Vietnam's Decree 322/2026/NĐ-CP for Cybersecurity Products: New HS Code and Product Management including routers and switches.
- Tron Chan
- 2 hours ago
- 3 min read
Vietnam has introduced Decree 322/2026/NĐ-CP, establishing a new regulatory framework for the business, import, and export of cybersecurity products and services. One of the most important changes for manufacturers, distributors, and importers is the introduction of an HS Code-based control list that identifies which cybersecurity products require licensing by the Ministry of Public Security. The Decree will take effect on 19 August 2026.
If your company imports networking or security equipment into Vietnam, this decree is worth paying close attention to.
HS Code list for cypersecurity products officially brought under Decree 322/2026/NĐ-CP
Appendix II of Decree 322/2026/NĐ-CP introduces a dedicated list of cybersecurity products that are subject to import and export licensing. Instead of regulating products only by their commercial names, the decree links product categories with specific HS Codes, creating a clearer compliance framework for customs and regulatory authorities.
HS Code | Managed product categories |
8471.30.90 | Personal Computer / Server Protection; Mobile Security; NAC; Network Firewall; IPS/IDS; DDoS Prevention; IoT Security; SIEM; UTM; Network Monitoring; VPN/IP Security; WAF; Email Security; Web Application Security; Vulnerability Assessment; Database Security; Data Storage Security; DLP; Threat Intelligence; Centralized Monitoring; Cybersecurity Testing; Incident Response; ICS Security; Other Cybersecurity Products |
8471.41.90 | Same product categories as HS 8471.30.90 |
8471.49.90 | Same product categories as HS 8471.30.90 |
8517.62.43 | Firewall, IPS/IDS, DDoS, SIEM, UTM, Network Monitoring, VPN/IP Security, WAF, Email Security, Threat Intelligence, Centralized Monitoring, ICS Security, and other cybersecurity networking products |
8517.62.49 | Personal Computer / Server Protection; Mobile Security; NAC; Network Firewall; IPS/IDS; DDoS Prevention; IoT Security; SIEM; UTM; Network Monitoring; VPN/IP Security; Threat Intelligence; Centralized Monitoring; Cybersecurity Testing; Incident Response; ICS Security; Other Cybersecurity Products |
8521.90.99 | Covert Information Collection & Digital Forensics Products |
8525.60.00 | Covert Information Collection & Digital Forensics Products |
8525.81.90 | Covert Information Collection & Digital Forensics Products |
8525.82.90 | Covert Information Collection & Digital Forensics Products |
8525.89.90 | Covert Information Collection & Digital Forensics Products |
A newly regulated cybersecurity product category: Covert Information Collection & Digital Forensics Products
A notable addition in the new HS Code list is Group 24, which appears as a newly regulated cybersecurity product category under Decree 322/2026/NĐ-CP. This group includes digital camera and broadcast devices.
This reflects the government's expansion of cybersecurity oversight beyond traditional security appliances and demonstrates a broader approach to regulating technologies that may impact national cybersecurity. Businesses dealing with products falling into Group 24 should review their HS Code classification and prepare for licensing requirements before import or export.
Routers and switches are now covered under Decree 322/2026/NĐ-CP
Perhaps the most significant practical change is IP Security Products.
Under this category, widely deployed networking equipment—including routers, switches, gateways, and similar IP networking devices—can fall within the regulatory scope when they provide IP security or secure network communication functions. The decree maps these products to the relevant HS Codes under heading 8517, making them subject to cybersecurity import/export licensing where applicable.
For network equipment vendors and enterprise infrastructure suppliers, this means that products previously treated as ordinary networking devices may now require additional compliance review before entering the Vietnamese market.
Cryptographic products remain outside Decree 322/2026/NĐ-CP
Equally important is what the decree does not regulate.
Decree 322/2026/NĐ-CP explicitly excludes civil cryptographic products and services from its scope. This means products such as:
Hardware Security Modules (HSM)
Cryptographic tokens
USB security tokens
Encryption key management devices
Other civil cryptographic products
are not regulated under Decree 322/2026/NĐ-CP. Instead, these product groups continue to be managed by NACIS (National Authority of Cryptography and Information Security) under the Government Cipher Committee, through the separate regulatory framework for civil cryptography.
What businesses should do next
Organizations importing or distributing cybersecurity and networking products in Vietnam should begin preparing by:
Reviewing product HS Code classifications regarding the new decree.
Identifying whether routers, switches, VPN gateways, or security appliances fall under the new law.
Determining whether newly introduced group products for camera affect their portfolio.
Separating cybersecurity products from civil cryptographic products to ensure compliance with the correct licensing authority.
Decree 322 marks an important shift toward HS Code-driven cybersecurity regulation, and early classification review will help businesses avoid customs delays and licensing issues as the new framework takes effect.
Comments