Commercial entities operating in Vietnam face a fundamentally transformed regulatory landscape this season. Vietnam’s Ministry of Public Security (BCA) will officially enforce two sweeping National Technical Regulations (Quy chuẩn Việt Nam, or QCVN) designed to harden the country’s digital infrastructure. 

The new framework introduces strict compliance gateways, shifting baseline cybersecurity liabilities directly onto commercial actors. Companies operating in or supplying technology to Vietnam must immediately reassess their compliance and market-entry strategies to preserve public and private sector access. 

In brief 

Effective July 1, 2026, the BCA will begin strict enforcement of QCVN 11:2026/BCA (governing IP surveillance cameras) and QCVN 12:2026/BCA (governing electronic document storage systems). While these frameworks target different layers of tech infrastructure, they are commercially linked. 

While QCVN 12 is formally applicable to information systems within public sector organizations, its enforcement establishes a de facto market-entry requirement for the private sector. Consequently, commercial enterprises involved in public bidding, state procurement, or acting as subcontractors to government entities are now required to prove full compliance with these security standards. This shift effectively makes adherence to these protocols a compulsory technical gateway for any business serving state-regulated channels. 

Key takeaways 

• Hardened market-entry barriers: Compliance is no longer a matter of best practice but a prerequisite for market participation. Post-deadline non-compliance will result in immediate disqualification from public tenders and may lead to the customs impoundment of non-certified hardware inventory,. Furthermore, firms fail to meet these statutory standards risk severe breach-of-contract liabilities from enterprise clients who require certified infrastructure for their own regulated operations. 
• Statutory shift in endpoint liability: The legal burden of “endpoint security”—the protection of individual network-connected devices—has shifted directly to manufacturers and importers,. This mandate eliminates the commercial viability of generic or unpatched hardware, as these actors now bear direct, statutory responsibility for device integrity and must provide unique cryptographic credentials and ongoing lifecycle support,. 
• B2G supply chain contraction: The “Business-to-Government” (B2G) sector, including services to regulated entities like commercial banks, faces an abrupt contraction,. Private software, cloud, and data center providers will face exclusion if their underlying infrastructures utilize non-domestic cloud replication networks. Under the new mandate for onshore hosting, all primary and backup data centers must be physically located within Vietnamese territory to remain eligible for regulated contracts,. 
• Mandatory “day one” enforcement: While legacy state architectures may undergo a phased transition via national master plans, there is no such allowance for the private sector. All new private-sector installations destined for public projects or B2G channels must achieve full compliance on the first day of enforcement. This necessitates an immediate audit of current bids and hardware pipelines to ensure they meet the July 1, 2026, standards,. 

In more detail 

1. IP Surveillance Cameras (QCVN 11:2026/BCA) 

QCVN 11 shifts the burden of endpoint security—the protection of individual devices connected to a network—directly onto manufacturers and importers. The regulation targets hardware vulnerabilities through several strict mandates: 

• Elimination of Default Credentials: Universal, factory-set passwords are banned. Devices must either feature a unique, hardcoded cryptographic credential per unit or run an unskippable initial setup routine that forces the user to create a strong, custom password. 

• Vulnerability & Lifecycle Support: Businesses must maintain a transparent Vulnerability Disclosure Policy and provide digitally signed, secure software patches throughout a regulatorily defined support window. 

• Data Sovereignty & Transparency: Camera firmware must natively support localized storage routing, ensuring all data streams remain within Vietnam. Technical documentation must also provide explicit, legally binding disclosures regarding sensor transparency—detailing exactly how audio, visual, and biometric data are captured, processed, and transmitted. 

What does this mean? 

In reality, a distributor bidding to supply 5,000 smart cameras for a municipal transport project will face immediate tender disqualification and customs rejection after July 1, 2026, should the hardware rely on a master-password system for batch configuration or automatically route metadata to an overseas cloud server.   

2. Electronic document storage (QCVN 12:2026/BCA) 

QCVN 12 enforces rigid infrastructure requirements to protect data sovereignty and the evidentiary integrity of electronic records. A core pillar of this framework is the strict adoption of standardized data redundancy, isolation, and security architectures. 

Actionable compliance directives for leadership 

To protect market access and insulate corporate interests from tender disqualifications, executive boards and technical leadership should initiate the following defensive measures immediately: