NIST CSF 2.0, ProtectPR.IR-03

Take all appropriate measures to ensure the integrity of your network and the continuity of the services you supply, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti.

If you operate a public telecommunications network, take measures to keep it operating properly and its services continuously available (Section 165(5)).

Ensure the continuity and regularity of your investment services by relying on suitable and proportionate systems, including the ICT systems set up and managed under Article 7 of Regulation (EU) 2022/2554, and on suitable and proportionate resources and procedures (Section 80(1) sentence 2 number 1).

If you are an investment firm engaged in algorithmic trading, keep effective systems and risk controls that ensure, in line with DORA Chapter II, that your trading systems are resilient with sufficient capacity, are subject to appropriate trading thresholds and limits, cannot send erroneous orders and cannot be used for market abuse (Bszt., Section 26/B(1)).

As an operator of essential services, permanently apply organizational, physical and information-technology security measures that prevent a cyber incident, resolve one, and prevent or mitigate its impact.

The Department says you should consider reviewing or developing threat-relevant personnel, customer and third-party communication strategies sufficient to address prolonged system and service disruptions; if you use operational technologies, confirming that critical system functions can operate if other information systems are unavailable or compromised; and monitoring financial transactions, including virtual currency business activity, to ensure compliance with applicable orders and guidance on sanctions and anti-money laundering.

Take technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems you use for your work or to provide your services, and to prevent or reduce the impact of an incident on the recipients of your services and on other services.

If you are an operator under the Zakon o elektronskih komunikacijah (ZEKom-2), establish and maintain a documented information security management system (SUVI) and continuity management system (SUNP) in line with the information security law, and take appropriate, effective and proportionate technical, operational and organizational measures to protect the integrity, authenticity, confidentiality and availability of your network and information systems and to limit the effect of incidents on your customers (Article 115(1)).

Put in place technical mechanisms addressing threats to your systems' permanent availability, integrity, authentication, non-repudiation and data confidentiality, and to their physical security, and submit those mechanisms to the Agence Nationale de la Cybersécurité for approval.

Deploy technical mechanisms addressing threats to your systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, and have those mechanisms cleared for conformity with the competent administrative authority's cybersecurity policy.

Operate your Electronic System reliably and securely, and take legal responsibility for it operating as it should.

Secure your Electronic System's components, and have and run procedures and means to protect the system against disruption, failure, and loss.

Maintain the integrity and availability of your digital systems and the confidentiality of the digital data you process, monitor for and help prevent incidents in the digital environment, manage the resulting risk under a risk-management system, and dedicate the resources your continuity of operation and recovery from an incident require.

Build your high-risk AI system to be as resilient as possible to errors, faults or inconsistencies, including those arising from its interaction with people or other systems, through technical and organisational measures.

It reaches you if you are an investment firm that engages in algorithmic trading, meaning trading in financial instruments where a computer algorithm automatically determines individual parameters of orders such as whether to initiate the order, the timing, price or quantity of the order or how to manage the order after its submission, with limited or no human intervention; a system used only to route orders to one or more trading venues, to process orders involving no determination of any trading parameters, or to confirm orders or process executed transactions after the trade is outside that meaning (Directive 2014/65/EU, Article 4(1), point (39)). Have in place effective systems and risk controls suitable to the business you operate to ensure that your trading systems are resilient and have sufficient capacity, are subject to appropriate trading thresholds and limits, and prevent the sending of erroneous orders or the systems otherwise functioning in a way that may create or contribute to a disorderly market (Article 17(1)).

Build into the smart contract a mechanism to terminate the continued execution of transactions, with internal functions that can reset or instruct the contract to stop or interrupt the operation, in particular to avoid future accidental executions (Article 36(1), point (b)).