Cybersecurity incident communication capabilities of small and medium-sized enterprises in Vietnam

This study examines the cybersecurity incident communication capabilities of small and medium-sized enterprises (SMEs) in Vietnam through a literature review and synthesis of secondary data. The findings identify a gap between technical incident-response capacity and the governance of incident-related information, reflected in four major challenges: the trade-off between speed and certainty of information; transparency and reputation; fragmented responsibility involving technology providers; and differing information needs among stakeholder groups. The study contributes by shifting the analytical focus from technical barriers toward the capacity to interpret and coordinate information. It also proposes a five-step communication process aligned with the obligations under Vietnam’s 2025 Personal Data Protection Law and designed to be feasible under the resource constraints of SMEs.