Introduction
Cyberattacks on banks have increased in scale, persistence, and
sophistication. There have been several bold violations of
information security, for example, leaks of customer information,
use of malicious codes, breaking passwords, all intended to
penetrate a bank's information systems.
On October 21, 2020, the State Bank of Vietnam
(“SBVN”) issued Circular No.
09/2020/TT-NHNN (“Circular
09”)1 which sets out minimum
requirements and conditions to heighten the security of the
information system used in banking operations. The minimum
requirements and conditions apply to credit institutions, branches
of foreign banks, intermediary payment service providers, credit
information companies, the National Payment Corporation of Vietnam
(“NAPAS”), Vietnam Asset Management
Company (“VAMC”), National Banknote
Printing Plant, and Deposit Insurance of Vietnam (collectively,
“institutions”), that establish and
use information systems to support their technical
