Issuing technical audit regulations for electronic signatures and trusted services: Ensuring safety and enhancing trust in the digital space

The Circular is an important legal basis for standardizing technical audit processes, ensuring that systems and organizations providing and using electronic signatures comply with technical standards and information security, contributing to strengthening the trust of people, businesses and management agencies in the digital transaction environment.

According to regulations, this Circular applies to organizations and individuals participating in or related to technical audit activities for information systems, processes for providing secure electronic signature services, secure electronic signature certificates, digital signatures, digital signature certificates and other trusted services.

In particular, agencies and organizations that create and use secure electronic signatures are encouraged to proactively conduct technical audits to self-assess the compliance and safety of their systems and service provision processes. This is an important step, demonstrating the spirit of proactively preventing cybersecurity risks instead of just handling incidents when violations occur.

Trusted service providers are required to conduct technical audits every two years to ensure that the service delivery systems and processes are maintained in a safe, stable state and meet technical requirements according to national standards.

Agencies and organizations that create and use secure electronic signatures and secure electronic signature certificates are encouraged to proactively conduct technical audits.

According to the Circular, the basis for technical audit assessment is the specific requirements for information systems and service provision processes specified in technical regulations, technical standards and technical requirements applicable to electronic signatures, electronic certificates and trusted services.

Technical audit activities are carried out in two main stages: Evaluation of information and documents during the planning process and actual evaluation at the audited organization. All contents must be objective, transparent, in accordance with the previously agreed plan and scope.

The maximum duration for an audit is 6 months, and if necessary, it can be extended by up to 45 days to complete corrective actions. After completion, based on the assessment results and corrective actions (if any), the auditing organization will consider issuing a certificate with a Technical Audit Report to the audited organization. If the requirements are not met, the auditing organization must notify in writing, stating the reasons and attaching the Technical Audit Report.

The Circular also details the mandatory content in the Technical Audit Report, including: General information about the audit, implementation time, assessment method, information security risk analysis results, system testing results, technical recommendations and basis for certification decisions.

Trusted service providers must send Technical Audit Reports to the Ministry of Science and Technology , through the National Electronic Authentication Center (NEAC), the focal point for synthesizing, monitoring and serving state management work.

Regular reporting not only helps assess the operational status of trusted service providers, but also creates a unified database for policy making, risk management and supports state agencies in improving the quality and safety of the national digital transaction infrastructure.

The Circular stipulates that technical audit organizations are responsible for exercising their rights and obligations in accordance with the provisions of law on technical standards and regulations; ensuring independence, objectivity and full compliance with technical audit procedures in accordance with regulations on product and goods quality and network information security.

The National Committee for Standards, Metrology and Quality under the Ministry of Science and Technology is the focal point for receiving and appraising registration dossiers for designation of technical audit organizations and submitting them to the Minister of Science and Technology for decision to designate qualified organizations in accordance with the law on standards and quality.

Meanwhile, the National Electronic Authentication Center is responsible for receiving and synthesizing technical audit reports from audited organizations, periodically reporting to the Minister of Science and Technology to serve the state management of the provision of reliable services.

The issuance of the Circular on technical audit of electronic signatures and trusted services is considered an important step in completing the national legal corridor on information security, electronic authentication and digital transformation.

The Circular contributes to standardizing the independent assessment system, strengthening risk control, improving technological autonomy, and creating digital trust for users in the process of transacting, signing and exchanging electronic data.

The Circular takes effect from January 1, 2026, marking a new step forward in technical management and ensuring the safety and reliability of the national electronic signature infrastructure, towards the goal of building a safe, transparent and sustainably developed digital government, digital economy and digital society.

Center for Science and Technology Communication

Source: https://mst.gov.vn/ban-hanh-quy-dinh-kiem-toan-ky-thuat-doi-voi-chu-ky-dien-tu-va-dich-vu-tin-cay-bao-dam-an-toan-nang-cao-niem-tin-trong-khong-gian-so-197251015202125722.htm