Provides telecom services, in Côte d'Ivoire

Décret n°2021-917 du 22 décembre 2021, Arts. 16-17 · Read the law's page

• Inform ARTCI, the body Article 16 names, immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning; ANSSI, which now houses the national incident-response centre CI-CERT, publishes the online declaration form for every kind of entity.
• Where you are designated and notified as a critical-infrastructure operator or manager, expect your cybersecurity focal point to also serve as your liaison to CI-CERT and to a sector cybersecurity officer, roles this vocabulary does not separately express.
• This duty runs to every public or private organization operating an information system in Côte d'Ivoire, with no activity or size gate.
• Expect ARTCI, not your own organization, to take the measures it judges necessary to stop a disruption once you have notified it.

Loi n°2024-352 du 6 juin 2024 relative aux communications électroniques, article 98 · Read the law's page

• This binds an operator, meaning a legal entity that establishes or operates an electronic communications network or provides electronic communications services (reached by declaring that you provide telecom services).
• Inform ARTCI as soon as you become aware of any security incident that has a significant impact on the operation of your networks or services; the Law sets the clock as soon as the operator is aware and states no hour limit (Article 98).
• Where there is a particular and significant threat of a security incident in a public electronic communications network or service, inform the subscribers concerned of the threat and of any protective or corrective measure they can take (Article 98).
• Comply with the technical requirements ARTCI sets to remedy the incident or prevent its spread (Article 98).
• Once you have analyzed the causes and consequences of the incident, report them to ARTCI together with the measures taken to prevent a recurrence (Article 98).

Loi n°2024-352 du 6 juin 2024 relative aux communications électroniques, articles 97 et 99 · Read the law's page

• This binds an operator, meaning a legal entity that establishes or operates an electronic communications network or provides electronic communications services (reached by declaring that you provide telecom services).
• Take all the technical and organizational measures needed to secure your networks, the communications carried on them and your services, at a level suited to the existing risk in light of the security standards in force, and guarantee the continuity of the services you provide (Article 97).
• Meet the minimum security level that the Autorité de Régulation, ARTCI, defines for operators (Article 97).
• Take the measures needed to secure the devices built into terminal equipment that identify and authenticate users, and tell your customers about the services that can strengthen the security of communications (Article 97).

Décret n°2021-916 du 22 décembre 2021, Arts. 1-2 · Read the law's page

• Comply with the RGSSI (the ISO 27001/27002-based security standard Décret n°2021-917's audits check you against), which Article 2 makes binding on every public body and private enterprise, and, if you also operate a designated critical-infrastructure asset, with the PPIC.
• Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.
• Do not expect this décret to state its own penalty for noncompliance: enforcement runs through Décret n°2021-917's audit, certification and sanction mechanism, filed as its own row in this jurisdiction.

Décret n°2021-917 du 22 décembre 2021, Arts. 3-4, 19-21 · Read the law's page

• Undergo a security audit for certification of your information system every three years, performed by ANSSI or by an audit provider (PASSI) that ANSSI has approved.
• Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.
• Correct a major nonconformity the auditing authority identifies and have your information system re-audited within twelve months, or receive a formal notice ordering you to comply.
• Expect a financial penalty proportional to the breach's severity and the advantage you gained, capped at 300,000,000 CFA francs and doubled on a repeat breach, if you fail to complete the mandatory audit.
• If you are a public body, or a private organization with an information system located on Côte d'Ivoire's territory, you fall inside Article 3's mandatory-audit population; Article 3 names in particular a telecommunications or ICT company, a telecommunications or internet service provider, a company whose information system connects through Côte d'Ivoire's public telecommunications networks, a company that automatically processes its customers' personal data in providing its service, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider, and that list is not exhaustive.