Runs an essential service, in Sierra Leone

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats) · Read the law's page

• Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
• This binds a person or institution that operates a computer system or network, whether public or private, not a licensed or sector-specific status; operating a computer system or network at all is enough to place an app in scope.
• The Act does not name a reporting channel, form, or contact point for the National Computer Security Incidence Response Team, unlike India's CERT-In directions or similarly detailed regimes; confirm the current reporting channel directly with the Team, housed within the Ministry of Communication, Technology and Innovation.

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), ss. 7-8 (Critical National Information Infrastructure) · Read the law's page

• If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.
• This only binds a computer system, computer data, or traffic data the President has designated, by an Order published in the Gazette on the Minister's recommendation and in consultation with the National Cybersecurity Advisory Council, as Critical National Information Infrastructure; declaring a flagged activity alone does not put an app in scope, and no public register of designated infrastructure was located.