Runs an essential service, in the Central African Republic

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre I (art. 7 à 12) · Read the law's page

• This binds an operator, public or private, that the Agence Nationale de la Cybersécurité designates as an essential-service operator because its continuity could be gravely affected by an incident touching an electronic-communications network or an information system.
• Comply with the protective measures the Agence Nationale de la Cybersécurité sets to secure your essential infrastructure, and hold the accreditation the Agency grants to a compliant operator.
• Expect the Agence Nationale de la Cybersécurité to inspect and audit your essential infrastructure's information systems, and to impose administrative sanctions, including pecuniary ones, if you fail to meet your cybersecurity obligations; the law does not state a fixed amount.
• Expect the Agence Nationale de la Cybersécurité to collect technical information about an incident affecting your essential infrastructure; no fixed deadline for reporting an incident to the Agency is stated.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.