On 31 December 2024 Vietnam's Ministry of Information and Communications (MIC) formally approved and published QCVN 135/2024/BTTTT, the National Technical Regulation on Baseline Information Security Requirements for Surveillance Cameras Using Internet Protocol. The regulation becomes fully mandatory on 1 January 2026, from which date all IP cameras sold and used in Vietnam must meet the new requirements.

Background and objectives

As IP cameras spread across Vietnam, their security risks have become increasingly prominent, with frequent default password vulnerabilities, unauthorised access and data leaks. Drawing on international practice, MIC has developed a unified technical regulation intended to:

1. establish a security baseline for IP surveillance equipment and raise overall protection;

2. strengthen privacy protection and prevent unauthorised access;

3. safeguard national cybersecurity and prevent malicious use of devices;

4. standardise the market and support healthy industry development.

Scope

The regulation applies to all surveillance cameras using internet protocol, including network cameras and digital cameras. Anyone manufacturing, importing, distributing or using such equipment in Vietnam must comply, and no explicit exceptions are currently provided.

Implementation schedule

15 February 2025: the standard takes effect and certification applications may be filed.

15 February to 31 December 2025: transition period for product testing and certification.

1 January 2026: full enforcement, after which uncertified products may not be sold or used in Vietnam.

Main technical requirements

1. Authentication and access control:

- mandatory password change on first use;

- password complexity: new passwords must contain upper case, lower case, digits and special characters and be at least 8 characters long;

- login protection: the account is locked for five minutes after five consecutive failed logins;

- encrypted storage: all passwords must be stored encrypted on the device.

2. Vulnerability and update management:

- vulnerability notification: manufacturers must provide detailed descriptions, affected scope and remediation;

- automatic updates: devices must support secure automatic or manual firmware updates;

- update records: the system must log all update operations and timestamps.

3. Communication and data security:

- transport encryption: network communication must use secure encryption protocols such as TLS 1.2 or higher;

- data protection: user data and video streams must be stored encrypted;

- interface security: all remote management interfaces must have strong authentication and protection.

4. System security capabilities:

- session management: session timeouts to prevent long-term unauthorised access;

- security audit: support for recording and querying security event logs;

- fault recovery: a safe recovery mechanism after a system crash;

- configuration protection: prevention of unauthorised changes to security settings.

Supervision and penalties

MIC will work with other authorities on market surveillance, applying measures such as sales bans and import bans to non-compliant products and imposing fines according to the circumstances. Manufacturers and importers must establish product traceability systems to enable recalls and other measures.