Trong b\u1ed1i c\u1ea3nh chuy\u1ec3n \u0111\u1ed5i s\u1ed1 \u0111ang di\u1ec5n ra m\u1ea1nh m\u1ebd, h\u1ec7 th\u1ed1ng c\u00f4ng ngh\u1ec7 th\u00f4ng tin kh\u00f4ng c\u00f2n l\u00e0 c\u00f4ng c\u1ee5 h\u1ed7 tr\u1ee3 m\u00e0 \u0111\u00e3 tr\u1edf th\u00e0nh “x\u01b0\u01a1ng s\u1ed1ng” v\u1eadn h\u00e0nh c\u1ee7a m\u1ecdi doanh nghi\u1ec7p. \u0110i\u1ec1u n\u00e0y \u0111\u1ed3ng ngh\u0129a v\u1edbi vi\u1ec7c r\u1ee7i ro li\u00ean quan \u0111\u1ebfn CNTT (nh\u01b0 m\u1ea5t d\u1eef li\u1ec7u, t\u1ea5n c\u00f4ng m\u1ea1ng, sai l\u1ec7ch th\u00f4ng tin) ng\u00e0y c\u00e0ng gia t\u0103ng. Ki\u1ec3m to\u00e1n c\u00f4ng ngh\u1ec7 th\u00f4ng tin ra \u0111\u1eddi nh\u01b0 m\u1ed9t nhu c\u1ea7u t\u1ea5t y\u1ebfu, gi\u00fap t\u1ed5 ch\u1ee9c nh\u1eadn di\u1ec7n, ki\u1ec3m so\u00e1t v\u00e0 gi\u1ea3m thi\u1ec3u r\u1ee7i ro li\u00ean quan \u0111\u1ebfn h\u1ea1 t\u1ea7ng v\u00e0 d\u1eef li\u1ec7u s\u1ed1.<\/p>\n\n\n\n
B\u00e0i vi\u1ebft n\u00e0y ph\u00e2n t\u00edch b\u1ee9c tranh to\u00e0n c\u1ea3nh v\u1ec1 ki\u1ec3m to\u00e1n CNTT t\u1ea1i Vi\u1ec7t Nam, t\u1eeb khung ph\u00e1p l\u00fd, s\u1ef1 c\u1ea7n thi\u1ebft, th\u1ef1c ti\u1ec5n \u00e1p d\u1ee5ng \u0111\u1ebfn c\u00e1c \u0111i\u1ec1u ki\u1ec7n v\u00e0 xu h\u01b0\u1edbng trong t\u01b0\u01a1ng lai g\u1ea7n.<\/p>\n\n\n\n
1. S\u1ef1 c\u1ea7n thi\u1ebft c\u1ee7a Ki\u1ec3m to\u00e1n CNTT: T\u1ea1i sao Doanh nghi\u1ec7p t\u1ef1 nguy\u1ec7n th\u1ef1c hi\u1ec7n?<\/strong><\/p>\n\n\n\n D\u00f9 ch\u01b0a ph\u1ea3i l\u00e0 y\u00eau c\u1ea7u b\u1eaft bu\u1ed9c tr\u00ean di\u1ec7n r\u1ed9ng, nhi\u1ec1u doanh nghi\u1ec7p t\u1ea1i Vi\u1ec7t Nam ch\u1ee7 \u0111\u1ed9ng t\u00ecm \u0111\u1ebfn ki\u1ec3m to\u00e1n CNTT v\u00ec ba nh\u00f3m m\u1ee5c ti\u00eau chi\u1ebfn l\u01b0\u1ee3c sau:<\/p>\n\n\n\n 1.1. N\u00e2ng cao uy t\u00edn v\u00e0 n\u0103ng l\u1ef1c c\u1ea1nh tranh:<\/em><\/p>\n\n\n\n -T\u0103ng ni\u1ec1m tin v\u1edbi \u0111\u1ed1i t\u00e1c: M\u1ed9t b\u00e1o c\u00e1o ki\u1ec3m to\u00e1n CNTT \u0111\u1ed9c l\u1eadp, \u0111\u1eb7c bi\u1ec7t theo chu\u1ea9n qu\u1ed1c t\u1ebf (nh\u01b0 ISO 27001, SOC 2), l\u00e0 minh ch\u1ee9ng cho th\u1ea5y h\u1ec7 th\u1ed1ng c\u1ee7a doanh nghi\u1ec7p an to\u00e0n v\u00e0 chuy\u00ean nghi\u1ec7p, \u0111i\u1ec1u n\u00e0y r\u1ea5t quan tr\u1ecdng khi l\u00e0m vi\u1ec7c v\u1edbi \u0111\u1ed1i t\u00e1c n\u01b0\u1edbc ngo\u00e0i.<\/p>\n\n\n\n -Thu h\u00fat \u0111\u1ea7u t\u01b0: Nh\u00e0 \u0111\u1ea7u t\u01b0 v\u00e0 ng\u00e2n h\u00e0ng th\u01b0\u1eddng y\u00eau c\u1ea7u \u0111\u00e1nh gi\u00e1 \u0111\u1ed9c l\u1eadp v\u1ec1 an to\u00e0n th\u00f4ng tin v\u00e0 h\u1ec7 th\u1ed1ng CNTT tr\u01b0\u1edbc khi quy\u1ebft \u0111\u1ecbnh h\u1ee3p t\u00e1c ho\u1eb7c gi\u1ea3i ng\u00e2n.<\/p>\n\n\n\n 1.2. Qu\u1ea3n tr\u1ecb r\u1ee7i ro v\u00e0 t\u1ed1i \u01b0u v\u1eadn h\u00e0nh:<\/em><\/p>\n\n\n\n -Ph\u00e1t hi\u1ec7n r\u1ee7i ro ti\u1ec1m \u1ea9n: Ki\u1ec3m to\u00e1n gi\u00fap nh\u1eadn di\u1ec7n c\u00e1c \u0111i\u1ec3m y\u1ebfu trong h\u1ea1 t\u1ea7ng (m\u00e1y ch\u1ee7, m\u1ea1ng, ph\u00e2n quy\u1ec1n), ph\u00f2ng ng\u1eeba s\u1ef1 c\u1ed1 m\u1ea5t d\u1eef li\u1ec7u ho\u1eb7c t\u1ea5n c\u00f4ng m\u1ea1ng.<\/p>\n\n\n\n -\u0110\u00e1nh gi\u00e1 hi\u1ec7u qu\u1ea3 \u0111\u1ea7u t\u01b0: Gi\u00fap l\u00e3nh \u0111\u1ea1o bi\u1ebft vi\u1ec7c \u0111\u1ea7u t\u01b0 v\u00e0o ph\u1ea7n m\u1ec1m, t\u00e0i nguy\u00ean CNTT c\u00f3 \u0111ang l\u00e3ng ph\u00ed hay kh\u00f4ng.<\/p>\n\n\n\n -C\u1ea3i thi\u1ec7n quy tr\u00ecnh n\u1ed9i b\u1ed9: Chu\u1ea9n h\u00f3a c\u00e1c quy tr\u00ecnh v\u1eadn h\u00e0nh CNTT (nh\u01b0 sao l\u01b0u, c\u1ea5p quy\u1ec1n, x\u1eed l\u00fd s\u1ef1 c\u1ed1) theo c\u00e1c chu\u1ea9n m\u1ef1c hi\u1ec7n \u0111\u1ea1i.<\/p>\n\n\n\n 1.3. \u0110\u1ea3m b\u1ea3o tu\u00e2n th\u1ee7:<\/em><\/p>\n\n\n\n -\u0110\u00e1p \u1ee9ng chu\u1ea9n m\u1ef1c qu\u1ed1c t\u1ebf: Nhi\u1ec1u \u0111\u1ed1i t\u00e1c n\u01b0\u1edbc ngo\u00e0i y\u00eau c\u1ea7u nh\u00e0 cung c\u1ea5p t\u1ea1i Vi\u1ec7t Nam ph\u1ea3i c\u00f3 c\u00e1c ch\u1ee9ng nh\u1eadn ki\u1ec3m to\u00e1n h\u1ec7 th\u1ed1ng tr\u01b0\u1edbc khi t\u00edch h\u1ee3p ho\u1eb7c chia s\u1ebb d\u1eef li\u1ec7u.<\/p>\n\n\n\n -H\u1ed7 tr\u1ee3 ki\u1ec3m to\u00e1n t\u00e0i ch\u00ednh: \u0110\u1ea3m b\u1ea3o t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a d\u1eef li\u1ec7u t\u1eeb h\u1ec7 th\u1ed1ng ERP, ph\u1ea7n m\u1ec1m k\u1ebf to\u00e1n, h\u00f3a \u0111\u01a1n \u0111i\u1ec7n t\u1eed, gi\u00fap gi\u1ea3m r\u1ee7i ro sai s\u00f3t khi ki\u1ec3m to\u00e1n t\u00e0i ch\u00ednh.<\/p>\n\n\n\n 2. Khung ph\u00e1p l\u00fd v\u1ec1 Ki\u1ec3m to\u00e1n CNTT t\u1ea1i Vi\u1ec7t Nam<\/strong><\/p>\n\n\n\n -Lu\u1eadt Ki\u1ec3m to\u00e1n \u0111\u1ed9c l\u1eadp 2011: t\u1eadp trung ch\u1ee7 y\u1ebfu v\u00e0o ki\u1ec3m to\u00e1n b\u00e1o c\u00e1o t\u00e0i ch\u00ednh, ki\u1ec3m to\u00e1n tu\u00e2n th\u1ee7 v\u00e0 ki\u1ec3m to\u00e1n ho\u1ea1t \u0111\u1ed9ng; kh\u00f4ng c\u00f3 ch\u01b0\u01a1ng m\u1ee5c hay \u0111i\u1ec1u kho\u1ea3n ri\u00eang bi\u1ec7t \u0111\u1ecbnh ngh\u0129a v\u00e0 b\u1eaft bu\u1ed9c v\u1ec1 ki\u1ec3m to\u00e1n CNTT nh\u01b0 m\u1ed9t l\u0129nh v\u1ef1c ri\u00eang. Tuy nhi\u00ean, theo \u0110i\u1ec1u 4 v\u00e0 36 c\u1ee7a Lu\u1eadt n\u00e0y, vi\u1ec7c ki\u1ec3m to\u00e1n h\u1ec7 th\u1ed1ng th\u00f4ng tin c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c xem l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a ki\u1ec3m to\u00e1n ho\u1ea1t \u0111\u1ed9ng ho\u1eb7c ki\u1ec3m to\u00e1n tu\u00e2n th\u1ee7, t\u00f9y theo ph\u1ea1m vi h\u1ee3p \u0111\u1ed3ng ki\u1ec3m to\u00e1n.<\/p>\n\n\n\n -Quy\u1ebft \u0111\u1ecbnh 2076\/Q\u0110-KTNN ng\u00e0y 14\/12\/2021 c\u1ee7a Ki\u1ec3m to\u00e1n Nh\u00e0 n\u01b0\u1edbc h\u01b0\u1edbng d\u1eabn ki\u1ec3m to\u00e1n c\u00f4ng ngh\u1ec7 th\u00f4ng tin trong c\u00e1c cu\u1ed9c ki\u1ec3m to\u00e1n nh\u00e0 n\u01b0\u1edbc.<\/p>\n\n\n\n -Quy\u1ebft \u0111\u1ecbnh 1934\/Q\u0110-KTNN v\u1ec1 \u0111\u00e1nh gi\u00e1 \u1ee9ng d\u1ee5ng CNTT.<\/p>\n\n\n\n -C\u00e1c tr\u01b0\u1eddng h\u1ee3p g\u1ea7n nh\u01b0 b\u1eaft bu\u1ed9c:<\/p>\n\n\n\n M\u1eb7c d\u00f9 kh\u00f4ng g\u1ecdi l\u00e0 ki\u1ec3m to\u00e1n CNTT, m\u1ed9t s\u1ed1 ng\u00e0nh nh\u1ea1y c\u1ea3m v\u1ec1 d\u1eef li\u1ec7u v\u00e0 t\u00e0i ch\u00ednh b\u1ecb bu\u1ed9c ph\u1ea3i th\u1ef1c hi\u1ec7n ki\u1ec3m tra, \u0111\u00e1nh gi\u00e1 h\u1ec7 th\u1ed1ng CNTT \u0111\u1ecbnh k\u1ef3, v\u00e0 c\u00f3 th\u1ec3 ph\u1ea3i thu\u00ea \u0111\u01a1n v\u1ecb \u0111\u1ed9c l\u1eadp:<\/p>\n\n\n\n L\u0129nh v\u1ef1c Ng\u00e2n h\u00e0ng: Theo Th\u00f4ng t\u01b0 51\/2024\/TT-NHNN, t\u1ed5 ch\u1ee9c t\u00edn d\u1ee5ng ph\u1ea3i \u0111\u1ecbnh k\u1ef3 \u0111\u00e1nh gi\u00e1 h\u1ec7 th\u1ed1ng ki\u1ec3m so\u00e1t n\u1ed9i b\u1ed9 v\u00e0 c\u00f3 th\u1ec3 thu\u00ea \u0111\u01a1n v\u1ecb ki\u1ec3m to\u00e1n \u0111\u1ed9c l\u1eadp \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 ho\u1ea1t \u0111\u1ed9ng CNTT, an ninh m\u1ea1ng v\u00e0 ki\u1ec3m so\u00e1t n\u1ed9i b\u1ed9.<\/p>\n\n\n\n L\u0129nh v\u1ef1c Ch\u1ee9ng kho\u00e1n: Th\u00f4ng t\u01b0 121\/2020\/TT-BTC quy \u0111\u1ecbnh c\u00f4ng ty ch\u1ee9ng kho\u00e1n ph\u1ea3i x\u00e2y d\u1ef1ng h\u1ec7 th\u1ed1ng ki\u1ec3m so\u00e1t n\u1ed9i b\u1ed9 v\u00e0 qu\u1ea3n tr\u1ecb r\u1ee7i ro CNTT, \u0111\u1ed3ng th\u1eddi ch\u1ecbu s\u1ef1 ki\u1ec3m to\u00e1n n\u1ed9i b\u1ed9 v\u00e0 ki\u1ec3m to\u00e1n \u0111\u1ed9c l\u1eadp theo quy \u0111\u1ecbnh.<\/p>\n\n\n\n H\u1ea1 t\u1ea7ng tr\u1ecdng y\u1ebfu: Lu\u1eadt An to\u00e0n th\u00f4ng tin m\u1ea1ng 2015 v\u00e0 Ngh\u1ecb \u0111\u1ecbnh 85\/2016\/N\u0110-CP y\u00eau c\u1ea7u c\u00e1c doanh nghi\u1ec7p h\u1ea1 t\u1ea7ng quan tr\u1ecdng (vi\u1ec5n th\u00f4ng, n\u0103ng l\u01b0\u1ee3ng, giao th\u00f4ng) ph\u1ea3i ki\u1ec3m tra, \u0111\u00e1nh gi\u00e1 an to\u00e0n h\u1ec7 th\u1ed1ng.<\/p>\n\n\n\n Doanh nghi\u1ec7p th\u00f4ng th\u01b0\u1eddng kh\u00f4ng b\u1ecb b\u1eaft bu\u1ed9c ki\u1ec3m to\u00e1n CNTT. Tuy nhi\u00ean, n\u1ebfu ho\u1ea1t \u0111\u1ed9ng trong l\u0129nh v\u1ef1c ng\u00e2n h\u00e0ng, t\u00e0i ch\u00ednh, ho\u1eb7c l\u00e0 h\u1ea1 t\u1ea7ng tr\u1ecdng y\u1ebfu, doanh nghi\u1ec7p s\u1ebd ph\u1ea3i tu\u00e2n th\u1ee7 c\u00e1c quy \u0111\u1ecbnh ki\u1ec3m tra, \u0111\u00e1nh gi\u00e1 CNTT \u0111\u1ecbnh k\u1ef3 c\u1ee7a ng\u00e0nh \u0111\u00f3.<\/p>\n\n\n\n 3. \u0110i\u1ec1u ki\u1ec7n h\u00e0nh ngh\u1ec1 Ki\u1ec3m to\u00e1n CNTT:<\/strong><\/p>\n\n\n\n V\u00ec Lu\u1eadt Ki\u1ec3m to\u00e1n \u0111\u1ed9c l\u1eadp c\u1ee7a Vi\u1ec7t Nam ch\u01b0a c\u00f3 quy \u0111\u1ecbnh ch\u00ednh th\u1ee9c cho ch\u1ee9c danh Ki\u1ec3m to\u00e1n vi\u00ean CNTT nh\u01b0 c\u00e1ch c\u1ea5p ch\u1ee9ng ch\u1ec9 Ki\u1ec3m to\u00e1n vi\u00ean, th\u1ecb tr\u01b0\u1eddng lao \u0111\u1ed9ng v\u00e0 c\u00e1c doanh nghi\u1ec7p s\u1eed d\u1ee5ng c\u00e1c chu\u1ea9n m\u1ef1c v\u00e0 ch\u1ee9ng ch\u1ec9 qu\u1ed1c t\u1ebf \u0111\u1ec3 c\u00f4ng nh\u1eadn n\u0103ng l\u1ef1c h\u00e0nh ngh\u1ec1.<\/p>\n\n\n\n M\u1ed9t ki\u1ec3m to\u00e1n vi\u00ean CNTT c\u1ea7n c\u00f3 ki\u1ebfn th\u1ee9c t\u1ed5ng h\u1ee3p s\u00e2u r\u1ed9ng v\u1ec1 c\u1ea3 hai m\u1ea3ng: (i)C\u00f4ng ngh\u1ec7:<\/em> Hi\u1ec3u bi\u1ebft v\u1ec1 h\u1ea1 t\u1ea7ng m\u1ea1ng, h\u1ec7 \u0111i\u1ec1u h\u00e0nh, c\u01a1 s\u1edf d\u1eef li\u1ec7u, an to\u00e0n th\u00f4ng tin, quy tr\u00ecnh ph\u00e1t tri\u1ec3n ph\u1ea7n m\u1ec1m; (ii)Ki\u1ec3m to\u00e1n:<\/em> N\u1eafm v\u1eefng c\u00e1c nguy\u00ean t\u1eafc ki\u1ec3m so\u00e1t n\u1ed9i b\u1ed9, ph\u01b0\u01a1ng ph\u00e1p lu\u1eadn \u0111\u00e1nh gi\u00e1 r\u1ee7i ro, v\u00e0 k\u1ef9 thu\u1eadt thu th\u1eadp b\u1eb1ng ch\u1ee9ng ki\u1ec3m to\u00e1n.<\/p>\n\n\n\n Ch\u1ee9ng ch\u1ec9 h\u00e0nh ngh\u1ec1 ph\u1ed5 bi\u1ebfn:<\/em><\/p>\n\n\n\n CISA<\/strong> (Certified Information Systems Auditor): \u0110\u00e2y l\u00e0 ch\u1ee9ng ch\u1ec9 \u0111\u01b0\u1ee3c c\u00f4ng nh\u1eadn r\u1ed9ng r\u00e3i nh\u1ea5t tr\u00ean to\u00e0n c\u1ea7u, do Hi\u1ec7p h\u1ed9i Ki\u1ec3m to\u00e1n v\u00e0 Ki\u1ec3m so\u00e1t H\u1ec7 th\u1ed1ng Th\u00f4ng tin (ISACA) c\u1ea5p. CISA<\/a> \u0111\u01b0\u1ee3c xem l\u00e0 ti\u00eau chu\u1ea9n v\u00e0ng \u0111\u1ec3 ch\u1ee9ng minh n\u0103ng l\u1ef1c v\u00e0 s\u1ef1 chuy\u00ean nghi\u1ec7p trong l\u0129nh v\u1ef1c ki\u1ec3m to\u00e1n CNTT.<\/p>\n\n\n\n CIA<\/strong> (Certified Internal Auditor): M\u1eb7c d\u00f9 l\u00e0 ch\u1ee9ng ch\u1ec9 v\u1ec1 ki\u1ec3m to\u00e1n n\u1ed9i b\u1ed9 n\u00f3i chung, ch\u01b0\u01a1ng tr\u00ecnh h\u1ecdc c\u1ee7a CIA (\u0111\u1eb7c bi\u1ec7t l\u00e0 Part 3) bao g\u1ed3m c\u00e1c n\u1ed9i dung quan tr\u1ecdng v\u1ec1 ki\u1ec3m to\u00e1n CNTT v\u00e0 b\u1ea3o m\u1eadt, r\u1ea5t ph\u00f9 h\u1ee3p cho c\u00e1c ki\u1ec3m to\u00e1n vi\u00ean n\u1ed9i b\u1ed9.<\/p>\n\n\n\n CISM (Qu\u1ea3n l\u00fd b\u1ea3o m\u1eadt), CISSP (Chuy\u00ean gia an ninh m\u1ea1ng) c\u0169ng r\u1ea5t c\u00f3 gi\u00e1 tr\u1ecb, \u0111\u1eb7c bi\u1ec7t khi ki\u1ec3m to\u00e1n chuy\u00ean s\u00e2u v\u1ec1 an ninh.<\/p>\n\n\n\n 4. Xu h\u01b0\u1edbng t\u01b0\u01a1ng lai c\u1ee7a Ki\u1ec3m to\u00e1n CNTT t\u1ea1i Vi\u1ec7t Nam<\/strong><\/p>\n\n\n\n Ki\u1ec3m to\u00e1n CNTT \u0111ang ph\u00e1t tri\u1ec3n nhanh ch\u00f3ng \u0111\u1ec3 b\u1eaft k\u1ecbp v\u1edbi c\u00f4ng ngh\u1ec7. C\u00e1c xu h\u01b0\u1edbng ch\u00ednh bao g\u1ed3m:<\/p>\n\n\n\n -T\u1eadp trung v\u00e0o c\u00f4ng ngh\u1ec7 m\u1edbi: Ki\u1ec3m to\u00e1n kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf h\u1ec7 th\u1ed1ng m\u00e1y ch\u1ee7 truy\u1ec1n th\u1ed1ng m\u00e0 m\u1edf r\u1ed9ng sang c\u00e1c r\u1ee7i ro li\u00ean quan \u0111\u1ebfn Tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o, t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a d\u1eef li\u1ec7u l\u1edbn, ki\u1ec3m so\u00e1t nh\u00e0 cung c\u1ea5p d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y.<\/p>\n\n\n\n -Ki\u1ec3m to\u00e1n An ninh m\u1ea1ng: C\u00e1c cu\u1ed9c ki\u1ec3m to\u00e1n s\u1ebd t\u1eadp trung s\u00e2u v\u00e0o kh\u1ea3 n\u0103ng ph\u00f2ng th\u1ee7, ph\u00e1t hi\u1ec7n v\u00e0 ph\u1ea3n \u1ee9ng v\u1edbi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ea1ng.<\/p>\n\n\n\n