Information Security Management Policy
PART I - PURPOSE, SCOPE, AND LEGAL BASIS
Article 1. Purpose
1.1. This Policy establishes the security governance framework applicable to all infrastructure, services, and data that HiTechCloud operates, stores, or processes, in order to protect three foundational properties: Confidentiality, Integrity, and Availability — the C-I-A model.
1.2. This Policy establishes mandatory minimum technical, administrative, and operational requirements to: (a) protect Customer data and internal data against unauthorized access, disclosure, alteration, or destruction; (b) maintain continuous service availability; (c) ensure compliance with Vietnamese law and applicable international standards.
1.3. This Policy supplements and supports enforcement of the Terms of Service, the Personal Data Protection Policy (PDPD), the Service Level Agreement (SLA) and the service-specific Terms of Service.
Article 2. Scope of application
2.1. This policy applies to: (a) all HiTechCloud personnel, including permanent employees, staff on probation, interns, contractors, technical partners, agents and third parties with system access; (b) all physical and logical infrastructure — owned or leased data centers, network equipment, servers, workstations, mobile devices, and cloud and edge infrastructure; (c) all system software, application software, source code, container images, AI models and training data; and (d) all data owned by HiTechCloud, together with Customer data, employee data and partner data.
Article 3. Reference standards framework
3.1. HiTechCloud uses the following standards as its primary reference framework: ISO/IEC 27001:2022 (ISMS); ISO/IEC 27017:2015 (cloud service security); ISO/IEC 27018:2019 (protection of personal information in public clouds); the NIST Cybersecurity Framework 2.0 (Govern–Identify–Protect–Detect–Respond–Recover); CIS Controls v8; OWASP ASVS v4.0; and TCVN 11930:2017 (baseline information system security requirements by assurance level).
3.2. Legal basis:
- The Cybersecurity Law 2025 (Law No. 116/2025/QH15, effective 1 July 2026 — consolidating and replacing the Cybersecurity Law 2018;
- Law on Cyberinformation Security 2015) and its implementing decrees;
- Decree 85/2016/NĐ-CP on securing information systems by classification level;
- Circular 12/2022/TT-BTTTT (the provisions still in force; now within the remit of the Ministry of Science and Technology);
- Law on Personal Data Protection 2025 (Law No. 91/2025/QH15);
- Decree 356/2025/NĐ-CP on personal data protection measures;
- Data Law 2024; Decree 147/2024/NĐ-CP;
- Penal Code 2015 (Bộ luật Hình sự 2015) (chapter on offences in the IT and telecommunications sector — Articles 285–294).
PART II – SECURITY GOVERNANCE AND ORGANIZATION
Article 4. Security organizational structure
4.1. HiTechCloud has established an Information Security Committee (ISC), comprising representatives of the Board of Directors, the Head of IT, the Security Administrator (CISO/ISO), the Data Protection Officer (DPO under the PDPD), and a representative of the Legal function. The ISC meets at least quarterly, and holds ad hoc meetings when a serious incident occurs.
4.2. The Information Security Officer (ISO) is responsible for: (a) developing, issuing, and maintaining specialized security policies (passwords, access control, encryption, redundancy, incident response); (b) conducting risk assessments at least once every 6 months, and on an ad hoc basis when major changes occur; (c) monitoring compliance and handling violations; (d) reporting directly to the Director and the ISC.
Article 5. Data classification and system classification by level
5.1. Data is classified into 4 tiers: Level 1 – PUBLIC (publicly disclosed information); Level 2 – INTERNAL (internal data); Level 3 – CONFIDENTIAL (ordinary customer data, business data and source code); Level 4 – RESTRICTED (sensitive personal data under the PDPD, payment data, secrets and keys, and biometric data). Each level applies an appropriate control set; Level 4 data must be encrypted both at rest and in transit.
5.2. Classify systems by cybersecurity level. HiTechCloud prepares the dossier proposing a security level and implements the corresponding level-based protection plan (information systems are classified into 5 levels) in line with Decree 85/2016/NĐ-CP (Nghị định 85/2016/NĐ-CP) and the Law on Cybersecurity 2025 (Luật An ninh mạng 2025); it also carries out appraisal, approval and review of the assigned level whenever changes occur.
PART III – PLATFORM TECHNICAL CONTROLS
Article 6. Access control
6.1. The principles of least privilege and need-to-know apply. Privileged accounts (admin, root, sudoer) must: (a) use mandatory multi-factor authentication (MFA); (b) be managed through a PAM (Privileged Access Management) system; (c) log in via a bastion host / jump server rather than connecting directly; and (d) have full SSH/RDP sessions recorded, with recordings retained for at least 12 months.
Article 7. Data encryption
7.1. In transit: all connections over public networks use TLS 1.2 or later (TLS 1.3 recommended); SSL 2.0/3.0, TLS 1.0/1.1 and weak ciphers (RC4, 3DES, MD5) are prohibited.
7.2. At-rest: Level 3 and Level 4 data is encrypted with AES-256-GCM or equivalent; keys are managed through a KMS/HSM validated to FIPS 140-2 Level 2 or higher.
7.3. User passwords are hashed with bcrypt/Argon2/scrypt using a random salt of at least 16 bytes; MD5 and SHA-1 are prohibited for password hashing.
Article 8. Network security
8.1. The network is segmented into at least: DMZ (Internet-facing), Application Zone, Database Zone, Management Zone and OOB (Out-of-Band Management).
8.2. Next-generation firewalls (NGFW) with deny-by-default policies at the perimeter and between zones; rule reviews at least once every 6 months.
8.3. Multi-layer DDoS protection (L3/L4 scrubbing + L7 WAF) at the service edge; alert thresholds and automated responses are configured under Article 10 of the SLA.
8.4. IDS/IPS is deployed inline on ingress and egress paths for critical systems; signatures are updated at least every 24 hours.
Article 9. Endpoint and server protection
9.1. Servers and employee workstations with access to production systems must run EDR/XDR with behavioral detection capability.
9.2. Operating systems and software must be patched in accordance with the Vulnerability & Patch Management Policy; Critical patches are applied within 7 days (aligned with the CVSS ≥ 9.0 emergency-maintenance threshold in the SLA).
9.3. Workstations holding internal data must use full disk encryption (FDE) with BitLocker or FileVault.
PART IV – PERSONNEL MANAGEMENT AND TRAINING
Article 10. Personnel screening
10.1. Candidates for positions with access to production systems or Level 3–4 data must complete appropriate pre-employment screening, to the extent permitted by law.
10.2. Personnel granted privileged access (root/admin on customer infrastructure) must sign an individual NDA and an enhanced confidentiality undertaking under the Information Confidentiality Agreement (NDA).
Article 11. Security awareness training
11.1. 100% of new employees must complete information security awareness training before being issued an account with access to production systems.
11.2. Every 6 months, all staff take refresher training and a phishing simulation test; a click-through rate above 10% triggers additional training.
PART V – ASSESSMENT, AUDIT AND COMPLIANCE
Article 12. Risk assessment and security testing
12.1. A comprehensive risk assessment at least once every 12 months, and on an ad hoc basis whenever there is a major architecture change.
12.2. Penetration testing of critical systems at least once every 12 months by an independent third party holding OSCP/CEH/CISSP certification.
12.3. Automated vulnerability scanning runs weekly on public-facing infrastructure and monthly on internal infrastructure.
Article 13. Audit, compliance, and incident response
13.1. HiTechCloud maintains an information security compliance file for inspection by the competent state authorities (the Ministry of Science and Technology; and the Department of Cybersecurity and High-tech Crime Prevention – A05, Ministry of Public Security).
13.2. Internal compliance reports are submitted to the ISC quarterly; exception reports go to the Director within 24 hours of a P1 incident being detected.
13.3. When a cybersecurity incident or personal data breach occurs, HiTechCloud carries out its response and remediation process and coordinates with and notifies the relevant authorities under the Cybersecurity Law 2025 (Luật An ninh mạng 2025), the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025), and the PDPD (including the obligation to notify A05 and affected data subjects of the breach).
PART VI – IMPLEMENTATION PROVISIONS
Article 14. Violations and enforcement
14.1. Any conduct that breaches this Policy is investigated by the ISC within 5 working days and handled at the following levels: reminder, warning, suspension of access, contract termination, and pursuit of liability under the law.
14.2. Anyone who intentionally causes damage to HiTechCloud or to Customers must compensate all direct damage in full and will be referred to the investigating authorities where there are indications of criminal conduct under Articles 285–294 of the Penal Code 2015 (Bộ luật Hình sự 2015).
Article 15. Effective date and review
15.1. This policy takes effect on 01/07/2026 and supersedes all previous versions.
15.2. This policy is reviewed in full at least every 12 months, or on a change in the law, a major system architecture change, or after each severe (P1) incident.
15.3. Any amendment must be approved by the Director and communicated to the relevant staff within 5 working days.
