Decree 331/2026: what enterprises need to do now

What Decree 331 changes

The Government issued Decree No. 331/2026/ND-CP on 19-8-2026 on cybersecurity protection for information systems. It provides practical guidance for classification assessment, auditing existing systems, handling user growth beyond thresholds, and selecting the right level. Hanoi Moi summarizes these points; the Ministry of Public Security portal lists the decree among new regulations on information system protection.

Level selection: splitting a system does not lower its level

Clause 2, Article 8 requires the system owner to apply the highest level when a system meets criteria that fall under several levels. Clause 3 prohibits deliberately splitting the system scope to lower the classification or protection requirements. If authorities find improper splitting or consolidation, the owner must redefine the system and the corresponding level. For operations teams, this means the network topology, data partitions and user groups must match the approved classification file.

Data thresholds that require reclassification

The number of basic or sensitive personal data subjects is a hard threshold between Level 2 and Level 3.

Data	Level 2	Level 3
Basic personal data subjects	under 100,000	100,000 or more
Sensitive personal data subjects	under 10,000	10,000 or more

When user numbers grow above the threshold, the process has three steps. First, assess cybersecurity risk when there is a change in user groups, service scope, scale, connectivity or data sharing. Second, if the detailed risk assessment confirms the risk is higher than the current level, the owner must propose the higher level. Third, the owner re-submits the classification proposal and protection plan as if it were a first-time approval under Article 25.

Transition timeline for systems built before 1-7-2026

Under Clause 1, Article 39, systems that were under investment or construction before 1-7-2026 must complete assessment and approval under Decree No. 85/2016/ND-CP within six months from the effective date of Law No. 116/2025/QH15 on Cybersecurity. Within twelve months from that same date, systems must meet the conditions, standards and protection measures for the level required by Decree No. 331/2026/ND-CP.

Law No. 116/2025/QH15 took effect on 1-7-2026, so the two deadlines fall on 1-1-2027 and 1-7-2027. For operating systems that need reclassification, such as moving from old criteria to new criteria, the approval process follows the first-time classification procedure in Article 25.

Shared infrastructure and the head of the organization

The decree promotes overall, synchronized and centralized investment, while encouraging resource sharing to avoid duplication. For Level 1, Level 2 and Level 3 systems, the protection plan must actively consider shared protection solutions and shared resources among internal systems. Level 3 and Level 4 systems can use shared physical infrastructure in a cloud or data center, provided the system, internal network zones and data storage are separated and independent logically. Level 5 requires full physical separation for system, storage zones and core network devices, but shared security solutions are still allowed if they only monitor, detect, alert or protect at the edge without creating access, control or direct intervention into business data.

Article 31 places ultimate direction and legal responsibility on the head of the organization. The head must arrange dedicated cybersecurity staff or a unit appropriate to the system level, and designate responsible individuals or units for systems using state budget. If no independent cybersecurity unit exists, the head may designate the IT or digital transformation unit as the dedicated cybersecurity unit, or establish such a unit.

Where to start in the move from Decree 85

Start by comparing the system inventory, data thresholds and current classification records. For systems near the 100,000 basic data subject or 10,000 sensitive data subject threshold, prepare a risk assessment scenario before scale changes. For systems at Level 3 and above, review logical separation, network segmentation, storage design and monitoring capability before building the file.

This review mixes legal, technical and documentation work. Operations teams can prepare evidence, but many enterprises need support to create a compliant classification dossier and protection plan. TechShield provides consulting for information system security level documentation for businesses reviewing the transition from Decree 85 to Decree 331/2026/ND-CP.