[Checklist] 100 Security Questions for Small and Medium Businesses

30 Actions Vietnamese Businesses MUST Take to Comply with the 2025 Cybersecurity Law - Law No. 116/2025/QH15

Insider activity is one of the leading causes of data-leak incidents - through privilege abuse, unauthorized copying, or employees taking data with them when they leave. This checklist helps organizations identify weaknesses in HR-related data governance, assess the current state, and put in place controls that prevent leaks from inside the organization. It's particularly relevant for businesses that collect, store, and process customer data - especially in finance, technology, real estate, and e-commerce - for HR, IT, and InfoSec teams that need to jointly build internal-control policies, and for organizations preparing to comply with Vietnam's Decree 13/2023/NĐ-CP on personal-data protection.

Complying with international standards such as ISO/IEC 27001:2022 not only protects information assets comprehensively but also builds trust with customers and partners. This document provides a detailed list of information-security controls aligned with the 2022 revision of ISO/IEC 27001, enabling organizations to track, assess, and implement optimal security measures.