No Default Passwords, No Open Ports: Việt Nam Sets Cybersecurity Rules for State-Run Camera Networks

Earlier this year Việt Nam set cybersecurity rules for the cameras themselves. In May 2026 the Ministry of Public Security issued QCVN 11:2026/BCA, a market-wide regulation on IP surveillance cameras, through Thông tư 48/2026/TT-BCA. It took effect on 1 July 2026. Those rules covered the device on the pole. They did not cover the system behind it, where footage is recorded, stored, streamed and viewed.

Thông tư 167/2026/TT-BCA covers that system for the state sector. The Minister of Public Security, Đại tướng Lương Tam Quang, signed it on 30 September 2026, on the proposal of the Cục An ninh mạng (Cybersecurity Department). The Government’s legal-documents portal posted the signed text on 15 October. The circular issues QCVN 14:2026/BCA, the national technical regulation on cybersecurity for surveillance camera systems in state agencies. It takes effect on 1 June 2027.

What the document is

The circular itself has three articles: it issues the regulation, sets the effective date and assigns enforcement to the Cục An ninh mạng. The real content is the attached 35-page regulation. It cites Luật An ninh mạng 116/2025/QH15 and Luật Bảo vệ dữ liệu cá nhân 91/2025/QH15 as its legal bases. Its bibliography names ITU-T F.743.23 (2023), ITU-T X.1453 (2022) and Taiwan’s TAICS TS-0014/TS-0015 video surveillance cybersecurity standards as references.

The regulation covers three kinds of camera system:

camera systems guarding important works related to national security;
cameras run by state agencies and state-owned enterprises for public security and order, and for smart-city monitoring and operations;
cameras used for public security, handling violations and traffic control.

It applies to every state agency, organisation and state-owned enterprise that builds, invests in, deploys or operates such a system. Some systems are excluded: combat and reconnaissance cameras, and cameras in interrogation rooms, prisons, detention camps and holding facilities. A system that already has an approved security level (cấp độ) and has fully deployed the matching cybersecurity plan is also exempt.

The requirements, component by component

The regulation breaks a camera system into six parts and sets testable requirements for each. Section 3 gives a test procedure and a pass/fail criterion for every requirement.

IP cameras must meet QCVN 11:2026/BCA. This makes the May product regulation a precondition for any state deployment.
Video recorders (NVR/DVR). There are eight requirements. Recorders must block executable files loaded from USB or eSATA ports, except signed firmware. They must let operators disable unused network and logical interfaces, and raise an alert when free storage drops below a threshold. They must detect or prevent splicing and tampering with recorded files, and encrypt footage when it is transmitted, exported or backed up offline. They must refuse unverified third-party apps. The manufacturer’s default admin account and password must be reset before go-live and must not remain usable. Firmware updates, including OTA updates, must be signed, and the recorder must roll back to a stable version if an update fails.
The network. Only secure protocols may be open. ONVIF must run over HTTPS/TLS with the appropriate Profile G/T/M. The camera zone must be segmented from other networks and reached only under an access-control policy. Devices must be admitted at least by MAC address control and synchronised to a time server. Remote administration must use an encrypted, mutually authenticated channel. The management ports of cameras, recorders and edge devices must never be exposed directly to the public Internet.
Storage. Local storage with two or more disks must support RAID. With three or more disks it must support automatic rebuild onto a hot spare. Cloud storage must use at least TLS 1.2 over the public Internet, or an encrypted private link such as a site-to-site IPsec VPN. Uploading devices may get write-only rights, with no rights to view, edit or delete. The cloud store must support WORM (write once, read many) and secure overwrite or deletion when the retention period ends.
Video management software (VMS). There are ten requirements. All video, audio and control traffic must be encrypted, and stream integrity must be checked to catch injected or forged data. Users and end devices must be authenticated before they connect. Access must be role-based and also scoped per camera and per recorder. At the time of assessment the software may have no published vulnerability rated critical or high on CVSS, and it must stop brute-force password attacks. Every user action must be logged with who, when, what and on which object. The software must embed a watermark in the video. The server may open only the ports declared in the design documents, and APIs must be protected, with authentication, authorisation and session control on every request.
Edge devices sit between cameras and the central system, for example boxes that run video analytics. Each needs its own certificate or key, with no shared passwords or certificates across devices. They must use secure boot and run only signed firmware. They may talk only to their designated receiving service, with no direct Internet access and no lateral connections to other cameras. Cached footage and metadata must be encrypted and deleted automatically when retention ends. The device must detect tampering, such as an opened case, a pulled module or replayed old video, and then alert or isolate itself.

What changes compared to before

Until now, state camera projects had no camera-specific binding security baseline. They relied on general information-security rules and on whatever the tender specified. The draft, which went out for public comment in December 2025, already named IP cameras, edge computing devices, recorders and video management systems. Vendors had a year’s notice of the general shape.

Two features of the final text matter most in practice. It turns common-sense hygiene into auditable pass/fail tests: no default credentials, no exposed admin ports, signed firmware, network segmentation and write-only upload accounts. It also reaches beyond the device into architecture and procurement. A system can fail because of how it is wired, not just because of what was bought.

Who it affects

Ministries, provincial and commune authorities, and police units that run city, traffic or building surveillance.
State-owned enterprises running cameras at airports, ports, utilities and other sites.
System integrators and VMS/analytics vendors, including foreign brands, bidding on public projects. Their products and designs will be tested against these clauses.
Smart-city programmes, which are named explicitly in the scope.

Private companies’ own CCTV is not in scope. However, the cameras they buy are already subject to QCVN 11:2026/BCA.

Transition

Systems built lawfully before 1 June 2027 may keep running, but they must comply within 24 months of the effective date, that is by 1 June 2029. New projects designed in 2027 should assume full compliance from day one.

Open questions

Who tests, and how? The regulation sets test methods but does not say whether compliance is shown through acceptance testing, third-party labs or inspections by the Cục An ninh mạng. Section 5 only says that the Cục An ninh mạng and provincial police will guide implementation.
Legacy hardware. Many existing recorders cannot do secure boot, signed OTA updates or tamper detection. For them, the 24-month window may mean replacement, not reconfiguration.
“No critical or high CVEs at the time of assessment” is a snapshot. The text does not say how quickly vulnerabilities found later must be patched.
Privacy. The circular cites Luật Bảo vệ dữ liệu cá nhân but has no rules on retention periods, face recognition or citizens’ access to footage. Those questions remain with the data-protection framework.

Sources

This post is general information, not legal advice.