Cybersecurity · Industry brief

Vietnam's Ministry of Public Security issued Circular No. 48/2026/TT-BCA, introducing QCVN 11:2026/BCA, a new national technical regulation on cybersecurity requirements for Internet Protocol surveillance camera devices and IoT hardware. The standard takes effect July 1, 2026, replacing the previous QCVN 135 regulation. Manufacturers entering the Vietnamese market should note that type approval and conformity assessment procedures remain pending formal publication, as is the risk-based controlled product list that will establish administrative workflows. The regulation reflects broader cybersecurity enforcement tightening across ASEAN, with similar updates occurring in Singapore and Indonesia.

The Australian Cyber Security Centre (ACSC) should be formally empowered as a dedicated cybersecurity regulator with authority comparable to the Therapeutic Goods Administration, establishing mandatory baseline standards, certifying high-risk products and services, investigating major incidents, and enforcing compliance across critical sectors. The Cyber Security Act 2024 represents an initial step toward moving Australia away from voluntary compliance frameworks, but regulatory evolution is needed as cyber threats increasingly pose national security and public safety risks comparable to health, aviation, and nuclear sectors that rely on formal regulatory oversight rather than market incentives alone. The proposed model would separate regulatory functions (standards, certification, compliance, accountability) from operational cyber defence, which would remain with the Australian Signals Directorate.