What is level 4 information security, and why must caex, scex, and tcex pass this “hurdle”?
Recently, CAEX, SCEX, and TCEX have been making headlines for a major milestone: receiving review and approval from the Department of Cybersecurity (Ministry of Public Security) for their Level 4 Information System Security proposal.
But what does “Level 4” actually mean? And why is it a mandatory condition for participating in the crypto exchange pilot under Resolution 05/2025/NQ-CP?
Simply put, “Level 4 Information System Security” is a cybersecurity rating assigned by the government to an organization’s IT infrastructure. The more critical the system—and the more severe the consequences of a cyberattack—the higher the rating and the stricter the required protection measures.
1. The 5-Level Security Scale
Under the Law on Network Information Security and Decree 85/2016/NĐ-CP (which defines the criteria, authority, procedures, and responsibilities for each security tier), Vietnam categorizes information systems into 5 levels, from Level 1 (lowest) to Level 5 (highest):
-
Levels 1–2: Internal systems and standard websites.
-
Level 3: Critical sector-level or enterprise-scale systems. This is the standard tier used by securities brokerage firms.
-
Level 4: Systems with national impact or direct relevance to national security and economic order. A security breach at this level would cause extremely severe damage. Examples include core banking infrastructure, critical facility control systems, and national databases.
-
Level 5: The highest tier, tied to exceptional national security interests.
If a system comprises multiple components operating across different tiers, the overall system classification is determined by the highest component level. Therefore, an exchange’s entire architecture—including hot/cold wallets, matching engines, KYC protocols, and banking integrations—must be safeguarded to Level 4 standards.
2. What Does Achieving Level 4 Compliance Require?
Fundamentally, companies must demonstrate the following operational capabilities:
-
Operating a dedicated information security unit with 24/7 Security Operations Center (SOC) monitoring.
-
Maintaining redundant backup infrastructure and a Disaster Recovery (DR) center to ensure virtually zero unplanned downtime.
-
Implementing strict network segmentation, data encryption, multi-layered access controls, and comprehensive activity logging.
-
Conducting regular security audits, vulnerability assessments, and penetration testing.
-
Establishing incident response procedures and continuous security training for staff.
Firms compile a “Proposed Level Dossier” containing their defense strategy and submit it to competent authorities for review. For digital asset exchanges, Level 4 proposals are vetted directly by the Ministry of Public Security to ensure the exchange operates safely and seamlessly without posing risks to national financial and monetary security.
3. What This Means for Investors
For years, Vietnamese investors have primarily traded crypto on offshore exchanges, leaving their personal data and assets beyond the reach of domestic legal protection. Requiring local exchanges to meet one of the highest security standards in the country aims to build a transparent trading environment where investor assets and data are protected within a clear legal framework.
4. Important Takeaway
Passing the Level 4 information security assessment does not automatically equal receiving an operational license. Exchanges must still fulfill additional regulatory requirements before being officially granted a license by the Ministry of Finance.（Vietnam Crypto Exchange）