Vietnam’s 2026 Civil Cryptographic Product Compliance Requirements: What Customers Need to Know
Updated: Sep 24
Vietnam has introduced a number of important regulatory updates affecting civil cryptographic products, including network security products, data-at-rest protection products, banking-sector cryptographic products, and Hardware Security Modules (HSMs).
These changes are particularly relevant to manufacturers, importers, distributors, and organizations deploying cryptographic products in Vietnam. This article summarizes the key requirements and the available conformity-assessment framework based on the regulatory materials reviewed.
1. Key regulatory updates for civil cryptographic product compliance
The current framework establishes requirements for civil cryptographic products to comply with applicable national technical regulations (QCVNs) before being placed on the Vietnamese market.
Under Decree No. 341/2026, civil cryptographic products must conform to applicable declared standards and corresponding technical regulations in accordance with Vietnamese laws on product and goods quality and on standards and technical regulations.
In addition, Circular No. 126/2026/TT-BQP provides that where a civil cryptographic product is also subject to other applicable laws or national technical regulations, the product must comply with the corresponding QCVNs and undergo conformity assessment, conformity certification, and declaration of conformity according to the applicable risk level and quality-management requirements. The Circular also specifies that duplicate conformity assessment for the same technical requirement should be avoided where that requirement has already been assessed under the corresponding QCVN.
For customers, this means that cryptographic functionality alone is not the only consideration. The product category, intended use, applicable QCVN, and conformity-assessment route should all be identified before market placement.
2. Three major products for civil cryptographic product compliance
The regulatory list identifies three main categories of civil cryptographic products relevant to this framework.
A. IPSec and TLS
This category covers products that perform encryption/decryption and digital signing/authentication of data transmitted over networks.
Examples include security devices or software using technologies such as:
IPsec VPN
TLS VPN
Other network security implementations falling within the defined product scope
The applicable regulation is:
QCVN 12:2022/BQP, together with Amendment 1:2026 to QCVN 12:2022/BQP.
The document describes these products as protecting information that does not fall within the scope of state secrets.
For these products, the required quality-management process includes:
Declaration of conformity based on conformity certification issued by a designated certification organization
Conformity assessment using Method 5 or Method 7 under Circular No. 14/2026/TT-BKHCN
State quality inspection for imported goods in accordance with applicable installation
HS includes:
8471.30.90; 8471.41.90; 8471.49.90; 8517.62.42; 8517.62.43; 8517.62.49; 8517.62.51; 8517.62.53; 8517.62.59; 8517.62.61; 8517.62.69; 8517.62.91; 8517.62.92; 8517.62.99
B. Data-at-rest
The second category covers products designed to encrypt/decrypt stored data.
The document specifically includes products in forms such as:
Smart cards
USB devices
Integrated-circuit memory
Dedicated storage systems
Cloud storage systems
The applicable regulation is:
QCVN 15:2023/BQP, together with Amendment 1:2026 to QCVN 15:2023/BQP.
As with IP Flow Security Products, the requirements include declaration of conformity based on certification by a designated certification organization, with conformity assessment under Method 5 or Method 7. Imported products are subject to state quality inspection in accordance with applicable regulations.
This category is particularly relevant to products such as secure USB devices, encrypted storage products, and other solutions providing cryptographic protection for stored data.
HS Code includes:
8471.80.90; 8523.51.11; 8523.51.21; 8523.51.99; 8523.52.00; 8542.32.00.
C. Civil Cryptographic Products Used in the Banking Sector
The third category concerns products providing encryption/decryption and digital signing/authentication for transmitted, received, or stored data used in the banking sector.
The regulatory framework listed in the document includes:
QCVN 4:2026/BQP – Data Encryption Used in the Banking Sector
QCVN 5:2016/BQP – Digital Signatures Used in the Banking Sector
QCVN 6:2016/BQP – Key Management Used in the Banking Sector
The scope covers a broad range of product types and HS codes, including computing, networking, storage, telecommunications, and other equipment. The product description focuses on cryptographic functions used in banking to protect information that does not fall within the scope of state secrets.
The conformity requirements are again based on:
Conformity certification by a designated certification organization
Method 5 or Method 7 under Circular No. 14/2026/TT-BKHCN
State quality inspection for imported goods, where applications
HS Code includes:
8471.30.90; 8471.41.90; 8471.49.90; 8471.80.90; 8517.62.42; 8517.62.43; 8517.62.49; 8517.62.51; 8517.62.53; 8517.62.59; 8517.62.61; 8517.62.69; 8517.62.91; 8517.62.92; 8517.62.99; 8517.11.00;
3. What are Method 5 and Method 7?
Circular No. 14/2026/TT-BKHCN specifies two conformity-assessment methods relevant to these product groups.
Method 5 involves testing a representative sample of the product type/category together with an assessment of the production process or management system. Surveillance may subsequently be conducted through sample testing and assessment of the production process or management system.
Method 7 involves testing and assessment of a specific batch of products or goods.
The appropriate method therefore depends on the applicable regulatory and product circumstances.
4. Recognition of foreign conformity-assessment results
An important development is Decision No. 4419/2026/QĐ-BQP, which provides for unilateral recognition of conformity-assessment results issued by specified foreign conformity-assessment organizations.
The decision applies to enterprises conducting business in civil cryptographic products and services, exporters and importers of civil cryptographic products, organizations involved in conformity assessment, and other relevant organizations and individuals.
The decision specifically lists the QCVNs covered by the recognition framework, including:
QCVN 12:2022/BQP and Amendment 1:2026
QCVN 15:2023/BQP and Amendment 1:2026
QCVN 4:2026/BQP
QCVN 5:2016/BQP
QCVN 6:2016/BQP
The mandatory cryptographic technical standards applicable to HSMs in electronic identification and authentication activities
The recognition period corresponds to the validity period of the conformity-assessment certificate issued by the foreign organization. Recognition may cease, be suspended, or be withdrawn under the circumstances specified in the decision.
5. Foreign laboratories included in the recognition framework
The document also provides a list of foreign conformity-assessment organizations and indicates their respective areas of coverage.
The listed organizations include laboratories and certification/testing organizations:
Lab | QCVN 12:2022/BQP + Amendment 1:2026 | QCVN 15:2023/BQP + Amendment 1:2026 | HSM – Circular No. 07/2026/TT-BQP | Note |
SGS Digital Trust Services GmbH - Austria | ✓ | |||
EWA - Canada - Canada | ✓ | For HSM | ||
Lightship Security - Canada | ✓ | ✓ | ||
Asia Pacific IT Laboratory - TÜV NORD - Taiwan | ✓ | ✓ | ||
TÜV Informationstechnik GmbH - Germany | ✓ | ✓ | ✓ | |
Atsec Information Security GmbH - Germany | ✓ | |||
Deutsche Telekom Security GmbH - Germany | ✓ | |||
Secuvera GmbH - Germany | ✓ | |||
SGS Brightsight B.V. - Netherland | ✓ | For HSM | ||
Keysight Technologies Netherlands B.V. - Netherland | ✓ | For HSM | ||
Korea Testing & Research Institute (KTR) - South Korea | ✓ | |||
Korea Testing Certification (KTC) - South Korea | ✓ | |||
Korea System Assurance (KOSYAS) - South Korea | ✓ | ✓ | ||
Korea Information Security Technology Evaluation Department (KOSTI) - South Korea | ✓ | |||
Telecommunications Technology Association (TTA) - South Korea | ✓ | ✓ | ✓ | |
CCLab Software Laboratory (Budapest site) - Hungary | ✓ | ✓ | ||
Securelytics SEF - Malaysia | ✓ | |||
Acumen Security - US | ✓ | ✓ | ||
Advanced Data Security - US | ✓ | |||
Atsec Information Security Corporation - US | ✓ | ✓ | ✓ | |
DEKRA Cybersecurity Certification Laboratory - US | ✓ | ✓ | ||
Gossamer Security Solutions - Hoa Kỳ | ✓ | |||
Leidos Accredited Testing & Evaluation (AT&E) Lab - US | ✓ | ✓ | ✓ | |
Lightship Security USA, Inc. - US | ✓ | ✓ | ✓ | |
Aegisolve, Inc. - US | ✓ | |||
Penumbra Security, Inc. - US | ✓ | ✓ | ||
ECSC Laboratory, Inc. - Japan | ✓ | ✓ | ||
Information Security Technology Evaluation Center - Japan | ✓ | ✓ | ✓ | |
OPPIDA - France | ✓ | ✓ | ✓ | |
CEA-LETI - France | ✓ | |||
THALES/CNES - France | ✓ | ✓ | ||
Serma Safety And Security - France | ✓ | For HSM | ||
Seco-An Security Pte Ltd - Singapore | ✓ | |||
UL Verification Services Pte Ltd - Singapore | ✓ | |||
SGS Brightsight Singapore - Singapore | ✓ | ✓ | ||
Dekra Testing and Certification S.A.U. - Spain | ✓ | ✓ | ||
SGS Brightsight Barcelona S.L. - Spain | ✓ | |||
Atsec Information Security AB - Sweden | ✓ | ✓ | ||
Combitech AB - Sweden | ✓ | |||
Intertek Sweden - Sweden | ✓ | |||
Teron Labs - Australia | ✓ | ✓ | ||
Atsec Information Security S.R.L. (Rome site) - Italia | ✓ | ✓ |
The table distinguishes the applicable scopes, including QCVN 12, QCVN 15, and HSM-related requirements.
This provides an important reference point for manufacturers that already hold testing or conformity-assessment results from international laboratories.
However, the applicable scope of each laboratory should be checked carefully. The document shows that not every organization covers every QCVN or HSM requirement.
Conclusion
Vietnam's 2026 regulatory framework introduces a more structured conformity-assessment regime for civil cryptographic products. For manufacturers and importers, the key steps are to:
Identify the product category → determine the applicable QCVN → select the appropriate conformity-assessment route → verify the assessment organization → complete certification/declaration and applicable import requirements.
For products that have already been tested or certified overseas, Decision No. 4419/2026/QĐ-BQP may provide a route for recognition of results from listed foreign conformity-assessment organizations, subject to the applicable scope and validity conditions.
Comments