Runs an essential service, in Mauritius

Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), Part V (ss. 33-34 and 37) · Read the law's page

• This binds the owner of an asset, facility, system, network or process that the National Cybersecurity Committee has declared a critical information infrastructure after consulting the regulatory authority in control of it, whether the owner is public or private (reached by declaring that you operate an essential service). Part V of the Cybersecurity and Cybercrime Act 2021 applies from its proclamation on 10 December 2021.
• Carry out the assessments your sector's regulatory authority directs you to carry out: of the threats, vulnerabilities, risks and probability of a cyber-attack on the infrastructure, of your overall preparedness against damage or unauthorised access, and of any other risk based factor appropriate to protect it (section 34(a) to (c)).
• Implement an information security policy, conduct periodic IT security risk assessments of the infrastructure and develop a security awareness programme when the regulatory authority directs you to (section 34(d), (e) and (g)).
• Carry out an independent IT security audit every year and on any major upgrade or change in your IT infrastructure, and submit the audit report to the National Cybersecurity Committee to evaluate compliance (section 37(1) and (2)).
• Provide the Committee, within the period it specifies, any additional information it requests to evaluate the issues the audit raised (section 37(3)).
• Do not hinder, obstruct or attempt to influence the person who carries out the audit or any member of the Committee who evaluates it (section 37(4)(d) and (e)).

Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), s. 35 · Read the law's page

• This binds the owner of an asset, facility, system, network or process that the National Cybersecurity Committee has declared a critical information infrastructure, whether the owner is public or private (reached by declaring that you operate an essential service). Part V of the Cybersecurity and Cybercrime Act 2021 applies from its proclamation on 10 December 2021.
• Report to the National Cybersecurity Committee any cybersecurity incident that impacts national security, public safety or the public interest, together with the action you intend to take to mitigate the incident (section 35(1)).
• Implement the incident reporting policy that the regulatory authority of your critical information infrastructure directs you to adopt (section 34(f)).

Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 (Government Notice No. 113 of 2026), regs. 3 to 9 · Read the law's page

• Applies to an owner or operator of a system designated as critical information infrastructure by the National Cybersecurity Committee, in consultation with the regulatory body, under the criteria in section 33(2) of the Cybersecurity and Cybercrime Act 2021 (regulation 4(1)); the regulations apply to the financial services (banking and non-banking), public service, information and communication technology and broadcasting, and energy and water supply sectors (regulation 3), and the Committee gives public notice of each designation in the Gazette (regulation 4(2)).
• Comply with the directions that the regulatory body gives you under section 34 of the Act (regulation 5).
• Do not allow anyone other than a person authorised in writing by the regulatory authority to have access to information about the infrastructure, including its architecture, vulnerability and security aspects (regulation 6).
• Comply with these regulations within 12 months of their coming into operation on 1 June 2026 (regulation 9).