Runs an essential service, in Botswana

Cybersecurity Act, 2025 (Act No. 21 of 2025), s. 53 · Read the law's page

• This Act is not yet in force: it comes into operation on the date the Minister appoints by Order published in the Gazette (section 1), and an owner is bound only from that date.
• This binds the owner of critical information or critical national information infrastructure that the National Cybersecurity Authority has designated by Notice in the Gazette, public or private (reached by declaring that you operate an essential service).
• Immediately notify the Botswana Computer Security Incident Response Team, in the manner it determines, of a perceived or actual cybersecurity incident in respect of the critical information or critical national information infrastructure, or in respect of any computer system under your control that is interconnected or communicates with it (section 53(1)).
• Submit a preliminary cybersecurity incident report to the Team immediately after the incident is detected and within not more than eight hours of notifying it, in the manner and form prescribed (section 53(2)).
• Submit a detailed cybersecurity incident report to the Team as soon as the incident is resolved (section 53(3)).
• Establish mechanisms and processes, in accordance with the cybersecurity standards prescribed, to detect a cybersecurity threat in respect of the critical information or critical national information infrastructure (section 53(4)).

Cybersecurity Act, 2025 (Act No. 21 of 2025), ss. 45-52 · Read the law's page

• This Act is not yet in force: it comes into operation on the date the Minister appoints by Order published in the Gazette (section 1), and an owner is bound only from that date.
• This binds the owner of information or information infrastructure that the National Cybersecurity Authority designates by Notice in the Gazette as critical information or critical national information infrastructure in a critical sector, public or private (reached by declaring that you operate an essential service).
• Comply with the baseline security requirements prescribed for the designated critical information or critical national information infrastructure (section 45(3)).
• Apply for the licence the Act requires of an information or information infrastructure designated as critical, in the form and manner prescribed (section 45(2)).
• Register the critical information or critical national information infrastructure with the Authority within 14 days of the designation (section 47(1)).
• Host critical information or critical national information infrastructure within Botswana unless the Authority authorises hosting outside Botswana (section 49).
• Seek the Authority's approval of any change of ownership within seven days of the change (section 50(1)).
• Remedy within the period the Authority states in writing any non-compliance that an audit under section 51 finds (section 52).