days after receiving a dossier, the Root Certification Authority shall examine the validity of the dossier. In case
of an invalid dossier, the Root Certification Authority shall notify such in writing to the applicant for modification or supplementation
of the dossier. 2. Verification of dossiers a/ Within 30 days after receiving a valid dossier, the Root Certification Authority shall verifiy the dossier and consider the application; b/ In case the public key of the digital certificate applicant is identical to the public key of any institutional provider of public
digital signature certification services which has been issued a digital certificate, the Root Certification Authority shall request
the applicant to create a new key pair; c/ Physical verification of the conditions for issuance of a digital certificate at the institutional provider of public digital signature
certification services. 3. Issuance of digital certificates a/ The Root Certification Authority shall issue digital certificates to applicants if their dossiers are valid and they satisfy all
the prescribed conditions; b/ The Root Certification Authority shall hand over digital certificates and notices of issuance of digital certificates to applicants
and update information on its website at http://www.rootca.gov.vn; c/ The Root Certification Authority shall maintain an online database on issued digital certificates on its website. Article 11. Procedures for registration of operation of institutional providers of specialized digital signature certification services 1. Submission and receipt of dossiers Institutional providers of specialized digital signature certification services shall send registration dossiers by post to or file
them directly with the Ministry of Information and Communications (the Department for Information Technology Application), at 18
Nguyen Du street, Hai Ba Trung district, Hanoi. 2. Acceptance of registration a/ The Ministry of Information and Communications shall examine dossiers of registration for provision of specialized digital signature
certification services; b/ Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall notify registry offices
in writing of its acceptance of the operation registration of the institutional provider of specialized digital signature certification
services. Notices of acceptance are made according to the form provided in Appendix X to this Circular. In case of non-acceptance, the Ministry of Information and Communications shall notify such in writing to registry offices, clearly
stating the reason. Article 12. Procedures for issuance of certificates of qualification to assure safety for digital signatures to institutional providers of specialized
digital signature certification services 1. Submission and receipt of dossiers Institutional providers of specialized digital signature certification services applying for a certificate of qualification to assure
safety for digital signatures shall send their dossiers by post to or file them directly with the Ministry of Information and Communications
(the Department for Information Technology Application) at 18 Nguyen Du street, Hai Ba Trung district, Hanoi. Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the
dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant
for modification or supplementation of the dossier. 2. Verification of dossiers The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units under regulations.
Consulted agencies and units shall give their written verifications and take responsibility for these dossiers' matters under their
management. 3. Issuance of certificates Within 60 working days after receiving a valid dossier, the Ministry of Information and Technology shall issue a certificate of qualification
to assure safety for digital signatures, made according to the form provided in Appendix XI to this Circular. In case of refusal to issue a certificate, the Ministry of Information and Communications shall notify such in writing to the applicant,
clearly stating the reason. Article 13. Procedures for recognition of foreign digital signatures and certificates 1. Submission and receipt of dossiers Institutional providers of foreign digital signature certification services applying for a paper of recognition of foreign digital
signatures and certificates shall send their dossiers by post to or file them directly with the Ministry of Information and Communications
(the Department for Information Technology Application) at 18 Nguyen Du street, Hai Ba Trung district. Hanoi. Within 5 working days after receiving a dossier, the Ministry of Information and Communications shall examine the validity of the
dossier. In case of an invalid dossier, the Ministry of Information and Communications shall notify such in writing to the applicant
for modification or supplementation of the dossier. 2. Verification of dossiers The Ministry of Information and Communications shall verify dossiers and consult concerned agencies and units. Consulted agencies
and units shall give their written verifications and take responsibility lor these dossiers' matters under their management. 3. Issuance of papers of recognition Within 60 working days after receiving a valid dossier, the Ministry of Information and Communications shall issue a paper of recognition
of foreign digital signatures and certificates, made according to the form provided in Appendix XII to this Circular. In case of refusal to issue a paper of recognition, the Ministry of Information and Communications shall notify such in writing to
the applicant, clearly stating the reason. Article 14. Fees and charges Agencies and organizations shall pay fees and charges according to regulations when carrying out procedures for licensing, registration
or recognition of institutional providers of digital signature certification services. The Root Certification Authority shall organize
the payment and collection of these fees and charges under regulations. Chapter III ORGANIZATION OF IMPLEMENTATION Article 15. Responsibilities of the Department for Information Technology Application 1. To guide and inspect agencies and organizations in carrying out procedures for licensing, registration and recognition of digital
signature certification services under this Circular. 2. To take necessary measures to facilitate the management of the provision of digital signature certification services. 3. To publish forms and documents relevant to procedures for licensing, registration and recognition of institutional providers of
digital signature certification services on the website http://www.rootca.gov.vn. The Root Certification Authority shall guide the forms and update information related to the licensing, registration and recognition
of institutional providers of digital signature certification services on this website. Article 16. Effect 1. This Circular takes effect on February 1, 2010. 2. Any problem arising in the course of implementation should be promptly reported to the Ministry of Information and Communications
for consideration, amendment or supplementation. | |||||||
| |||||||