DPO Radio
AesirX ComplianceOne | Decree 343 Cyber-Conflict Response
ACTIVE
Decree 343/2026/NĐ-CP – Cyber-Conflict Response
Govern authority-response evidence from assessment through outcome reporting
Record event assessments, authority directions, condition reviews and remediation evidence with accountable human approval.
Decree 343/2026/NĐ-CP: Scope and Current Status
Decree 343 matters to you if you own military information systems, supply military-purpose cybersecurity products or services, or deal with the authorities on information conflict in cyberspace. Which duties apply depends on those facts. Being located in Vietnam is not enough on its own.
The Government of Vietnam issued Decree 343/2026/NĐ-CP on 3 September 2026, and it took effect that day under Article 49(1). Its 50 articles in five chapters detail the Cybersecurity Law within the Ministry of National Defence's remit.
The decree has two halves:
- Articles 5–28 cover military information systems and military-purpose cybersecurity products and services: appraisal, security conditions, data protection and the handling of unlawful information.
- Articles 29–48 cover information conflict in cyberspace: monitoring, identifying sources, filtering, remediation, elimination and cooperation.
Article 49(1) repeals Decree 142/2016/NĐ-CP. Under Article 49(2), specified existing military systems have a twelve-month transition from 3 September 2026. Keep each system's earlier determination on file and record whether the transition applies to it.
How Decree 343 Relates to the Vietnam Cybersecurity Law 2025
Use the law for the legal context and the decree for the procedure, the authority, the conditions and the evidence. The Vietnam Cybersecurity Law 2025 sets the statutory baseline. Decree 343 adds the detail for the Ministry of National Defence's cybersecurity responsibilities and for information-conflict response.
Each of the other implementing decrees keeps its own scope and response periods. In particular, Decree 333's response clocks do not carry over to information-conflict records under Decree 343. Where an event also involves personal data or another cybersecurity procedure, keep each set of obligations and approvals separate, even when the evidence is shared.
Technical Provisions and Compliance Obligations
| Provision | What It Covers or Requires | Operational Implication |
|---|---|---|
| Articles 7, 10 and 12 | Military-system level appraisal, cybersecurity appraisal and security-condition evaluation | Identify the applicable procedure and retain receipt, evaluation, result and certificate evidence |
| Article 25(1), (4) | Unlawful-information action and related electronic-data supply within the Ministry of National Defence remit | Record the request, applicable normal or emergency period, action and completion evidence |
| Articles 29–30 | Information-conflict monitoring, receipt and handling | Preserve the report, source material, responsible authority and handling decision |
| Articles 31–33 | Identification of information-conflict sources | Link source-identification evidence to the reviewed assessment |
| Article 34(1) | Filtering based on any one of three stated factors | Document which factor supports the decision; do not turn the test into an all-three requirement |
| Article 35 | Remediation requiring all three stated conditions, with outcome reporting | Evidence each condition and preserve the remediation plan and outcome report |
| Article 36 | Elimination factors, with no explicit relationship stated among the three factors | Record the factors and legal review without inventing an any-one or all-three test |
| Article 37 and Articles 47–48 | Coordination and provider responsibilities | Maintain authority correspondence, assigned responsibilities and cooperation evidence |
| Article 49 | Repeal and transition | Record applicable prior-system evidence and the separate twelve-month transition |
| Obligation | Timeline | Reference |
|---|---|---|
| Level-3 military-system classification appraisal | 7 working days | Article 7(3)(b) |
| Level-4 appraisal | 10 working days | Article 7(3)(c) |
| Level-5 appraisal | 15 working days | Article 7(3)(d) |
| Appraisal receipt certificate / appraisal result | 3 / 10 working days respectively | Article 10(1)(b)–(c) |
| On-site survey or evaluation | Maximum 7 working days | Article 10(3) |
| Condition evaluation and certificate / deficiency notice | 10 / 3 working days respectively | Article 12(2)(c) |
| Removal, correction or cessation | Maximum 6 hours; maximum 1 hour in an emergency | Article 25(1) |
| Related electronic-data supply | Maximum 24 hours; maximum 6 hours in an emergency | Article 25(4) |
| Specified existing military-system transition | 12 months from 3 September 2026 | Article 49(2) |
Each period applies only to its own procedure and trigger. Articles 29–48 set no numeric response period for information conflict. If you set an internal response target, label it as your own target, not a statutory deadline.
Working Records and Certificate Forms
Decree 343 has no numbered official filing form in its annexes. The remediation plans, outcome reports and condition reviews you keep in ComplianceOne are internal working records, not official forms. Under Article 6, the Ministry of National Defence issues the training-certificate form separately, so treat it as a ministry form rather than part of this decree.
How ComplianceOne Supports Decree 343 Compliance
The Authority Directions register keeps each direction in one record: the authority, its stated legal basis, the affected systems, the scope of data supplied, technical-action evidence, approvals and the restoration decision. An authorized person chooses the event classification and records why.
The four classification options are ordinary security incident, serious cyberattack, unlawful or false-content action, and information conflict. They route the work to the right laws. They are a working aid, not a four-part classification set by law.
Condition reviews follow the decree's own tests: any one factor for filtering under Article 34, all three conditions for remediation under Article 35, and no stated relationship for elimination under Article 36. Remediation plans and outcome reports are versioned and stay attached to the direction. Reviewers can see what was proposed, approved and reported.
Releasing protected data requires a legal review and a minimized scope. Without both, ComplianceOne blocks the release and records the refusal. This is an evidence and approval control. ComplianceOne does not send data to an authority, decide whether an event is information conflict, or carry out filtering, removal or remediation on external systems.
Built for Reviewed Information-Conflict Response
Each authority direction stays linked to the assessment a person made, the condition evidence and the approved action. Reviewers can tell the filtering basis from the remediation conditions without piecing the decision together from separate messages.
Versioned plans and outcome reports show how the response developed and what was reported. Each protected-data release keeps its legal review and minimized scope, so later reviewers can see the disclosure decision and the evidence behind it.
Related Modules
Incident Operations
Coordinates investigation and remediation work with linked technical-action evidence
Explore Incident Operations
Incident Response
Connects response records and authority interactions to the reviewed event context
Explore Incident Response
Program Governance
Assigns owners for applicability reviews, procedure tracking and transition work
Explore Program Governance
Audit Trail
Preserves decision, contributor, approval and change history for subsequent review
Explore Audit TrailCompliance Readiness Checklist
Organizations implementing applicable Decree 343 procedures should confirm:
See Decree 343 Compliance in Action
See how ComplianceOne connects an authority direction to human assessment, condition evidence, remediation versions and outcome reporting.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Decree 343/2026/NĐ-CP was issued and took effect on 3 September 2026. The Government's explanatory article appeared on 4 September, but the decree's commencement date is 3 September. It covers the Ministry of National Defence's cybersecurity responsibilities, military information systems, military-purpose cybersecurity products and services, and the prevention and handling of information conflict. Whether it applies to you depends on whether you own such systems, supply such products or services, or deal with the authorities on them. Being in Vietnam is not enough on its own.
No. Articles 29–48 of Decree 343 set no numeric response period for information conflict. Article 25 sets separate periods for acting on unlawful information: six hours, or one hour in an emergency. Supplying related electronic data has its own period: twenty-four hours, or six hours in an emergency. These periods apply only to those events. Neither they nor Decree 333's clocks become a general information-conflict deadline.
Each has a different test. Filtering under Article 34(1) needs any one of three factors. Remediation under Article 35 needs all three conditions. Elimination under Article 36 lists three factors without saying how they relate. ComplianceOne keeps these tests separate in its condition reviews, so an authorized person records the evidence and the decision without an invented test.
Decree 343 has no numbered official filing form in its annexes. ComplianceOne's versioned remediation plans and outcome reports are internal working records. Releasing protected data requires a legal review and a minimized scope, and ComplianceOne blocks and logs any release without them. It records the approval and the evidence; it does not send the data to an authority.
Article 49(1) repeals Decree 142/2016/NĐ-CP. Article 49(2) gives specified existing military systems twelve months from 3 September 2026 to transition. Check whether each system qualifies, keep its earlier determination and record the transition work. ComplianceOne tracks owners and evidence; your organization and its advisers decide the legal scope.
Next Steps
Start a Compliance Pilot
Test authority-direction assessments, condition reviews and remediation evidence with your response team.
Discuss Your Compliance Needs
Review your Decree 343 scope, authority-response records, protected-data approvals and transition evidence.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
