Công văn 25/VBHN-NHNN (2026)

# Văn bản - Lĩnh vực: Tai chinh Ngan hang --- "lr) ceNG noA x,c, ngr cHt xcnfu vlpr NAM DQc l$p - Tg do - Hqnh phtic TIIONG Tt./ Quy ilinh v6 an toin, bio mit cho viQc cung cAp dich vg trgc tuy5n trong nginh Ng6n hirng Th6ng tu s6 sOlzozqftT-NHNN ngiy 3l thSng l0 rdrm2o24 cua Th6ng tl6c NgAn hang Nhn nu6c ViQt Nam quy dinh v6 an todn, b6o mflt cho viQc cung c6p dich w tr.uc tuy6n fong nganh Ng6n hirng, c6 hiQu luc ki5 tir ngdy 0l thSng 0l nim 2025,dugc sria d6i, b6 sung boi: Th6ng tu sii zZlzOzSruf-Nf{]\w ngiy 3l thing 12 ndm 2025 cria Th6ng tti5c Ngdn hang Nhd nu6c ViQt Nam sria d6i, bO sung mQt sO AiCu cria Th6ng tu sii solzoz+mufwN cria Thiing ttiSc NgAn hang Nhd nu6c ViQt Nam quy t[nh vd an toin, bio mflt cho vi6c cung c6p dich vu tr.uc tuy6n trong nganh Ngdn hang, c6 hiQu lyc k,5 tu ngdy 0l thring 3 ndm2026. Cdn ct Luqt Ngin hdng Nhi nudc WQt Nam ngay 16 tluing 6 ndm 2010; Cdn c* Lruit An todn th6ng tin mqng ngdy 19 thdng ll ndm 2015; Cdn c* Ludt Anninh mqng ngdy 12 thdng 6 ndm 2018; Cdn c* LuQt Giao dich ilisn tt ngdy 22 tluing 6 ndm 2023; Cdn c* Luit Cdc tii ch*c tin &mg ngdy 18 thdng 01 ndm 2024; Cdn ct NShi dinh ti, |OZ.ZOZZ.wU-CP ngdy t2 thdng 12 ndm 2022 cia Chinh phti quy ilinh chtc ndng, nhi€m vu, quyin han vd co cdu ili chtc cia Ngdn hdng Nhd nrdc W€t Nam; Theo cti ngh! cila Cuc trudng Cltc C6ng ngh€ th6ng tin; Thiing itiic Ngin hdng Nhd nudc WQt Nam ban hdnh Th6ng tu quy dinh vi an todn, bdo mQt cho viQc "ung "lip dich vy trqc tuyih trong ngdnh Ngdn hdngt . . I Th6ng tu s6 77I2025ITT-NHNN sria d5i, b6 sung mot s6 diAu cua Th6ng tu sO SOIZOZ+fff-\Ifn fN c0a Thiing d6c Ngdn hAng Nhi nu6c ViQt Nam quy tfinh vA an toirl bAo mft cho vipc cung c6p dich vu tr.uc tuy6n tong nginh NgAn hing, c6 cdn cri ban hdnh nhu sau: "Cdn ct LuAt NgAn hdng Nhd rufic WCt Nam sii 46/2010/QH12; Cdn c* LuQt An todn rh6ng tin mqngsii 86/2015/QH13; Cdn c* LuQt An ninh mqng s6 24/2018/QH14; -- 1 of 45 -- 2 Chuong I QUYDINH CHUNG Didu l. Pb4m vi tli6u chinh vi tISi tuqng 6p dgng l. Phgm vi di6u chinh Th6ng tu ndy quy tlinh c6c y6u cAu b6o dAm an toirn, b6o m4t cho vi6c cung cAp dich vU tr.uc tuy6n trong nganh Ng6n hang, bao g6m: a) Ho4t dQng ngdn hang vd c6c ho4t tlQng kinh doanh kh6c cria t6 chric tin dgng, chi nhrinh ngAn hdng nu6c ngodi; b) Hopt dQng cung rmg dch v1l trung gian thanh toriur; c) Ho4t <IQng th6ng tin tin dgng. d)2 Ho4t ttQng cung wrg dfch w TiAn di <lQng; 2. D6i tuqng 6p durrg' Th6ng tu niy 6p dqng d6i voi c6c t6 chtc tin dgng, chi nhrffi ngAn hang , '' ,l nu6c ngodi, t6 chric cung img dlch vU trung gian thanh todn, t6 chric cung img dlch vU Ti6n di tlQng, c6ng ty th6ng tin tin dgng (sau tl6y ggi chung ld tton vi). Di6u 2. Gi6i thich tir ngfr vi thu$t ngii Trong Th6ng tu niry, c6c ttr ngt duoi ddy duo. c hi6u nhu sau: Cdn ct Lu$t Giao dich tli€n t* sii 20/2023/gHt 5; Cdn ct Ludt Cdc td chtc tin dltng sd j2/2024/QHl5 duqc stha tt6i, bd sung boi Luqt sii 96/2025/QHr 5; . Cdn ct Nghi dinh sii 26/2025ND-CP cia Chinh phi quy dinh ch*c ndng, nhiAm vu, quyAn hqn vd co cdu t6 chric cfia Ngdn hdng Nhd rutdc W€t Nam; Theo cti ngh! cila Cltc truhng Cltc Cdng nghQ th1ng tin; Thiing diic Ngdn hdng Nhd nubc WQt Nam ban hdnh Thdng tu s*a itiii, bii sung mgt sii iliiu cila Thong tu sii 50/2024iT1-NInNN cia Thiing ddc Ng:an hdng Nhd nudc Vi€t Nam quy tllnh vi an todn, bdo mdt cho vi€c cung ciip dich vu t4tc tuyiin tong ngdnh Ngin hing.- 2 Di6m nAy duo. c b6 sung theo quy ttnh tei khoan 1 Didu I cuaTh6ngwsi;.7712025fff- NHNN sta d6i, b6 sung mQt s6 didu cria Th6ng tu s6 solz0z+nt-Nrn nt.cria Th6ng dtic NgAn heng Nha nu6c ViQt Nam quy dinh vA an tin, bAo mit cho viQc cung c6p dich vu truc tuylin trong ngdnh Ngfln hAng, c6 hi€u luc kti tu ngny 0113/2026. 3 Klroan nay duo. c sria tl6i theo quy dinh tei khoen 2 Didu I cua Th6ng fi sii 77 l2o25rTT- NHNN sta <16i, b6 sung mQt s6 di6u cua Th6ng tu s6 50/2024lTI-NHNN.cua Th6ng <l6c Ngin hang Nhd nu6c ViQt Nam quy tlinh vA an toan, bdo mft cho vi€c cung cdp dich 4r tr.uc tuyiln hong nganh NgAn hing, c6 hiQu lUc kA tu ngAy 011312026. -- 2 of 45 -- 3 l. Dlch w tryc tuy6n trong ngdnh Ngdn hdng (ggi tit ta aicn 4r Online Banking) ld dich vu quy dinh t4i khoan I Di6u I Th6ng tu niry du-o. c c6c don vi c.,rrg c6p cho kh6ch hi.ng tr€n m6i trudmg mpng tti5 thyc hiQn c6c giao dich diQn tu (ggi tit li giao dich), kh6ng bao gdm c6c giao dich tryc tii5p tai c6c tlon v! ch6p nhan thanh torin qua thiiit bi ch6p nh{n the tai di6m b6n, qua M6 phan hdi nhanh (Quick Response Code - QR Code) hi6n thf ttr phia kh6ch hang. 2. HQ thiing Online Bankingln mQt tpp hgrp c6 c6u trfic cric trang thiait bi phan , ,.\ l , cimg, phin m6m, co sd dt lipu, hQ th6ng m4ng truyEn th6ng vd an toin, bio m6t dii san xu6t, truy6n nh{n, thu thfp, xti lj, luu trfi vir trao AOi ttrOng tin s6 phuc vu cho viQc quan lj vd cung c6p dich vu Online Banking, do don vf thiiSt lfp, quan tri, v6n hdnh ho4c thu6 b6n thri ba thii5t lQp, quan tri, vin hanh. 3. Phdn mim img dltng Online Banking H phan m6m img dqrng cung cdp dich vU Online Banking. 4. Phdn mim *ng dqng Mobile Banking le phan m6m img dgng Online Banking tlugc cii dat tr6n thiait bi di ttQng. 5. Giao dich thanh todn trttc tuydn ld giao dich thanh torin dugc thtlc hiQn bing phucng ti6.n tliQn tu th6ng qua hQ thiing Online Banking. 6. Khdch hingldcic t6 chric, c6 nhin st dung dich vu Online Banking. 7. Phtrong thilrc x* ly xuyAn su6t $taight-Through Processing) ld phuong thric tao AOi *rOng tin, dt li€u, tai li€u hai chi€u tg ttQng, th6ng qua kiit n5i an toiur gita hQ th6ng th6ng tin cta kh6ch hang voi h€ thtine Online Banking. 8. Xdc nhqn giao dich di€n tu (sau tldy gpi ld xdc nhqn giao dich) ldhirfl, thric x6c nhfn bdng phuong tiQn tti-6n tu ttti tfr,l nien str ch6p thufln cria kh6ch hang aiii vei c6c th6ng rliQp dt liQu trong giao dich tli€n tu. 9 . Md h6a ditim ttdu itdn didm cu6i lend to end encryption) lir co ch6 mE h6a an todn th6ng tin d tti6m dAu trudc kfii gui di vi chi duqc giai mi sau khi nhan du-o. c t4i di,5m cutii trong qu6 trinh rao <t6i th6ng tin glfia cfuc ring dwrg, c6c thiiit bi trong hQ thting nhim trq+ chti rui ro bi 19, lgt th6ng tin tr€n dudng truyen. 10. He qudn tri co sd dfr li€z ld phin mdm duo. c thiist k6 di6 quan lf, luu tr&, ruy xu6t vd thgc thi c6c truy v6n at tieu fong co sd dt liQu. ll3 Khdch hing tii ch*c moi li ti5 chtic m6i dnng ky thanh lfp trong vdng 12 thingho4c t6 chirc moi thilit lap quan hQ voi don vi trong vdng 12 th6ng vd . a Khoan ney duq.c b6 sung theo quy tlinh t4i Didu 2 cria Th6ng tu s6 77I2025ITT-NHNN sua A6i, f6 sung mQt s6 <tidu cy Th6ng tu s6 S0lZOz+/tt-Nfn rN cria Th6ng <Itic NgAn hang Nhd nudc ViQt Nam quy dinh vA an tohn, bAo mQt cho viQc cung cip dich vu tnrc tuyiin nong nganh NgAn hang, c6 hiQu luc ki5 ti ngiry 011312026. -- 3 of 45 -- 4 dugc tlon vi thgc hi€n tl6nh gi6 rui ro, x6c tlinh thdi gian cin 6p dr,rng hinh thuc ktrop tlung th6ng tin sinh tr6c hgc hoflc chft kj diQn tri an todur cho kh6ch hdng ndy khi thgc hiQn giao dich. Quy ttinh ndy kh6ng bao g6m: a) C6c co quan nhd nu6c, don vi sU nghiQp c6ng lflp; b) C6c t6 chric tin dpng, chi nhanh ngAn hring nudc ngodi; c) C6c t6 chric ni€m yiit theo quy dfnh tai LuQt chimg khorin; d) C6c t6 chric thuQc danh s6ch Fortune Global 500 do T4p chi Fortune c6ng bii vdLo ndm li6n tru6c; d) Nhe diu tu nu6c ngodi ld nguoi kh6ng cu tru md tdi khoan thaxh toAn d6 thuc hiQn ho4t tlQng dAu tu girin tirSp tai Vi6t Nam; e) C6c t6 chric kh6c do tlon vi lpa cho.n vir chju hod,n toin tnich nhiQm v6 c6c rui ro tu viQc lga chgn ndy. Don v! ph6i b6o dam x6c minh chinh x6c ve th6ch hang vi chiu hoan todn tr6ch nhi6m tltii voi vi6c nhdn biilt kh6ch hang. Di6u 3. NguyGn tic chung vd Uao tfilm an toin, b6o mAt he thdng th6ng tin cho viQc cung c5p dich vg Online Banking l. HQ thiing Online Banking ph6i tu6n tht quy tllnh vC bio dim an todn hQ thiing th6ng tin c6p dQ 3 trdl6n theo quy tlinh ctia ph6p luft vC Uao dam an toAn hQ thiSng thdng tin theo c6p dQ, a5i voi ne thr5ng th6ng tin cung c6p {ch vg chuyiin mgch tii chinh, dich vU bi tru diQn tri phii tuen thri quy tlinh ve bao aam an toin hp thr5ng th6ng tin cip dQ' a tr& l6n; tuan tht ti6u chu6n TCVN I1930:2017 (ti6u churAn C6ng nghQ th6ng tin - C6c k! thuQt an toin - YEu ciu co ban vr! an toan hQ thling th6ng tin theo c6p ttQ) vi quy ilfnh cria Ngdn hang Nhd nu6c vii an toan he thiing th6ng tin trong ho4t ttQng ngin hang. 2. Bio dim tinh bi miq tinh toirn vgn cria th6ng tin kh6ch hang; b6o ttim tinh sin sang cria hQ thiing Online Banking d6 cung c6p dfch vu mQt c6ch li6n tgc. 3. C6c giao dich cta lft6ch hang tlugc ph6n loai vd tilffi gi6 mric tIQ rui ro tiii tni6u theo: nh6m kh6ch hang, hanh vi sri dpng cua kh6ch hang, lo4i giao dfch, hgn mric giao dlch (nliu c6) vd tu6n thri c6c quy tlinh c0a ph6p luft li€n quan. Tr6n cs s& d6, tton vi cung cilp cfuc hinh thric x6c nhQn giao dfch phir hgp cho kh6ch hang llra cho.n, tudn thri t5i ttrl.iu c6c quy dinh sau: -- 4 of 45 -- 5 a)5 Ap dung tOi tfrl,iu mQt trong cric hinh thric xic nhf,n quy dinh tai khoan 3, khoan 4, khoan 5, kho6.n 7, khoan 8, khoi.n 9 DiAu 1l Th6ng tu niy khi thay AOi tnOng tin dinh danh kh6ch hang. Truong hqp kh6ch hirng c6 nh6n, kh6ch hang t6 chric moi thay tl6i th6ng tin gi6y td tuy thnn (bao g6m cdn cu6c c6ng ddn, cin cu6c, cEn cu6c diQn tu, hQ chi6u cria kh6ch hang c6 nh6n hoec cria nguoi ttai diQn hqp ph6p cta kh6ch hang to chric) ho{c c6c th6ng tin <ti dEng kf, st {rng c6c hinh thtic x6c nhfln giao dich (tiii tfriiSu bao g6m si5 aiCn thoai hoac dia chi thu diQn tt ho& cht ky ttiQn nr), 6p dpng c6c hinh thric x6c nhfn quy dinh t+i khoan 5 Di6u ll Th6ng tu ndy krit hqp v6i mQt trong c6c hinh thric x6c nhf,n quy dinh tai khoan 3, khoan 4, khoin 7, khoirn 8, khoan 9 Di6u I I Th6ng tu niy. b) Ap dung t6i thitiu mQt hoac ki5t hqp c6c hinh thric x6c nhfln giao dich theo quy tlinh tai Th6ng hr ndy; Trucrng hqp ven ban quy phgm ph6p luft huong d5n v€ c6c dch 4r quy tllnh tai lJroan I DiAu I Th6ng tu niy c6 quy dinh vC trintr ttrri" x6c nh$n giao dich thi thuc hi-6n theo vdn ban quy phAm ph6p luft tI6; c) Otii v6i giao dich g6m nhiAu bu6c, phai thyc hiQn x6c nh4n giao dich tai bu6c ph6 duyQt cuiii ctng. 4. Thgc hiQn kiiSm tra, iIiffi gi6 an toirn, bAo m{t hQ th6ng Online Banking dinh ky hang nEm. 5. Thudng xuy6n nhin dang rui ro, nguy co gdy ra rui ro vi x6c dlnh nguydn nhdn gdy ra nii ro, ki.p thoi c6 bipn ph6p phdng ngta, ki6m so6t vd xri ly rui ro trong cung c6p dich ru Online Banking. 6. C6c trang thii5t bi ha t6.g k! thuft c6ng nghQ th6ng tin cung c5p dich vu Online Banking phii c6 b6.n quydn, ng,rdn g5c, xu6t xt 16 rdng. Voi c6c trang . 5 Ditim nAy dugc sria ct6i theo quy ttinh tai DiAu 3 cria Th0ng tu s6 ZZIZOZSfff-mlrtN sria tt6i, bii sung mQt si5 didu cria Th6ng tu s6 50/2024rrt-NHNN cria Th6ng <liic Ngin heng Nhd nu6c ViCt Nam quy tlinh ud uo toerr, bio m$t cho viQc cung clp dich w truc tuy6n hong ngdnh NgAn hang. Khoan 2 vi khoan 3 Didu 12 cua Th6ng tu si:lltZOZSfft+tHNN quy tlinh: "2..Diii voi cric don vi cung clip dich vu thanh tgdn Wg tuydn cho cd ktuich,hdng cd nhdn vd tii chtic, thdi gian dp dyng cdc qtty dlnh tai Diiu 3, Diiu I0 Th6ng ttr nay ki tt ngay 01 thdngT ndm2026. 3. Diii voi cric ilon v! chi cung ciip dlch vu thanh todn trt c tuydn cho tluich hang tii chilrc (I*6ng cung cdp dich v1t cho t:fuich hing cd nhdn), thdi gian dp dqng aic quy ctlnh tqi Diiu i, Diiu l0Thdngtundyki fingdy01 thting 10ndm2026./.' -- 5 of 45 -- 6 thi6t bi sip hiit vdng ttdi san phAm vd sE kh6ng dugc nhd sirn xu6t ti6p qrc h5 tro, tton vi phii c6 kii ho4ch ndng c6p, thay th6 theo th6ng b6o cria nhd san xu6t, b6o <l6m c6c trang thi6t bi ha tang c6 khA nEng ciri ttflt phi6n ban ph6n mAm m6i. Trong thoi gian chua n6ng c6p, thay Ai5, Oon v! phni c6 biQn ph6p ting cudng bio tlim an tolur, b6o mflt hQ th6ng Online Banking. 7. DOi voi cdc hQ th6ng "rrrg c6p dich vU ciing thanh torLn <IiQn tu, dich vU tr5 trq thu hO, chi hQ, kh6ng ph6i tuAn tht c6c quy tlinh t4i khoan 7, khoan 9, khorin l0 DiAu 7 vd Mgc 2 Chuong II Th6ng tu ndy. 8. HQ thiSng Online Banking chi duo. c ho4t tlQng ".r.,g c6p dich W cho kh6ch hang lJti bio dim an todn, bio m{t theo quy ilinh cria Th6ng tu niy vA c6c quy tllnh cta ph6p lu6t li6n quan. Chuong II CAC QUY DINH CU TIIE Msc 1. IrA TANG KV THUAT CUA HE THONG ONLINE BANKING Di6u 4. HQ thSng mlng, truydn th6ng vir an toir, bio m$t Don vi phii thiiit lfp hQ th6ng m4ng, truydn th6ng vir an todn, b6o mdt tl4t y6u cAu t6i thiiiu sau: l. C6 cic gi6i ph6p an toem, b6o mf,t tOi thiiiu gOm: a) Tu<rng hia img dung ho{c gi6i ph6p b6o vQ c6 tinh ning tuong tluong; b) Tuong lta co sd dt liQu hoac gini ph6p bio vQ c6 tinh ndng tuong duong; c) Gini ph6p phdng, ch6ng dn c6ng tir chiii dich vu (DoS - Denial of Service attack), tin c6ng tu chiSi dich vu ph6n tan (DDoS - Distributed Denial of Service attack) tti5i vor cdchQ th6ng cung c6p dlch vg tr.uc tiilp tr6n Internet; d) H9 thiing quan ly vi ph6n tich s1r kiQn an toiur th6ng tin. 2. Th6ng tin kh6ch hang (th6ng tin nhfn bii5t kt6ch hirng, th6ng tin giao dlch cria kh6ch hang) kh6ng <Iugc lrru ffi t4i phan vung k6t n5i Internet vd phAn vung trung gian grta mqng nQi b0 vd m4ng Intemet @han vung DMZ). 3. fhir5t lfp chinh s6ch h4n ctriS tOl aa c6c dfch vr;, c5ng tci5t nOi vdo hQ th6ng Online Banking. 4. K6t n6i fi b6n ngodi mqng nQi b0 vio h€ th6ng Online Banking tl6 quan ri chi tluo. c thUc hi€n trong trudrng hqp kh6ng tfr,5 tci5t .rdi tt m4ng n6i b0 vd bio tlAm an todn, tuan thri c6c quy dinh sau: a) Phni duo. c c6p c6 thAm quyAn ph6 duyQt sau khi xem x6t muc tlich, c6ch -- 6 of 45 -- 7 thuc kiit ni5i; b) Phei c6 phuong rln quan l1i truy c$p, quan tri h6 thiing tir xa an toirn nhu sri {rng m4ng ri6ng 6o ho{c phucrrg rin tuong duong; c) Thiiit bi k6t n6i phii duo. c cii d4t c6c phin m6m bio ttim an tod,n, bio mat; d) Phai 6p d\mg t6i thiiiu hai trong c6c hinh thtc x6c nhQn quy dinh tai khoan l, kho6n 3, khoin 4, khoAn 7, kho6m 8, kho6n 9 Di6u ll Th6ng tu ndy khi tl6ng nh0p h€ thline; tt) Sri dr,mg giao thtic truyOn th6ng duo. c mE h6a an todn vd kh6ng luu mE kh6a bi mat tai c6c phnn m6m tiQn ich. 5. Dudng truy6n ki5t ni5i mqng cung c6p dich vu phii bio dam tinh sin sang -L cao vir khi ndng cung c6p dich vu li€n tgc. Di6u 5. HQ th5ng mdy chri vi phAn mdm hQ th5ng l. Y6u ciu OOi voi m6y cht: a) HiQu ning sri dUng tai nguyEn m6y chri bao gdm: bQ xri lj trung t6m (CPU), bQ nhd trong (RAM), thiCt bi luu trfi d[ liQu, thiilt bi t uy xr6t dfr liQu ktri Itru trt hopc truy6n nhfn, trung binh hang thring tl5i da80%o c6ng sudt thi6t ki5; b) H€ thi5ng Online Banking phii c6 m6y chri du phdng bio tlAm tinh sin sirng cao; c) T6ch biQt vd l6-gic ho4c vft ly va cfucmily chri ho4t tlQng nghi€p vU kt6c; d) Phai dugc kiilm ffa, nAng cao mric tlQ an todn, bio mft (hardening) cho hQ di6u hinh, cfp nhQt c6c bin v6 l5i thudrng xuydn. 2.Donvi ph6i I6p danh mgc c6c phdn mAm dugc ph6p cii tl{t fr6n m6y chri. Dinh kj, t6i thiiSu 06 th6ng mQt ldn c0p nh4t, ki,3m tra, b6o drlm tu6n thri danh mpc ndy. Di6u 6. HQ quin tri co s& dii liQu l. HQ quan tri co sd dft liQu phii c6 cs ch.i bao vO vi ph6n quy6n truy cfp ',,, tl6i v6i cdc tii nguy€n co so d& liQu. 2. HQ th6ng Online Banking phii c6 co sd dft li-6u dg phdng thim hga, c6 khi n6ng ttray thtl co s& dt li€u chinh vi bio atim ttiy ttri, todu: vgn dt liQu giao dlch cta ldr6ch hang. 3. HQ quan tri co sd dt liQu phti tluo. c ki6m tra, n6ng cao mric tIQ an toin, b6o mflt (hardening) vd cfp nh{t c6c ban v6 l5i thuong xuy€n. 4. Don v!phai c6 biQn ph6p gi6m s6t, ghi nhat ky truy cQp co sd dt li€u vi -- 7 of 45 -- 8 c6c thao t6c khi truy cQp co so dfr li€u. Di6u 7. PhAn m6m rfrng dgng Online Banking ^:).. L C6c y6u cAu v€ an toin, b6o m4t phii duo. c x6c dinh tru6c khi ph6t tri6n phAn mdm vd t6 chirc, tri6n khai trong qu6 trinh ph6t tri,6n @h6n tich, thiilt kt5, xdy dyng, kiiSm tht), v4n hdnh chinh thirc vd duy tri ho4t dgng ph6n mdm. C6c h6 so, tai liQu vd an todn, bio mit cria phdn mAm phAi du-o. c hQ thi5ng h6a, luu tr&, cQp nhflt <I6ng bO khi he thiing c6 thay tl6i vd kii5m so6t ch4t ch6, h4n chti titip cfln. 2. Dcm vi phii kii5m so6t m6 ngudn phin mAm voi c6c y6u cdu t6i ttri6u: a) D6i vcri mE ngudn ph6n m€m do don vi tr,r ph6t tri6n: (i) Dinh kj hoac khi c6 thay OOi pnan m'im img dgng, don viph6i kiiSm tra mE ngudn nhim loai trir c6c tlo4n md ttQc h4i, c6c l5 h6ng b6o mQt. NhAn su thuc hi€n ki,3m tra phii tlQc lflp voi nhdn sg ph6t tririn m6 ngudn phin mAm; (iD Chi ttinh cg thr! c6c c6 nhAn chiu t6ch nhiem quin lf md ngu6n crla phAn mdm img dgng Online Banking; (iii) Me ngudn ph6i dugc luu trt an todn tai it nh6t hai <Iia diiim t6ch biQt v6 ttia lf vd c6 biQn ph6p bio vC tinh todn ven cta mE ngu6n. b) Truong hgp md ngu6n phSn mAm thu6 ngodi gia c6ng (outsourced software): (i) Don viphii y6u cAu b6n cung c6p kf cam klit me ngu6n phdn mAm ld hgrp ph6p, kh6ng gii m4o; cam k6t thUc hi€n c6c thoi thudn vC viQc chinh sria md ngu6n khi b6o hd.u:h, bio tri ph6n m6m; (ii) Trucng hgp tlugc ban giao md ngudn, Eudc khi nghiQm thu ban giao m6 ngutin phin mdm, don vi y€u cAu b6n cung c6p phai ki6m tra, xi lf, khic phgc c6c 15 h6ng b6o m{t trong mE ngudn. Sau khi mi ngudn dugc bin giao, don vi thpc hiQn theo quy ttinh tai tliiim a khoan ndy; (iii) Truong hqp kh6ng <Iuo. c bd,n giao m6 ngudn, khi ky nghiQm thu sin phAm, tton vi phAi y6u ciu b6n cung c6p thgc hiQn dd qu6t, lo4i b6 c6c <lo4n m6 tlQc hai vd lc.i cam ti5t ttrOng c6 c6c tlopn md tIQc h4i trong ph6n m6m img dgng. 3. Ph6n mim tmg dr,rng Online Banking phai dugc ki6m tra, thti nghiQm tru6c kai v$n hanh chinh thric tl6p img c6c y6u cAu tiii thi6u sau: a) LQp vd ph€ duyQt k6 ho4ch, kich ban tht nghiQm phdn m6m tmg dwrg Online Banking, trong tl6 n6u 16 c6c tliAu ki€n ve tinh an todn, bAo mft phii duo. c tl6p rmg; b) Ph6t hiQn vd lo4i trtr c6c l5i, circ gian. lQn c6 th6 xdy ra khi nhip s6liQu oau vao; -- 8 of 45 -- 9 c)6 D6nh giri, dd qu6t ph6t hi€n 16 h6ng, tli6m y6u v6 m[t k] thu{t. D6nh gi6 kh6 ndng phdng, ch5ng c6c l5 h6ng, <ti6m yi5u, kiiiu rin c6ng b6o Aam t,5i ttrliiu I cac yeu cau sau: (i) DOi vdi phAn mAm tmg durrg Online Banking cung c6p qua ndn tang web, phii phdng, chiing l0 l5 h6ng ptrO Uii5n nh6t du-o. c c6ng bii bcri t6 chric OWASP (OWASP Top Ten). (iD D6i voi phdn mdm img drmg Mobile Banking, tllp rmg ti5i thiriu c6c y6u ;. :. cdu v€ an todrn bdo mf,t img dung di dQng do t6 chric OWASP cdng b6 (OWASP Mobile Application Security). (iii) Phi6n ban OWASP Top Ten ho{c OWASP Mobile Application Security 6p dung ld phi€n ban moi ntr6t troac phi€n ban ga" nh6t voi phi6n bdn duo. c ban hinh trong vdng 06 th6ng; d) Ghi lai c6c l5i vi qu6 rinh xri lf l5i, dac biet la c6c l5i vC an toin, b6o mflt trong c6c b6o c6o rr€ tiilm tra thri nghigm; tt) Ki6m tra thri nghiQm c6c tinh ndng an toirn, bio mit ph6i tlu-o. c thlrc hiQn tr6n c6c trinh duyQt ptrO Uilin (6p dpng CiSi voi ph6n m€m img dung Online Banking cung c6p qua ndn tang web) vd c6c phAn m6m h€ tli6u hanh cria thi6t bi di dgng (6p dune aOi voi phAn m6m img (rng Mobile Banking); c6 co ch6 ki6m tra, th6ng b6o tric thcvi cho kh6ch hang khi sri dpng ung dUng tr6n c6c trinh duygt, phi6n ban phAn m6m h€ di6u hdnh cria thi6t bi di tlQng d5 ducr. c ki6m tra vi thri nghiQm an todn. 4. Tru6c khi triCn khai phAn m6m img d\mg Online Banking moi, don vi phai tlinh gi6 nhtng rui ro cria qu6 trinh tri6n khai al5i voi hogt dQng nghiQp vu, c6c hQ th6ng c6ng nghQ th6ng tin li6n quan vh lfp, tririn khai crlc phuong rin han chii, khic phuc rui ro. 5. Don vi thgc hi-€n quan lf thay aOi ptri6n ban phnn m€m img dUng Online Banking ttlp tmg c6c y6u ciu saut a) Xdy dpg tai 1i6u phAn tich danh giri tric tlQng cta viQc thay tt6i A5i voi ne thiSng hiQn t4i, cic hQ th6ng c6 li6n quan kh6c cta dsn vi vi duo.c c6p c6 thdm quy6n ph6 duyQt tru6c khi thUc hiQn; b) C6c phi6n ban ph6n mdm bao g6m ci md ngu6n do don vl qr phat pHiin 6 Di6m nAy tluo. c sria d6i theo quy ilinh tai khoriLn I Didu 4 cua Th6 ngfi s6.77l2}25ltT- NHNN sta d6i, brl sung mQt sti tli€u cria Th6ng tu sO SOIZOZ+fff-NIttr IN cua Thting <fi5c Ng&r hAng Nhd nudc ViQt Nam quy dinh vd