Under the draft, personnel directly engaged in core cybersecurity tasks could receive total monthly income - including salary and additional support - of up to 300% of their base pay, determined by rank, position and existing allowances.

This enhanced compensation is not intended for the entire workforce. Instead, it applies to a narrowly defined group tasked with particularly sensitive duties requiring strict confidentiality and continuous operational readiness.

Those working in critical positions - operating 24 hours a day, seven days a week, responding to major cyber incidents or handling high-intensity, classified tasks - may also receive performance-based bonuses and additional forms of support.

Targeted approach, not across-the-board increase

The drafting agency emphasized that the 300% income level is not a universal benchmark. Only around 5% of personnel in the cybersecurity force would qualify, estimated at roughly 100 individuals.

The remaining 95% would receive compensation aligned with their specific roles, responsibilities, risk exposure and performance, under a tiered policy framework.

According to the Ministry of Public Security, the introduction of differentiated policies covering salaries, working conditions, housing, healthcare, training and legal protection is essential to enhancing the country’s ability to prevent, detect and respond to cyber threats at a national level.

The policy is designed to link compensation with job position, competency standards and performance outcomes, while ensuring efficient use of resources by combining state budget funding with other lawful sources.

Cybersecurity as a pillar of national security

The draft underscores that in an era of comprehensive digital transformation, cybersecurity and data security are no longer purely technical concerns. They have become integral to national security, sovereignty, political stability and economic competitiveness.

Authorities argue that remuneration for frontline cybersecurity personnel should be viewed as a strategic investment in national resilience, rather than a routine expenditure under standard public sector pay structures.

With current staffing levels, the proposed policy could increase annual state spending on salaries for the cybersecurity force by approximately VND700 billion (US$28.7 million).

Despite the additional cost, policymakers stress that early investment in prevention, detection and rapid response capabilities would help mitigate far greater losses resulting from potential cyber incidents.

Tran Thuong