AesirX ComplianceOne | Decree 85/2016/NĐ-CP Information System Security Levels

This instrument is presented beneath the Vietnam Cybersecurity Law 2025 as transition context, not as one of its implementing decrees. Its own legal parent is Law 86/2015/QH13, a Ministry of Information and Communications stack, and its criteria are not the Cybersecurity Law's criteria.

That distinction matters operationally. Law 116/2025/QH15 Điều 8 also sets five levels, but it grades them by the degree of harm an incident or a violation would cause, and Điều 8 khoản 2 leaves the detailed determination criteria, the competence and the procedure to a Government decree. Decree 85 grades a system by what it serves and what information it processes. The two scales share their numbering and answer different questions, so a determination must name which one it was made under. Điều 9 of the new Law is a third thing again: the designation of a system as important to national security, which is a decision of the Prime Minister on the Ministry of Public Security's proposal, and is not a level at all.

Cross-links preserve related evidence without promoting a superseded stack into current law or collapsing two scales into one.

The five levels are carried as regulatory content, with each level's text transcribed from the article that defines it and an English rendering prepared by AesirX, Decree 85 has no official English translation. Regulatory Classification, the Subject Register leaf under Data Mapping, offers those levels for any system in your inventory once the framework is installed.

An operator records the system's kind under Điều 6, the level they have determined and their reasoning, and any component systems with their own levels. Where components are declared, the highest component level is applied and the record states that it was a component that raised the result rather than the system's own answers.

The determination is the operator's, and the approval is the authority's. The decree fixes a system's level through a process: the system owner lodges a level-proposal dossier, it is appraised, and it is approved by the competent body. ComplianceOne records the determination, the rationale and the reviewer who signed it off. It does not determine the level and nothing in it substitutes for the approval decision.

Approving a determination instantiates the protective measures that follow from it, drawn from the requirements of the installed frameworks that attach duties to a classification of that kind, the framework that publishes the scheme, and any framework that declares it places obligations on the result, rather than from any control catalogue of ours. The instrument that publishes a scheme and the instrument that says what to do about landing on a level are routinely two different documents, and both contribute. This is not legal advice, and it does not guarantee compliance, certification, or acceptance by an authority.

Built for Information System Security Operations

A level is only useful if you can say how you arrived at it. Each determination keeps the system kind, the criteria relied on, the rationale, the reviewer and the date in one record.

The composite-system rule is applied because the decree states it, and the record shows when it changed the answer, so a reviewer can see that a component drove the level rather than having to reconstruct it.

Two five-level scales are now in force in Vietnam and they are not the same scale. Every determination names which instrument it was made under, which keeps the transition legible instead of merging the two.