One Blueprint for State Cyber Defence: Quyết định 1875/QĐ-TTg Issues Việt Nam's National Cybersecurity Architecture Framework

In August the Government told every organisation in Việt Nam how to grade its information systems. Nghị định 331/2026/NĐ-CP set out five security levels, who approves them and what each level requires. That decree did not say what the state’s own defences should look like as a whole: which platforms are built once and shared, which an agency must run itself, and how the parts connect. Quyết định 1875/QĐ-TTg, signed on 30 September 2026, gives that answer for the public sector and for state enterprises that operate critical systems.

What the document is

Quyết định 1875/QĐ-TTg issues the Khung kiến trúc an ninh mạng quốc gia (Phiên bản 1.0), the National Cybersecurity Architecture Framework, version 1.0. Deputy Prime Minister Hồ Quốc Dũng signed it on behalf of the Prime Minister on 30 September 2026. According to Nhân Dân, it took effect on the day it was signed. VTV, Nhân Dân, VietnamPlus, Báo Đầu tư and VietQ all report the same number, signer and date.

The framework is the cybersecurity part of the Khung kiến trúc tổng thể quốc gia số, Việt Nam’s national digital architecture framework. Its stated job is to set “a national-level master plan for technology, data and defence processes”. It also turns into practice the principle of sharing resources and avoiding surplus or duplicate investment in Điều 6 and Điều 30 of Nghị định 331/2026/NĐ-CP. Nhân Dân describes it as a cross-cutting element that protects all four layers of the digital architecture: infrastructure, data, applications and interaction channels.

The framework does not set its own technical controls. Requirements for each system level are left to Nghị định 331/2026 and to the national standard TCVN 14423:2026 (An ninh mạng – Hệ thống thông tin – Yêu cầu cơ bản). According to VietQ, this is the standard’s second edition. It replaces TCVN 14423:2025 and TCVN 11930:2017, sets basic requirements across the same five levels and treats systems important to national security as Level 5. The Cybersecurity and High-Tech Crime Prevention Department of Bộ Công an drafted it, and Bộ Khoa học và Công nghệ published it.

What it sets up

Shared national components. The framework lists four components that are built centrally and that agencies are expected to use rather than duplicate:

a national cybersecurity operations platform (nền tảng điều hành an ninh mạng quốc gia) for unified monitoring, coordination and command of incident response;
a national network defence platform (nền tảng phòng vệ mạng quốc gia), described as a shield for the “digital border” and critical systems;
endpoint data-security infrastructure to protect devices and end users inside agencies and organisations;
the specialised cybersecurity systems that belong to the group of national shared digital platforms.

Two groups of components. The overall design has a “pillar” component, the national cybersecurity architecture itself, and “satellite” components. The satellites are the cybersecurity parts of each agency’s own digital architecture, and they must connect back to the pillar.

Four layers. Both the national architecture and the reference models have the same four layers: (1) cybersecurity infrastructure, (2) cybersecurity data, (3) cybersecurity application and operations platforms, and (4) interaction and measurement channels. At national level, the first three layers are described as shared across the whole political system.

Reference models for those who must comply. The framework sets basic requirements on connecting to and sharing cybersecurity-monitoring data, a rule against buying components that the shared platforms already provide, and minimum requirements by system level. It also provides reference models that the following bodies must use to build or update the cybersecurity part of their own digital architecture:

ministries and ministry-level agencies;
provincial People’s Committees;
state-funded socio-political organisations;
state groups, corporations and enterprises, and public service units, that operate information systems important to national security;
Party bodies, the National Assembly, the Office of the President, the Central Committee of the Fatherland Front, the courts and the procuracies.

At provincial level, the model is built around a provincial cybersecurity centre run by the provincial police (Công an tỉnh). Ministries and central bodies follow the same four layers, adjusted for vertical, sector-by-sector management and stricter secrecy requirements.

Procurement, AI and accountability

According to Nhân Dân, one stated aim is to move away from buying separate pieces of equipment and towards investing in real defensive capability. The goal is to stop money going into outdated or unsuitable technology. Where a component is not yet provided centrally, an agency or locality may rent IT services to secure its systems instead of building them itself.

The framework also sets rules for AI. It favours real-time, data-driven management and prefers AI and automation in operational work. It requires AI systems to be transparent, fair, safe, accountable and explainable, and not to infringe privacy. It specifically calls for monitoring the risks of virtual assistants and generative AI to prevent leaks of sensitive data.

Implementation duties are as follows:

Bộ Công an leads, working with Bộ Khoa học và Công nghệ, Ban Cơ yếu Chính phủ and other ministries. It guides, monitors and evaluates how the framework is applied nationwide, and it develops national standards, technical regulations and technical guidance on cybersecurity.
Bộ Khoa học và Công nghệ keeps the cybersecurity standards of shared platforms and databases compatible with the national digital architecture.
Ministries and provinces must compare their plans against the framework and use the shared components first.
Operators of systems important to national security must fund their own on-site components to at least the minimum for their system’s level and coordinate with Bộ Công an on connection, monitoring and incident response.
Bộ Nội vụ must issue guidance on using a group of cybersecurity indicators as one of the criteria in the annual performance rating of heads of agencies and organisations.

Who it affects

The framework applies directly to the public sector and to state enterprises that operate critical systems. Private companies are not on the list of bodies that must adopt the reference models. They are affected indirectly in three ways.

First, as suppliers: an explicit preference for shared platforms and rented services changes what ministries and provinces will buy. Second, as operators: any private system classified at a given level under Nghị định 331 still has to meet that decree and TCVN 14423:2026, and those are the standards the framework points to. Third, the provincial police centres and the national operations platform become the counterparts for monitoring and incident reporting.

For people working in the public sector, the most concrete change may be the last one listed: cybersecurity results will count towards the annual evaluation of the person in charge.

Open questions

The full text was not yet available in public legal databases at the time of writing, so this post relies on official press summaries. Those summaries mention no deadlines for adopting the framework or connecting to the national monitoring infrastructure. They also do not say which cybersecurity indicators Bộ Nội vụ will use or when its guidance will come out. “Version 1.0” signals that revisions are expected. It is also unclear how renting cybersecurity services will interact with the licensing of cybersecurity vendors under the August decrees, and how existing monitoring centres in ministries and provinces will be merged into the new police-run provincial model.

Sources

This post is general information, not legal advice.