Trains models, in the Republic of the Congo

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 18 et 19 · Read the law's page

• Inform the agency in charge of the security of information systems and networks (defined in Article 3) without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network; the Law sets the clock as 'without delay' and states no hour limit (Article 18).
• Comply with the measures the agency decides in order to end those disturbances (Article 18).
• This binds every operator of an information system or an electronic communications network, whether a public body or a private organisation; the Law excludes the systems and networks used for national defence and security (Article 2).

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 4 à 11 · Read the law's page

• Take adequate measures to protect against and prevent any risk to third parties arising from your use of information systems and networks (Article 4).
• Be accountable for the security of the systems and networks you develop, own, supply, manage, maintain or use, and continuously review and assess your own security policies, practices, measures and procedures to make sure they fit their environment (Article 4).
• Do everything possible to prevent, detect and respond to security incidents (Article 5).
• Exchange the information you hold on threats to and vulnerabilities of networks and systems in an appropriate manner, and put in place procedures for rapid and effective cooperation to prevent and detect security incidents (Article 6).
• Carry out risk assessments that cover the main internal and external factors, such as technology, physical and human factors, and the policies and services of third parties (Article 8).
• Design, implement and coordinate your information systems and networks to optimize their security, with technical and non-technical protective measures proportionate to the value of the information in them (Article 9).
• Base your security management on the risk assessment, covering every level of your activities and including responses to identifiable or foreseeable threats, the prevention, detection and resolution of incidents, system recovery, permanent maintenance, control and audit (Article 10).
• Guarantee the security of your systems and networks constantly as risks evolve, with continuous risk assessment and appropriate changes to your security policies, practices, measures and procedures (Article 11).
• This binds anyone, whether a citizen, a business, an organization or a public authority, that develops, owns, supplies, manages, maintains or uses an information system or network; the Law excludes the systems and networks used for national defense and security (Article 2).

Loi n° 27-2020 du 5 juin 2020 portant lutte contre la cybercriminalité, arts. 4, 5, 6, 63 · Read the law's page

• Do not access or attempt to access, without authorization, all or part of an information system.
• Do not remain or attempt to remain connected, without authorization, to an information system.
• Do not hinder or attempt to hinder the functioning of an information system.
• Do not copy or attempt to copy computer data to the prejudice of a third party without authorization.
• Reading a public, unauthenticated page without accessing, remaining connected to, hindering, or copying data from a system without authorization has not itself been held to violate these articles.

Loi n° 27-2020 du 5 juin 2020 portant lutte contre la cybercriminalité, arts. 7, 8, 17, 22 · Read the law's page

• Do not introduce, or attempt to introduce, data into an information system by fraudulent means.
• Do not intercept, or attempt to intercept, by fraudulent means and by technical means, data of an information system during its non-public transmission to, from or within an information system.
• Do not collect personal data by fraudulent, unfair or unlawful means.
• Do not divert personal data you hold in the course of recording, classifying, transmitting or otherwise processing it from the purpose defined by the personal-data laws and regulations, by the data-protection commission's authorizing decision, or by the prior declarations for the processing.