Makes justice decisions, in Côte d'Ivoire

Décret n°2021-917 du 22 décembre 2021, Arts. 16-17 · Read the law's page

• Inform ARTCI, the body Article 16 names, immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning; ANSSI, which now houses the national incident-response centre CI-CERT, publishes the online declaration form for every kind of entity.
• Where you are designated and notified as a critical-infrastructure operator or manager, expect your cybersecurity focal point to also serve as your liaison to CI-CERT and to a sector cybersecurity officer, roles this vocabulary does not separately express.
• This duty runs to every public or private organization operating an information system in Côte d'Ivoire, with no activity or size gate.
• Expect ARTCI, not your own organization, to take the measures it judges necessary to stop a disruption once you have notified it.

Décret n°2021-916 du 22 décembre 2021, Arts. 1-2 · Read the law's page

• Comply with the RGSSI (the ISO 27001/27002-based security standard Décret n°2021-917's audits check you against), which Article 2 makes binding on every public body and private enterprise, and, if you also operate a designated critical-infrastructure asset, with the PPIC.
• Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.
• Do not expect this décret to state its own penalty for noncompliance: enforcement runs through Décret n°2021-917's audit, certification and sanction mechanism, filed as its own row in this jurisdiction.

Décret n°2021-917 du 22 décembre 2021, Arts. 3-4, 19-21 · Read the law's page

• Undergo a security audit for certification of your information system every three years, performed by ANSSI or by an audit provider (PASSI) that ANSSI has approved.
• Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.
• Correct a major nonconformity the auditing authority identifies and have your information system re-audited within twelve months, or receive a formal notice ordering you to comply.
• Expect a financial penalty proportional to the breach's severity and the advantage you gained, capped at 300,000,000 CFA francs and doubled on a repeat breach, if you fail to complete the mandatory audit.
• If you are a public body, or a private organization with an information system located on Côte d'Ivoire's territory, you fall inside Article 3's mandatory-audit population; Article 3 names in particular a telecommunications or ICT company, a telecommunications or internet service provider, a company whose information system connects through Côte d'Ivoire's public telecommunications networks, a company that automatically processes its customers' personal data in providing its service, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider, and that list is not exhaustive.

Loi n° 2013-450, art. 25 (automated individual decisions) · Read the law's page

• Do not base an administrative or private decision assessing a person's behavior or personality solely on automated processing of their personal data.