Tóm tắt Quyết định số 29/2008/QĐ-NHNN về bảo trì hệ thống thiết bị tin học trong ngành Ngân hàng
Quyết định số 29/2008/QĐ-NHNN do Thống đốc Ngân hàng Nhà nước Việt Nam ban hành ngày 13 tháng 10 năm 2008, ban hành kèm theo Quy chế bảo trì hệ thống thiết bị tin học trong ngành Ngân hàng. Đây là văn bản pháp lý quan trọng nhằm đảm bảo sự vận hành liên tục, an toàn và bảo mật của toàn bộ hệ thống hạ tầng công nghệ thông tin phục vụ cho hoạt động quản lý và nghiệp vụ ngân hàng. Dưới đây là nội dung chi tiết về phạm vi điều chỉnh, đối tượng áp dụng, các thuật ngữ cốt lõi và nguyên tắc bảo trì được quy định từ Điều 1 đến Điều 4 của Quy chế.
1. Phạm vi điều chỉnh (Điều 1)
Quy chế này quy định chi tiết về hoạt động bảo trì hệ thống thiết bị tin học trong hệ thống Ngân hàng Nhà nước Việt Nam. Nội dung điều chỉnh bao gồm:
- Công tác lập kế hoạch bảo trì định kỳ và đột xuất cho các thiết bị phần cứng, hạ tầng mạng và các hệ thống phần mềm nền tảng.
- Quy trình thực hiện kỹ thuật, kiểm tra, giám sát và nghiệm thu kết quả bảo trì thiết bị tin học.
- Trách nhiệm quản lý, vận hành và phối hợp giữa các đơn vị liên quan trong quá trình bảo trì nhằm hạn chế tối đa rủi ro gián đoạn hoạt động nghiệp vụ.
2. Đối tượng áp dụng (Điều 2)
Quy chế áp dụng bắt buộc đối với các tổ chức và cá nhân sau đây:
- Các đơn vị thuộc cơ cấu tổ chức của Ngân hàng Nhà nước Việt Nam bao gồm các Vụ, Cục, Chi nhánh Ngân hàng Nhà nước tỉnh, thành phố trực thuộc Trung ương, Văn phòng đại diện và các đơn vị sự nghiệp trực thuộc.
- Các cán bộ, công chức, viên chức và người lao động trực tiếp tham gia quản lý, vận hành, sử dụng hoặc thực hiện bảo trì hệ thống thiết bị tin học tại các đơn vị thuộc Ngân hàng Nhà nước.
- Các tổ chức, doanh nghiệp cung cấp dịch vụ bảo trì thiết bị tin học theo hợp đồng ký kết với Ngân hàng Nhà nước.
3. Giải thích từ ngữ và thuật ngữ chuyên ngành (Điều 3)
Để đảm bảo tính thống nhất trong việc áp dụng pháp luật, Quy chế đưa ra định nghĩa rõ ràng cho các khái niệm kỹ thuật cốt lõi:
- Hệ thống thiết bị tin học: Bao gồm toàn bộ các thiết bị phần cứng (máy chủ, máy trạm, thiết bị lưu trữ, thiết bị ngoại vi), thiết bị mạng, thiết bị bảo mật, nguồn điện dự phòng (UPS), hệ thống cáp mạng và các phần mềm hệ thống, phần mềm nền tảng đi kèm.
- Bảo trì thiết bị tin học: Là tập hợp các hoạt động kỹ thuật nhằm duy trì, khôi phục hoặc cải thiện trạng thái hoạt động tiêu chuẩn của thiết bị, đảm bảo thiết bị vận hành ổn định, an toàn và đạt hiệu suất tối ưu.
- Bảo trì phòng ngừa (bảo trì định kỳ): Là hoạt động bảo trì được thực hiện theo kế hoạch vạch sẵn nhằm ngăn ngừa các sự cố có thể xảy ra trong quá trình vận hành.
- Bảo trì khắc phục (bảo trì đột xuất): Là hoạt động sửa chữa, thay thế hoặc cấu hình lại thiết bị ngay sau khi xảy ra sự cố nhằm đưa hệ thống trở lại trạng thái hoạt động bình thường trong thời gian ngắn nhất.
4. Các nguyên tắc cơ bản trong hoạt động bảo trì (Điều 4)
Hoạt động bảo trì hệ thống thiết bị tin học trong ngành Ngân hàng phải tuân thủ nghiêm ngặt các nguyên tắc sau:
- Nguyên tắc an toàn và bảo mật thông tin: Quá trình bảo trì không được làm ảnh hưởng đến tính toàn vẹn, bí mật của dữ liệu ngân hàng. Mọi hoạt động can thiệp vào hệ thống có chứa dữ liệu nhạy cảm phải được giám sát chặt chẽ và có phương án bảo mật được phê duyệt.
- Nguyên tắc liên tục của hoạt động nghiệp vụ: Việc bảo trì phải được lên kế hoạch chi tiết, ưu tiên thực hiện ngoài giờ hành chính hoặc vào các thời điểm ít ảnh hưởng nhất đến giao dịch và hoạt động nghiệp vụ của Ngân hàng Nhà nước.
- Nguyên tắc tuân thủ quy trình kỹ thuật: Tất cả các bước bảo trì từ kiểm tra, vệ sinh vật lý đến cấu hình phần mềm đều phải tuân thủ đúng tài liệu hướng dẫn của nhà sản xuất và quy chuẩn kỹ thuật của Ngân hàng Nhà nước.
- Nguyên tắc phân định rõ trách nhiệm: Phải xác định rõ trách nhiệm của đơn vị chủ quản thiết bị, đơn vị thực hiện bảo trì và cá nhân giám sát để đảm bảo tính minh bạch và khả năng truy vết khi xảy ra sự cố trong quá trình bảo trì.
Việc nắm vững các quy định chung từ Điều 1 đến Điều 4 của Quyết định số 29/2008/QĐ-NHNN là cơ sở pháp lý và kỹ thuật quan trọng để các đơn vị triển khai các bước bảo trì chuyên sâu tiếp theo, góp phần xây dựng hệ thống công nghệ thông tin ngành Ngân hàng vững mạnh, hiện đại và an toàn.
| THE STATE BANK OF VIETNAM | SOCIALIST REPUBLIC OF VIETNAM |
| No. 29/2008/QD-NHNN | Hanoi, October 13, 2008 |
ON THE ISSUANCE OF REGULATION ON MAINTENANCE OF SYSTEM OF INFORMATICS EQUIPMENTS IN BANKING INDUSTRY
THE GOVERNOR OF THE STATE BANK
- Pursuant to the Law on the State Bank of Vietnam issued in 1997 and the Law on the amendment, supplement of several articles of the Law on the State Bank of Vietnam issued in 2003;
- Pursuant to the Law on Credit Institutions issued in 1997 and the Law on the amendment, supplement of several articles of the Law on Credit Institutions issued in 2004;
- Pursuant to the Decree No. 96/2008/ND-CP dated 26 August 2008 of the Government providing for functions, duties, authorities and organizational structure of the State Bank of Vietnam;
- Upon the proposal of the Director of Banking Information technology Department,
DECIDES:
Article 1. To issue in conjunction with this Decision the Regulation on maintenance of system of informatics equipments in Banking industry.
Article 2. This Decision shall be effective after 15 days since its publication in the Official Gazette.
Article 3. The Director of the Administrative Department, the Director of the Banking Information technology Department, Head of units of the State Bank, General Manager of the State Bank branch in provinces, cities under the Central Governments management; Chairman of the Board of Directors, General Directors (Directors) of Credit Institutions shall be responsible for the implementation of this Decision.
...
...
...
FOR THE GOVERNOR OF THE STATE BANK OF VIETNAM
DEPUTY GOVERNOR
Nguyen Toan Thang
ON THE MAINTENANCE OF SYSTEM OF INFORMATICS EQUIPMENTS IN BANKING INDUSTRY
(Issued in conjunction with the Decision No. 29/2008/QD-NHNN dated 13 October 2008 of the Governor of the State Bank)
Article 1. Governing scope and subjects of application
1. This Regulation provides for technical standards, sequences, procedures and measures of ensuring security, confidentiality in the maintenance of informatics equipments in Banking industry.
...
...
...
1. In this Regulation, system of Banking informatics equipments includes devices of hardware, network system, computer software and database serving one or more operational technical activities of the Bank.
2. Maintenance means the maintenance of equipments system during the process of use, exploitation in order to maintain working capacity, increase service life, early detect and prevent the risk of failure, unsafeness of each separate device, group of devices or the entire system of equipments.
3. Off-site maintenance means the performance of off-site maintenance of informatics equipments and software via computer network of the Bank.
4. Unexpected maintenance means the act of timely overcoming or preventing technical breakdowns which may cause effect to the Bank's operation.
5. Periodic maintenance means the act aiming to help the system work continuously in good condition, perform in line with the established plan.
6. Self-maintenance means the maintenance performed by technical officers of the Bank.
7. Warranty means the overcoming of bugs, technical breakdowns arising due to faults of producer within the warranty period of device or software.
8. Scenario means the collection of requirements, procedures, circumstances, data and performance results predetermined, used in the process of examination, installation, warranty, maintenance of equipments, software, information technology database.
...
...
...
10. Maintenance book means the book opened by the Bank for recording diary of each maintenance time. After each maintenance time, basic information needs recording includes time, location of performance, maintainer, completed works and uncompleted works, recommendation (if any).
11. Maintenance ticket means a leaflet used to follow up process of repair, replacement, change, additional installation of hardware devices, network devices and these devices shall be maintained from the installation until they are out of service. There contains basic information in each ticket, such as time, maintainer and information relating to the change, additional installation of devices.
12. Managerial officer means the person assigned to administer the system, examine, supervise the maintenance, repair, replacement of components, devices, organize acceptance of results after maintenance for putting into use.
Article 3. Basic principles in the maintenance of informatics equipments
1. The maintenance can be performed in site or off-site.
2. Do not interrupt normal operation of the Bank.
3. The implementation must be organized in scientific and reasonable manner in accordance with the plan approved by competent level or under the signed contract. The maintenance for each device must comply with provisions, conditions, technical standards of the producer or provider.
4. To effectively prevent the risk of failure of devices, do not infect devices, software and database of the Bank with virus in the process of maintenance.
5. To ensure system security, to keep secret of data of the Bank, prevent the stealing or illegal exploitation of data in the process of maintenance.
...
...
...
Article 4. Hardware devices (hereinafter referred to as hardware) include:
1. Devices of system: Server of different types, storage, tape library and uninterruptible power supply system (UPS from 5 KVA and more, electrical generator).
2. Special purpose devices: Personnel computer, notebook, terminal, laser printer, dot printer, scanner, uninterruptible power supply system (UPS below 5 KVA, voltage regulator), automatic teller machine, card reader of different types.
Article 5. Network system includes:
1. Communication and network devices: router, Switch, Modem, line, main optimizer (optical cable, subscriber line), IP Call processing and other communication devices.
2. Security devices: Firewall, intrusion prevention system device, Encryptor/ Descryptor, identification equipment and other security devices.
3. Network node, network cable and other accessories.
1. Banking operational software, software serving the Bank's administration, specialized Web pages.
...
...
...
3. Database includes data and database management system.
1. Individuals participating in the maintenance activity, including managerial officers, maintainers must possess full virtuous characters, competence, knowledge, professional skill of information technology; sectors requested for maintenance.
2. Organizations supplying maintenance service are specialized companies, units which engage in information technology, communication sector, have legal status and perform legal business activities; have group of qualified maintainers and enough maintainers to carry out the maintenance in line with plan, content of maintenance requested by the Bank.
3. Depending on the reality, the Bank can provide for additional conditions in correspondence with the maintenance activity such as standards of person, means of repair, requirements of software specialized in examination, discovery of errors and acceptance of results after maintenance.
Article 8. Basic contents of the maintenance of informatics equipments
1. Basic contents of the maintenance of hardware and network system:
...
...
...
b. To discover, recommend and repair, replace broken-down or out of service devices.
2. Basic contents of the maintenance of software and database:
a. Upgrading software: includes timely overcoming of shortcomings of the program (patch), satisfaction of innovation requirement of operation and replacement of algorithm or replacement of backward technology.
b. Adjustment of software: includes the change, supplement of software components more suitable with users' requirements and real state of devices.
c. Maintenance of system software (operating system): to examine the performance of the system, free disk areas. To delete intermediary data files, delete expired log files.
d. To examine, destroy informatics virus, harmful codes, informatics worm and to maintain in line with particular standards of the provider.
Article 9. Time of maintenance of informatics equipments
1. On daily, weekly basis, the user of informatics equipments must be responsible for preserving, cleaning externally equipments, do not let the equipment be dusty, timely making report to responsible person upon discovering abnormal signs of devices, software or database.
2. Periodically, the Bank must carry out the examination of technical situation of devices for timely discovery of errors that possibly occur; optimize parameters of data tables, clean up old, data and redundant data.
...
...
...
Article 10. Process of maintenance of informatics equipments
The maintenance process includes following major steps:
1. To hand over technically operation situation of machines, devices, software and database between related parties for drawing detailed implementation plan.
2. For software, database, machine, device with password, managerial officer must replace with temporary password; keep configuration and important data in order to prevent the loss of data during maintenance time.
3. The maintainer performs the maintenance. During the maintenance, the maintainer must use temporary passwords.
4. After the completion of maintenance, related parties must organize operation for acceptance of operation situation of each separate device, software and the entire system; examine standards of industrial hygiene, reexamine the record of maintenance diary.
5. The managerial officer must organize examination, supervision of maintenance activity, render passwords to their initial state and ensure devices to be ready for use.
Article 11. Organization of maintenance of informatics equipments
1. General principles
...
...
...
2. Decentralization in the implementation organization
a. Managerial unit of level 1: means units having function of management of information technology of the State Bank or having specialized function of information technology at Head Offices of banks. These units have following main tasks:
- To administer the maintenance of informatics equipments of the entire system, to assign specific tasks to junior managerial units and organize general examination, supervision of the entire system.
- To organize the implementation of maintenance for large or important information technology systems, software and united database of the entire system, server system of different types, WAN network system, backup system and security system; to maintain specialized informatics equipments at working office.
- To make estimates of expenditure and annual expenses settlement in accordance with the regime.
b. Managerial unit of level 2: means bank's branches or equivalent, subject to the direction of managerial unit of level 1 in terms of Information technology. These units have following main tasks:
- To organize the implementation of maintenance of informatics equipments at locations assigned by the managerial unit of level 1 and to maintain specialized informatics equipments at its working office.
- To make estimates of expenditure and annual expenses settlement for assigned works in accordance with the regime.
Article 12. Security in the maintenance of informatics equipments
...
...
...
2. For software, database, machine, device having password, it is required to use temporary passwords in the maintenance time and to change them right after the completion of maintenance.
3. It is necessary to prepare a standby plan of substitute machines, devices, components, accessories to ensure the convenience, quickness of the maintenance. To have measures of risk prevention upon performing maintenance.
4. Components, accessories must be technically examined before being upgraded, replaced. For devices containing confidential data and still being usable, it is required to preserve them and delete the entire data thereof before repairing, replacing. Changes in design, configuration of devices in each time of repair, replacement or upgrade must be recorded fully in diary.
5. Off-site maintenance shall only be performed when network system of the Bank is equipped with security tools including encryptor of transmission line, firewall, anti-virus devices.
MANAGEMENT OF MAINTENANCE ACTIVITY
Article 13. Responsibilities of the Bank
1. The Bank shall be obliged to have a written plan of maintenance and measures of implementation organization. To draw up plan of expenditures and prepare other resources for the maintenance on the annual basis.
2. To arrange qualified officers for assuming task of management, supervision during the process of maintenance and acceptance of results after the completion of maintenance
...
...
...
Article 14. Responsibilities of the organization which, individual who manages the maintenance
1. To organize the implementation of maintenance at the Bank in line with the plan and provisions of Chapter II of this Regulation.
2. To organize examination, supervision, guarantee of maintenance and acceptance of results after the completion of maintenance.
3. To manage the maintenance book, maintenance tickets and to draw up report on maintenance.
Article 15. Responsibilities of the organization which, individual who assumes the maintenance
1. To be obliged to perform the maintenance in compliance with the scenario approved by competent level. Any technical breakdown that can affect operation of the Bank must be reported immediately to the competent person for timely settlement, overcoming solutions.
2. When the technical breakdown is solved completely, broken-down equipments, replaced components, accessories and actual technical status of machine, device must be handed over to person in charge of management of the Bank. Breakdowns that defected machines, devices due to objective factors must be indemnified. After completion of maintenance work, it is required to record in the maintenance book and maintenance ticket.
3. To strictly comply with internal regulation on entrance and exit of the company and provisions on security of assets of the Bank.
...
...
...
Article 16. Dealing with violation
Any violation of provisions of this Regulation shall, depending on seriousness of the violation, be subject to the administrative punishment, compensation for material damages, be prosecuted for criminal liability in compliance with provisions of applicable laws.
Article 17. Responsibility of implementation
1. The Director of Banking Information Technology Department shall be responsible for providing guidance and coordinating with Chief Inspector of the State Bank, Director of General Control Department, Director of Finance Accounting Department to examine the implementation of this Regulation.
2. Head of units of the State Bank, General Manager of the State Bank branch in provinces, cities under the Central Governments management; Chairperson of the Board of Directors, General Directors (Directors) of Credit Institutions shall be responsible for the organization of implementation, examination of compliance with this Regulation in their unit.
- 1 Law No. 20/2004/QH11 of June 15, 2004 amending and supplementing a number of articles of The Law on credit institutions
- 2 Law No. 10/2003/QH11 of June 17, 2003, amending and supplementing a number of articles of the Vietnam State Bank Law
- 3 Law No. 06/1997/QH10 of December 12, 1997 on The State Bank of Vietnam
- 4 Law No. 07/1997/QH10 of December 12, 1997 on credit institutions
- 5 Decree No. 96/2008/ND-CP of August 26, 2008, defining the functions, tasks, powers and organizational structure of The State Bank of Vietnam.