Operates a social platform, in Morocco

Loi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 26, 29, 32 et 34, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe · Read the law's page

• This duty reaches you where you operate an online marketplace or service-contract platform, an online search engine, or a datacenter or cloud-computing hosting service (a prestataire de services numériques under Article 2), or you publish an Internet platform (éditeur de plateformes Internet); Loi n° 05-20 groups you with a public telecommunications network operator, an Internet access provider and a cybersecurity service provider as an opérateur; a public telecommunications network operator or Internet access provider among them is reached by declaring that it provides telecommunications services.
• Comply with the national cybersecurity authority's directives on retaining, for one year from generation, the technical data needed to identify a cybersecurity incident, including connection data, system logs, and the security-event traces your operating systems, applications and security products generate.
• Take the protective measures the national cybersecurity authority directs to prevent and neutralize the effects of a threat or breach affecting your clients' information systems.
• If you are a digital service provider, identify the risks threatening the security of your own networks and information systems, and take the technical and organizational measures needed to manage those risks, avoid incidents, and minimize their impact, so as to guarantee the continuity of your services.
• Expect the national cybersecurity authority to open a compliance audit at your own cost if it is informed you do not meet one of these obligations, and to order your directors, within a deadline it sets, to come into compliance.

Loi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 27, 30 et 33, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe · Read the law's page

• This duty reaches you on the same terms as Loi n° 05-20's other opérateur security duties: you operate an online marketplace or service-contract platform, a search engine, a datacenter or cloud-computing hosting service, or you publish an Internet platform.
• Inform your clients of a vulnerability in your information systems, or of a breach that could affect them.
• When you detect an event that could affect the security of a client's information systems, inform the national cybersecurity authority of it without delay.
• If you are a digital service provider, as soon as you become aware of an incident affecting the networks or information systems your service needs, declare it to the national cybersecurity authority where the information available to you shows the incident has a significant impact on providing that service.