Runs an essential service, in the Republic of the Congo

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 12 à 16 · Read the law's page

• Have your systems and networks audited for security, periodically; the nature of the audit, its periodicity and the follow-up of its recommendations are fixed by regulation (Articles 12 and 13).
• Have the audit carried out by an expert previously approved by the agency (Article 16).
• If you have not carried out the audit, carry it out within three months of the agency's warning; after that period the agency appoints an expert to audit at your expense (Article 14).
• Collaborate with the agency and the audit experts, and put at the agency's disposal all documents and files relating to IT security (Article 15).
• This binds the information systems and electronic communications networks of public bodies, other than those of the ministries in charge of national defence and public security and of diplomatic and consular missions, and of the bodies on the list that Article 12 leaves to regulation; it is reached by declaring that you operate an essential service.

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 18 et 19 · Read the law's page

• Inform the agency in charge of the security of information systems and networks (defined in Article 3) without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network; the Law sets the clock as 'without delay' and states no hour limit (Article 18).
• Comply with the measures the agency decides in order to end those disturbances (Article 18).
• This binds every operator of an information system or an electronic communications network, whether a public body or a private organisation; the Law excludes the systems and networks used for national defence and security (Article 2).

Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 4 à 11 · Read the law's page

• Take adequate measures to protect against and prevent any risk to third parties arising from your use of information systems and networks (Article 4).
• Be accountable for the security of the systems and networks you develop, own, supply, manage, maintain or use, and continuously review and assess your own security policies, practices, measures and procedures to make sure they fit their environment (Article 4).
• Do everything possible to prevent, detect and respond to security incidents (Article 5).
• Exchange the information you hold on threats to and vulnerabilities of networks and systems in an appropriate manner, and put in place procedures for rapid and effective cooperation to prevent and detect security incidents (Article 6).
• Carry out risk assessments that cover the main internal and external factors, such as technology, physical and human factors, and the policies and services of third parties (Article 8).
• Design, implement and coordinate your information systems and networks to optimize their security, with technical and non-technical protective measures proportionate to the value of the information in them (Article 9).
• Base your security management on the risk assessment, covering every level of your activities and including responses to identifiable or foreseeable threats, the prevention, detection and resolution of incidents, system recovery, permanent maintenance, control and audit (Article 10).
• Guarantee the security of your systems and networks constantly as risks evolve, with continuous risk assessment and appropriate changes to your security policies, practices, measures and procedures (Article 11).
• This binds anyone, whether a citizen, a business, an organization or a public authority, that develops, owns, supplies, manages, maintains or uses an information system or network; the Law excludes the systems and networks used for national defense and security (Article 2).

Loi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel) · Read the law's page

• Notify the national commission of a personal-data breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons.
• Communicate the breach to the affected data subject without undue delay, in clear and simple terms, where it is likely to create a high risk to their rights and freedoms.
• As a processor, notify the controller of any personal-data breach without undue delay after becoming aware of it.
• Put in the notification to the commission the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, the contact point, the likely consequences, and the measures taken or proposed to remedy it and mitigate its effects.