Runs an essential service, in Cabo Verde

Decreto-lei nº 9/2021, arts. 11, 15 and 17 (regime jurídico de cibersegurança) · Read the law's page

• Take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems you use, at a level of security that suits the risk and the latest technical progress (Articles 15(1)-(2) and 17(1)-(2)).
• If you are a public administration body or a critical infrastructure operator, apply the security requirements of the decree-law that sets the information security policies, standards and rules for the State's Private Technology Network (RTPE), together with the technical implementing measures the Centro Nacional de Cibersegurança approves (Article 15(1) and (4)).
• Take adequate measures to prevent incidents that affect the security of the networks and information systems you use and to minimise their impact; an essential-service operator does so to ensure the continuity of its services (Articles 15(3) and 17(3)).
• If you are an essential-service operator, register formally with CSIRT.CV, the national computer security incident response team (Article 11(2)).
• If you are an essential-service operator, carry out an internal audit every year by 31 December and send its report to the Centro Nacional de Segurança, as Article 17(4) names the recipient, within 15 days of completing the audit (Article 17(4)).
• Follow the cybersecurity instructions the Centro Nacional de Cibersegurança issues (Articles 8(1)(b) and 24(1)(b)).
• This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex); the Centro Nacional de Cibersegurança identifies the essential-service operators within one year of its installation and updates that identification every year (Article 30(1)-(2)). Reached by declaring that you operate an essential service.

Decreto-lei nº 9/2021, arts. 16 and 18 (regime jurídico de cibersegurança) · Read the law's page

• If you are a public administration body or a critical infrastructure operator, notify the Centro Nacional de Cibersegurança of incidents with a relevant impact on the security of the networks and information systems, within the period set by the regulation Article 14 provides for (Article 16(1)).
• If you are a critical infrastructure operator, include in the notification the information that lets the Centro determine the cross-border impact of the incident (Article 16(2)).
• If you are an essential-service operator, notify the Centro of incidents with a relevant impact on the continuity of the essential services you provide, within the period set by regulation, and include the information that lets it determine the cross-border impact (Article 18(1)-(2)).
• If you are an essential-service operator that depends on a third-party digital service provider, notify every important impact on the continuity of your services that results from incidents affecting that provider (Article 18(10)).
• Weigh whether an incident's impact is relevant by the number of users affected, the duration of the incident and its geographic spread (Articles 16(4) and 18(4)).
• This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex); the Centro Nacional de Cibersegurança identifies the essential-service operators within one year of its installation and updates that identification every year (Article 30(1)-(2)). Reached by declaring that you operate an essential service.