Provides telecom services, in Djibouti

Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Deuxième, Art. 169 · Read the law's page

• Take all appropriate measures to ensure the integrity of your network and the continuity of the services you supply, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti.
• Take all technical and organizational measures necessary to secure your network and services at a level adapted to the existing risk, and comply with the technical security prescriptions the national cybersecurity authority issues.
• Give the cybersecurity authority confidential access, on request, to the arrangements you have made to secure your network, and submit your network to a security and integrity inspection the authority conducts or commissions.
• Where a particular risk of a security breach exists, inform your users of the risk without delay, of any available remedy, and of its cost.
• As soon as you become aware of a security breach or integrity loss with a significant impact on your network's or service's operation, notify the cybersecurity authority and the telecoms regulator by registered letter with acknowledgement of receipt. No numeric clock is stated for this notice, unlike the 24-hour clock this jurisdiction's Digital Code sets for a trust service provider or the 72-hour clock it sets for a personal-data breach.

Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Sixième, Titre 3 (Arts. 679 à 684) · Read the law's page

• Implement a qualified system for detecting events capable of affecting your information systems' security, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti. The detection system, and any service provider you use to run it, must be qualified by the national cybersecurity authority.
• Submit your information systems, at your own cost, to a control the cybersecurity authority conducts to verify their security level and your compliance with security rules.
• Maintain and keep in good condition any protective device you have established: failing to do so draws a fine of up to 10,000,000 Djiboutian francs.
• Expect the State to hold offence-capable equipment and data for cyberattack analysis and response through its own designated services, and to obtain your users' identity and contact details from you where those users hold a vulnerable, threatened or attacked information system, so the competent authority can alert them; obstructing either of these state functions draws a fine of up to 25,000,000 Djiboutian francs.