Runs an essential service, in Morocco

Loi n° 05-20, Chapitre II, Arts. 8 et 14 (déclaration d’incident, infrastructures d’importance vitale) · Read the law's page

• Declare to the national cybersecurity authority, as soon as you become aware of it, any incident affecting the security or operation of your information systems (Articles 8 and 14).
• When the national cybersecurity authority asks, give it without delay further information on incidents affecting the security or operation of your information systems, and send the technical data and incident information it specifies in the manner it specifies (Article 8).
• This binds the person in charge of a vital infrastructure (infrastructure d'importance vitale), an installation, structure or system indispensable to the vital functions of society that the government authority or public body coordinating its vital sector designates after the opinion of the national cybersecurity authority; the list of designated infrastructures is kept secret (Articles 2 and 16; reached by declaring that you operate an essential service).

Loi n° 05-20, Chapitre II, Section 2, Arts. 14 à 25 (infrastructures d’importance vitale) · Read the law's page

• Apply the security rules that Chapter II, Section 1 of the Law sets for entities, which Article 14 extends to vital infrastructures.
• Draw up, from a risk analysis, the list of your sensitive information systems and send it, with its updates, to the national cybersecurity authority; where the authority makes observations, amend the list and send the amended list within two months of receiving them (Articles 17 and 18).
• Have the security of every sensitive information system approved (homologation) before you put it into operation (Article 19).
• When the national cybersecurity authority asks, submit your sensitive information systems to an audit carried out by the authority or by an auditor it has qualified; give the authority or the auditor the information needed, including your security policy and earlier audit results, and access to the networks and systems audited; send the auditor's report to the authority; and bear the cost of a qualified auditor (Articles 20 to 23).
• Put in place an action plan to implement the recommendations of the audit reports and send it to the national cybersecurity authority (Article 24).
• Use the services, products or solutions that strengthen security functions as the national authority defines them, and use only providers qualified by the authority if you outsource cybersecurity services (Article 25).
• This binds the person in charge of a vital infrastructure (infrastructure d'importance vitale), an installation, structure or system indispensable to the vital functions of society that the government authority or public body coordinating its vital sector designates after the opinion of the national cybersecurity authority; the list of designated infrastructures is kept secret (Articles 2 and 16; reached by declaring that you operate an essential service).