01. The Underwriting Problem: Sovereign Security and Infrastructure Governance
In transaction diligence, technology and digital infrastructure assets are often assessed through standard global software architecture reviews, scalability metrics, and cloud tenancy audits, while sovereign network security and data retention requirements may be evaluated separately.
Where a target provides digital services or operates information systems within Vietnam, unresolved dependencies on applicable data-storage, retention, or system-protection requirements may create an evidentiary and operational continuity issue.
The Cybersecurity Law establishes statutory requirements relating to cybersecurity protection, information-system classification, information requests, content removal, and, for specified entities and services, data storage and retention [1, 2]. For an institutional buyer, an unresolved gap in statutory compliance is not merely a legal finding. Under the AseanPrimer framework, it represents a missing link in the Evidence Chain. If the target cannot evidence that its data storage architecture, system classification status, and compliance posture meet applicable statutory requirements, any remediation expenditure assumptions derived from system re-architecture remain structurally unquantifiable.
02. The Sovereign Security Dependency Graph
AseanPrimer does not treat sovereign cybersecurity compliance as a binary audit pass or fail. To successfully underwrite a target's operational continuity in Vietnam, the evidence chain must flow unbroken through the following dependencies:
- Data Storage & Retention Applicability: Whether the target falls within the statutory scope of the applicable data-storage and retention requirements, which categories of data are covered, and whether the target's storage and retention arrangements satisfy those requirements [1, 2].
- System Classification & Transition Status: The formal classification of each relevant information system, the applicable protection requirements, and whether any transition or remediation measures are required before the applicable statutory deadline [3].
- Cybersecurity Control & Transition Evidence: Verifiable records demonstrating the applicable protection measures, transition requirements, and current remediation status in accordance with the applicable statutory requirements [3].
- Operational Remediation Requirement: The technical, contractual, or operational measures required to address an evidenced control gap, where applicable.
When a target relies on historical architectures established before the current statutory requirements became applicable to the relevant target or system, the engine does not infer non-compliance from missing documentation. It first determines whether the relevant requirement applies, then tests whether the target can evidence compliance.
03. Tracing the Uncertainty: Two Distinct Gaps
Assume, for illustration, a fictional cross-border acquisition of a regional cloud-native software platform operating in Ho Chi Minh City. The financial model projects robust SaaS revenue growth supported by low ongoing maintenance capital expenditure.
Cross-referencing the data room reveals that the target aggregates user telemetry and service data through monitoring APIs that pipe logs directly to centralized offshore availability zones without verified compliance with any applicable Vietnamese data-storage or retention requirements.
(The following example is illustrative only; the applicable system classification and data retention status would need to be verified against the target's actual system architecture during the live transaction).
If the target cannot produce evidence demonstrating that its data storage and information systems comply with the requirements applicable to the target, the underwriting question shifts from technical uptime to regulatory operating continuity.
This introduces a critical distinction in the AseanPrimer architecture:
- Evidence Gap: The necessary data-flow schematics or system classification dossiers are simply not provided (State:
MISSING). - Dependency Gap: The underlying technical infrastructure exists, but the logical chain connecting the architecture to applicable statutory requirements remains unproven (State:
UNRESOLVED).
These are distinct states, not mutually exclusive categories. An evidence gap may produce a downstream dependency gap. In our scenario, the engine demonstrates how distinct regulatory branches converge on a single execution variable:
04. Blocking the Remediation CAPEX Input
Because regulatory applicability and the target's current control state remain UNRESOLVED, the engine keeps the remediation financial exposure in an UNQUANTIFIED state.
Following our core underwriting standard ("No evidence, no conclusion"), where remediation expenditure assumptions depend on infrastructure whose applicable cybersecurity requirements and current control state have not yet been sufficiently evidenced, that remediation-related financial assumption remains BLOCKED.
The framework does not convert unresolved regulatory uncertainty into a speculative reserve fund or an arbitrary discount. The exposure therefore remains subject to targeted evidence resolution through Requests for Information (RFI) and, where warranted, a structured technical remediation assessment.
Only where the resulting remediation requirement is sufficiently evidenced does the corresponding CAPEX assumption become eligible for inclusion in the financial model.
05. The Resolution: Targeted RFI & Transaction Response
Before allowing the affected CAPEX assumptions to enter the final financial model, the deal team must either resolve the relevant evidence gap or explicitly determine how the unresolved exposure will be treated in underwriting. The AseanPrimer framework generates distinct, targeted evidence requests:
Generated RFI #01 — Data Storage, Retention & Routing Architecture Please provide data-flow and system-architecture documentation identifying the categories of user and service data processed by the relevant Vietnamese operations, their collection and processing purposes, routing and storage locations, applicable retention periods, and supporting the target's implementation of the requirements applicable to the relevant systems and services.
Generated RFI #02 — Information System Classification & Transition Please provide the information-system classification records, assessments, or other documentation establishing the classification of all relevant systems, together with the applicable protection requirements, assessment or audit records, transition status, identified remediation measures, and implementation timelines.
If the evidence remains unresolved, the issue may affect the appropriate SPA allocation response. Depending on the final regulatory determination, potential transaction responses may include a specific remediation escrow for evidenced infrastructure remediation, post-closing covenants addressing transition or audit requirements, or restructuring cloud-tenancy arrangements prior to completion.