Is a bank, in Tanzania

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5 · Read the law's page

• This binds every government institution and private entity, so it reaches any organisation that operates an information system. The Order has applied since 19 June 2026.
• Within six months from the commencement of the Order, assess your information systems with the checklist in the Second Schedule to determine whether any of them is critical information infrastructure (regulation 5(1)).
• Submit the self-assessment report to the Ministry responsible for Information and Communication Technology (regulation 5(2)).

Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), regs. 3, 4 and 6 to 12 · Read the law's page

• This binds the owner of a computer system that the Order designates as critical information infrastructure, and the operator for the duties stated for operators (reached by declaring that you operate an essential service). The Order has applied since 19 June 2026.
• Register each designated critical information infrastructure with the Ministry responsible for Information and Communication Technology, on the form in the First Schedule, within six months from the commencement of the Order (regulation 4(2)).
• Carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry (regulation 6(2)).
• Take necessary steps for secure access, control and transfer of data related to the infrastructure, and host all of that data within Tanzania; seek the approval of the Minister before hosting primary or secondary data outside Tanzania (regulation 8).
• Ensure the integrity and authenticity of the data or information in the infrastructure, and ensure its storage and archiving in accordance with the Act and the relevant written laws (regulations 9 and 10).
• Ensure functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures; as an operator, secure the infrastructure you operate by carrying out risk assessment (regulation 11).
• Within every six months from the date of registration, conduct an audit and inspection as part of your internal operation and submit a report to the Ministry; the Ministry also audits and inspects at least annually (regulation 12).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 (notification and reports) · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Notify the national CERT of any significant security breach to your systems or networks, meaning any circumstance or event having an adverse effect on their security such as a Denial of Service or Distributed Denial of Service attack, a Malware attack or a Botnet attack, together with the measures you undertook to resolve the security breach (regulation 7(f)).
• Share the key findings of each security assessment you perform with the National CERT as soon as possible (regulation 7(j)).
• Create and update a cybersecurity incidents register (regulation 7(n)).
• As a user of a computer or equipment with data processing capability, monitor your systems and networks in real time for security breaches and intrusions and report any breaches and intrusions to the Authority, and report to the Authority every quarter the implementation status of the security advisories it issues (regulation 11(e) and (f)).

Electronic and Postal Communications (Computer Emergency Response Team) Regulations, 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023 · Read the law's page

• This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on 23 February 2018 and the 2023 amendment on 11 August 2023.
• Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
• Maintain your organization's Information Communication Technology and cyber security policy for information and computer security (regulation 7(b)), and comply with the security standards, guidelines, minimum security specifications and minimum requirements the national CERT or your service providers recommend for securing your information and computer systems, or in response to threats or identified vulnerabilities (regulation 7(h), renamed 7(o) by the 2023 amendment).
• Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
• Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
• Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
• As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
• As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).