Firewall systems are advanced network security devices that safeguard against cyber threats by monitoring and controlling network traffic based on predefined rules. Their features include data encryption, threat detection, and the creation of secure VPN channels, making them indispensable in today’s digital age. The demand for such systems is growing in Vietnam, driven by the expansion of digital services and heightened cybersecurity needs.

However, foreign trading companies face significant challenges when importing these products into Vietnam without a local business entity. The regulatory environment is strict, and the process can be time-consuming and resource-intensive. This article outlines the process, and regulations for importing the product to Vietnam, and introduces Importer of Record (IOR) services as an ideal solution, offering a streamlined approach to compliance and logistics, enabling foreign companies to enter the Vietnamese market efficiently.

1. What Are Firewall System Products?

Firewall systems are critical components of network security infrastructure, designed to protect against unauthorized access, malware, and other cyber threats. They operate by filtering network traffic based on security rules, ensuring that only legitimate data passes through. Modern firewall systems, such as the Cisco Firepower Series, Fortinet FortiGate, and Palo Alto Networks PA Series, offer advanced features including:

• Data Encryption: Securing data in transit to prevent interception.
• Threat Detection: Identifying and mitigating potential security breaches in real time.
• Secure VPN Channel Creation: Facilitating secure remote access for users.

These systems are vital for industries such as finance, telecommunications, and technology, where protecting sensitive data and ensuring network reliability are paramount. For instance, financial institutions use firewalls to comply with data protection regulations, while telecommunications companies rely on them to secure communication channels, reflecting a global trend toward stricter cybersecurity measures.

2. Why Companies Need Firewall Systems

The need for firewall systems is driven by several factors:

• Protection of Sensitive Data: With increasing cyber threats, companies must safeguard confidential information from breaches, which firewalls help achieve by blocking unauthorized access.
• Regulatory Compliance: Various industries, especially finance and healthcare, are subject to data protection laws that mandate robust security measures, including firewalls.
• Enhancing Network Reliability and Communication Security: Firewalls ensure stable network performance and secure data exchange, critical for business operations.
• Global Cybersecurity Trends: The rise in cyber attacks and regulatory pressures worldwide underscores the indispensability of firewall systems, particularly in emerging markets like Vietnam.

Recent statistics highlight the urgency, with cybercrime costs projected to reach $10.5 trillion annually by 2025, emphasizing the need for robust security solutions like firewalls.

3. Regulations and Procedures to Import Firewall Systems to Vietnam

Importing firewall systems into Vietnam is governed by a stringent legal framework, given their classification as cryptographic civil products. The import approval process involves multiple steps and depend on the specific products and HS codes the requirements would be different.

3.1. Having a company to manage the importing process

First, you need to establish a presence in Vietnam. Typically, this requires setting up a company with trading functions in Vietnam. A trading company is a non-conditional business, has no minimum capital, and allows 100% foreign ownership. Once established, the trading company can immediately engage in wholesale activities, which involve selling the company’s products to another company (B2B).

In cases where the importer wants to sell products directly to Vietnamese consumers, such as in so-called retail activities (B2C), the company must obtain a retail license to conduct retail activities in Vietnam. The process of establishing a trading company usually takes 4-6 weeks, while obtaining the Retail License can take from 1 to 3 months.

3.2 Obtaining the required license for trading firewall system products

Based on the current legal regulations in Vietnam, including the Law on Cyber Information Security 2015, Decree No. 58/2016/ND-CP, and Circular 10/2022/TT-BTTTT, firewall products in Vietnam are classified based on technical specifications and HS (Harmonized System) codes, leading to the requirement of two different types of licenses:

• Civil Cryptography Trading License: Applicable to firewall products that have encryption functions or use cryptographic algorithms to protect information.
• Cyber Information Security License: Applicable to firewall products that do not have encryption functions or do not fall under the category of civil cryptographic products, primarily focusing on basic network security.

This classification is determined based on the main function of the product, national technical standards, and the applicable HS code during importation. Thus, dividing firewall products into these two categories aligns with the legal realities in Vietnam.

To determine which license a firewall product requires, it is necessary to consider its specific technical features and HS code. Here’s a detailed classification:

Firewall Products Requiring a Civil Cryptography License

Features:

• Possess data encryption functions or use symmetric/asymmetric cryptographic algorithms.
• Typically support features like creating secure VPN channels, protecting data with cryptographic techniques, or encrypting network communication.
• Classified as civil cryptographic products under the provisions of Decree 58/2016/ND-CP.

Common HS Codes:

• 8517.62 (communication devices with encryption functions).
• 8471.80 (control units with advanced security features).
• Other HS codes under the category of civil cryptographic products as regulated by the Government Cipher Committee.

Licensing Authority:

• Government Cipher Committee (under the Ministry of National Defense).

Firewall Products Requiring a Cyber Information Security License

Features:

• Do not have encryption functions or do not use cryptographic algorithms.
• Focus on basic network security functions such as packet filtering, access control, and intrusion detection/prevention.
• Not classified as civil cryptographic products but fall under the category of cyber information security products as per Circular 10/2022/TT-BTTTT.

Common HS Codes:

• 8471.30 (laptops with basic firewall functions).
• 8471.41 (desktops with firewall software).
• 8471.90 (other devices without encryption functions).

Licensing Authority:

• Ministry of Public Security.

In practice, most modern firewall products integrate encryption functions (e.g., VPN or data encryption), so the majority will require a Civil Cryptography License. However, products with only basic functions such as packet filtering, unrelated to encryption, may require a Cyber Information Security License.

3.3 Obtaining the Certificate of Conformity

A Certificate of Conformity is an official document issued by a regulatory authority, confirming that a product—such as a firewall system—meets specific technical standards and safety requirements. For firewall systems, which are critical for protecting networks from cyber threats, this certification ensures:

• Network Security: The system effectively prevents unauthorized access, detects threats, and mitigates data breaches.
• Data Encryption: It employs approved encryption methods to secure data in transit.
• Standards Compliance: It adheres to national or international cybersecurity standards, such as ISO/IEC 27001 or Vietnam’s TCVN 12:2022/BQP.

This certificate is often mandatory for importing, selling, or deploying firewall systems in regulated markets. Without it, products may be barred from entry, leading to delays or penalties.

The requirements vary based on whether the firewall is cryptographic or non-cryptographic. Below are the essentials:

General Requirements

• Technical Documentation: Detailed specs, including hardware, software, security features, and encryption details (if applicable).
• Standards Compliance: Adherence to Vietnamese standards like TCVN 12:2022/BQP (cryptographic) or IT security standards (non-cryptographic).
• Testing Reports: Results from accredited labs verifying performance and security.
• Local Representation: Foreign companies need a local agent or Importer of Record (IOR) to manage the process.

Specific Requirements for Cryptographic Firewall Systems

• Encryption Documentation: Details on algorithms, key lengths, and key management.
• Cryptographic Standards: Compliance with Government Cipher Committee requirements.
• Additional Proof: International standards (e.g., ISO/IEC 27001) may support but don’t replace local compliance.

Specific Requirements for Non-Cryptographic Firewall Systems

• Security Features: Documentation of intrusion detection, packet filtering, etc.
• Conformity Assessment: May require a Certificate of Conformity from MIC or an accredited body.

3.4. Obtaining the Import License

After securing the trading license and type approval certificate, companies apply for an import license for specific products. Required documentation includes (specific products will have some changes on the document):

• An import permit application letter.
• A copy of the Civil Cryptography Products and Services Trading License.
• A copy of the type approval certificate.
• Product specifications, detailing purpose, encryption used, operations, and configurations.
• Supplier agreements and other certifications ensure compliance.

The review process for these licenses typically takes 1-2 months, depending on the completeness of the dossier, with the import permit now granted for one year, down from two years as of early 2019.

3.5 Starting the Custom Clearance Process

Once licenses are obtained, customs clearance involves submitting all documentation to Vietnamese customs authorities, ensuring compliance with standards, and paying applicable taxes and duties. This step is crucial to avoid delays, with IOR services often assisting in navigating these procedures.

4. The Importer of Record (IOR) Services Made the Import Process Easier?

Importer of Record (IOR) services are provided by a third-party entity that acts as the legal importer on behalf of a foreign company, handling all import-related processes. In Vietnam, IOR services are particularly valuable for companies without a local presence. An IOR is a local company contracted to manage the importation, ensuring compliance with Vietnamese laws and regulations.

• Scope of Services:
  • Securing the necessary trading and import licenses, including the type approval certificate.
  • Handling customs clearance, including preparing declarations and paying taxes and duties.
  • Managing delivery, and arranging logistics from port to the final destination.
  • Ensuring regulatory compliance, leveraging local expertise to navigate complex requirements.

Without a local entity, foreign companies face barriers in obtaining licenses and understanding regulations. IOR services eliminate the need for establishing a subsidiary or joint venture, saving time and resources, especially for companies testing the market or making occasional imports. For example, companies like VNBG Access, Emerhub, Tron Chan, and FGX offer IOR services, facilitating imports of IT equipment, including firewalls, into Vietnam.

5. Why Choose Importer of Record Services Over the Traditional Approach?

Opting for IOR services over the traditional approach of establishing a local entity offers several advantages:

• Simplified Process: Establishing a local entity involves significant time and cost, including obtaining investment registration certificates and meeting infrastructure requirements. IOR services allow immediate importing without these steps, ideal for companies with time constraints or limited import frequency.
• Expertise in Compliance: IOR providers have deep knowledge of Vietnamese import regulations, reducing the risk of application rejections due to incomplete or incorrect documentation. This local expertise is crucial given the lack of standardized documents and the complexity of technical requirements.
• Cost-Effectiveness: Setting up a local presence incurs overheads like office space, staff salaries, and legal fees. IOR services minimize these costs, offering a pay-per-use model, making it economical for small-scale or occasional importers.
• Focus on Core Business: By outsourcing import logistics, companies can focus on core activities like sales, marketing, and partnerships, enhancing operational efficiency. This is particularly beneficial for tech firms aiming to penetrate the Vietnamese market quickly.
• Risk Mitigation: Non-compliance with import regulations can lead to penalties, shipment delays, or confiscation. IOR services mitigate these risks by ensuring all legal and procedural requirements are met, leveraging their experience to avoid common pitfalls.

6. Export Firewall System Product to Vietnam with VNBG ACCESS

With many years of experience in consulting and handling import procedures, inspection, compliance certification, and civilian cryptographic devices such as routers, switches, firewalls, and secure channel devices for leading global brands like Cisco, Asus, Meraki, etc. VNBG Access can provide full support for your import procedures, including:

• Evaluating documentation and technical information of the product before importation into Vietnam, and advising on the appropriate import procedures.
• Determining whether the product contains civilian cryptographic features by assessing its technical specifications.
• Performing and assisting with initial customs clearance procedures for firewall system products.
• Representing businesses in conducting testing, measurement, certification, and declaration of compliance for imported firewall system products.
• For products that are not civilian cryptographic devices, VNBG Access will provide the most convenient import solutions for both the business and the product to be imported into Vietnam.
• Advising and providing a preliminary assessment of the enterprise’s current conditions for obtaining a civilian cryptographic license, including recommendations for remedial measures if the enterprise does not meet the necessary conditions for license acquisition.

VNBG Access offers a comprehensive import service, which includes evaluating, consulting, preparing documentation, executing the import process, and delivering the product to the recipient easily and conveniently. For newly established businesses, individual customers wanting to import firewall system products into Vietnam for business use, or companies that do not yet meet the conditions for importing firewall system products, VNBG Access is fully capable and provides complete Importer of Record (IOR) solutions for importing popular firewall system products to Vietnam, such as: FortiGate 6000F series, FortiGate 71F, Cisco Firepower 2110 NGFW, Cisco Meraki MX series, Firebox T35, Firebox T55, etc