Is a securities firm, in Tunisia

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25 · Read the law's page

• This duty runs to the same Article 6 population: telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises automatically processing their users' personal data over telecommunications networks, and state-designated vital digital infrastructure.
• Create your own cybersecurity emergency response center, or join a public, sectoral or private one, and have it coordinate with the national emergency-response contact point.
• Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders.
• Where an incident or attack has disrupted your information system or communications network, or endangered the national cyberspace's security, remedy the failure within thirty days of the Agency's warning; in that same case the minister of communication technologies may decide, on the Agency's reasoned report, to isolate your information systems and networks temporarily, and the article does not make that decision depend on the thirty days having run.
• If you are classified at the first or second digital-trust level, expect a classification downgrade, rather than a fine, for failing to comply with an emergency measure, to remedy a failure within the article 17 deadline, or to create or join a response center.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for the same failures.

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 6-9, 14-16, 24-25 · Read the law's page

• Where your service automatically processes your users' personal data while providing that service through Tunisia's telecommunications networks, you fall inside Article 6's mandatory-audit population; a telecommunications or internet operator, a hosting or cloud-computing provider, and a state-designated vital digital infrastructure are each named as their own separate category, and each falls inside that same population.
• Undergo a mandatory information-systems security audit, performed by an expert the National Cybersecurity Agency lists as authorized, at least once every twelve months.
• Submit a protected electronic copy of the audit report to the Agency within ten days of the audit's completion, and implement every security recommendation the report contains.
• Where you host a governmental electronic system or service, do so only with a hosting or cloud provider holding the government-cloud or national-cloud label; a first- or second-level organization that does not can be downgraded under article 24, and article 25 names no fine for this failure.
• Expect the Agency to classify you into one of three digital-trust levels from your audit compliance, your equipment and your hosting choices, and expect a formal notice giving you up to one year to meet the standard if you are classified at the lowest, unclassified level.
• If you are classified at the first or second level, expect the minister of communication technologies, on the Agency's reasoned report, to be able to downgrade your classification, rather than fine you, for failing to carry out the audit, to hand the Agency a copy of the audit report within the deadline, or to implement its recommendations within a year.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for failing to carry out the audit or to implement its recommendations (fully, within a year); article 25 does not list a late audit report copy or a breach of the hosting duty among the fined cases.