Runs an essential service, in Mozambique

Lei n.º 13/2026, arts. 51 a 56 · Read the law's page

• It reaches you if you operate as a critical-infrastructure network operator, an essential-service network operator, a digital-service provider, a digital-intermediary-service provider, a data-centre operator, or a cloud-computing-platform operator under Articles 51 through 56.
• If you are a critical-infrastructure operator, an essential-service operator, a digital-service provider, or a digital-intermediary-service provider, take technical and organisational measures adequate to the risk your networks and information systems face, in light of the latest technical progress (articles 51 to 54). A digital-service provider or digital-intermediary-service provider must weigh the security of its systems, infrastructure, and premises, incident handling, business-continuity management, monitoring, auditing, and testing, and conformity with international standards (articles 53(2) and 54(2)).
• If you are a private critical-infrastructure operator, additionally establish an institutional CSIRT.
• If you operate a data centre, take adequate measures to guarantee the integrity, confidentiality, and availability of the data you store, reducing the risk of downtime (article 55(2)). If you operate a cloud-computing platform, guarantee the security of the data you store in the cloud, in line with internationally recognised good practice (article 56(1)).

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.