Runs an essential service, in Togo

Titre II (Arts. 3, 5-7), Loi n° 2018-026 du 07 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité · Read the law's page

• This binds you only where the Agence nationale de la cybersécurité (ANCy) designates your organization an opérateur de services essentiels (operator of essential services) under Article 6(4): a public or private operator whose service is essential to the functioning of society or the economy and whose continuity could be gravely affected by an incident affecting the networks or information systems you need to provide it. The conditions and modalities of designation are left by Article 3 to a decree, which ANCy's Cybersecurity Rules identify as decree n°2019-095/PR of 8 July 2019 and describe as setting the designation criteria and listing the essential services in an annex; neither the Act nor the Rules set out that annex, so the sectors it lists are not stated here.
• Once designated, comply with the cybersecurity rules for protecting your essential infrastructure that a decree in Council of Ministers fixes under Article 3, and expect the Agence nationale de la cybersécurité (ANCy) to control, audit and inspect your compliance with them.
• Expect ANCy to condition your accreditation on that compliance, and to impose astreintes or monetary sanctions if you do not comply; the amounts and procedure for both are left to a decree in Council of Ministers not located here.
• Expect ANCy to collect technical information about an incident affecting your essential infrastructure; the Act itself states no notification deadline or threshold of your own for reporting one.
• A separate ANCy certification of hardware, software or IT services for their cybersecurity capability exists under Article 6, but the Act states no duty to hold it before you place a product or service on the market, so it is not raised here as a market-placement requirement.

Arrêté N°2022-040/PMRT du 29 juin 2022 portant adoption des règles de cybersécurité en République togolaise (Règles de Cybersécurité, version 1.0) · Read the law's page

• This binds an operator of essential services (opérateur de services essentiels, OSE) that ANCy has designated under decree n°2019-095/PR, for each essential infrastructure it operates; you are reached by declaring that you operate an essential service.
• Comply with the Cybersecurity Rules, which cover the governance, protection, defence and resilience of your networks and information systems.
• Establish a documented cybersecurity policy approved by your board or chief executive, send ANCy the supporting cybersecurity policies the Rules list, and review them annually and when significant changes occur (Rules G2.1.1 to G2.1.3).
• Send the contact details of your information-systems security manager, or of your cybersecurity point of contact, to your sectoral supervisory authority, to ANCy and to its delegate within six months of being notified of your designation, and after each update (Rule G1.1.6).
• Send ANCy or its delegate the list of your essential personnel within three months of being notified of your designation, and after each update (Rule G5.2.4).
• Report information-security events as quickly as possible through the appropriate management channels (Rule D1.2.2).
• Put in place detection devices able to identify events characteristic of a security incident, archive the metadata of identified events for at least six months, and run for each essential infrastructure a logging, correlation and analysis system operating 24 hours a day, 7 days a week (Rules D1.3.1 and D1.3.2).
• Submit to the annual compliance control that ANCy's delegate carries out on the security measures of your operator security plan (plan de sécurité d'opérateur) for each essential infrastructure (section 4).