AngolaLei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties
Lei n.º 7/17, Artigos 15.º, 16.º, 40.º e 41.º
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the same class as the security duties of articles 12 to 14 and 17 to 19, a provider, operator or service provider of Angola's cyberspace or of an information-society system, a class far broader than social platforms.
- Before starting your activity, submit an accident-and-incident management plan to Angola's data protection regulator and to the body responsible for promoting the information society, for use in a computer emergency (Article 15(1)).NIST CSF 2.0ID.IM-04
- On an attack, computer theft or any computer incident, disseminate alerts and warnings; the text does not state to whom or within what deadline (Article 15(2)).NIST CSF 2.0RS.CO-02
- Equip your service with devices capable of issuing an alert on an event or a request, and of sending a technical report on a compromised server, widely disseminated malicious code, a software vulnerability or anything an intrusion-detection system or event log identifies (Article 16(1)).NIST CSF 2.0DE.AE-06
- Expect this reactive alerting function to sit alongside the CERT-equivalent Equipa de Monitorização e Respostas aos Incidentes Informáticos, whose own organisation, functioning and reporting channel Article 40 leaves to a separate decree not located here (Article 16(2), Article 40).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 42 makes a violation of Article 15 or 16 a contravenção (an administrative infraction) rather than a crime; Article 42(7) states that where the same fact is simultaneously a crime and a contravenção, the agent is always punished as a crime instead, so the contravenção itself carries no criminal exposure. Articles 40 and 41, the CERT team's own organisation and cooperation duties, carry no fine under Article 42 at all.
Penalty structure
Article 42(1)(a) sets this range (Kz 7,000,000 to Kz 150,000,000) for non-compliance with the requirements of Article 15; Article 42(1)(b) sets the identical range for non-compliance with Article 16. Articles 40 and 41 are not listed in Article 42 and carry no stated fine.
- Rule
- Fixed only
- As of
- Minimum
- 7,000,000
- Currency
- AOA
- Fixed cap
- 150,000,000
Who enforces it
Enforcement body
Agência de Protecção de Dados Pessoais (the Personal Data Protection Agency), which investigates the contravenção proceedings under this Law, with fines applied by the Agency's President following the Agency's own deliberation (Article 43).
Settledness
- As of
- Open questions
- Has the decree required by Article 40 to establish the Equipa de Monitorização e Respostas aos Incidentes Informáticos's own organisation and functioning been issued, and does it specify the reporting channel and clock Articles 15 and 16 leave unstated?
What this law does
Article 15(1) requires a provider, operator or service provider of cyberspace, before starting its activity, to submit an accident-and-incident management plan to the entity that regulates data protection and to the body responsible for promoting the information society, for use in a computer emergency, and Article 15(2) requires alerts and warnings to be disseminated in the event of an attack, computer theft or any computer incident.
Article 16(1) requires the relevant services to be equipped with devices capable of issuing an alert on an event or a request, and of sending a technical report on a compromised server, widely disseminated malicious code, a software vulnerability or anything an intrusion-detection system or event log identifies, and Article 16(2) ties that reactive service to the central work of the CERT-equivalent Equipa de Monitorização e Respostas aos Incidentes Informáticos (Computer Incident Monitoring and Response Team).
Article 40 leaves that team's own organisation and functioning, which would be the natural place a reporting channel and clock could sit, to a separate decree ("diploma próprio") not located here, and Article 41 requires the team to maintain institutional cooperation with public and private bodies. Unlike the General Data Protection Regulation (GDPR)'s 72-hour or the Cyber Resilience Act's 24-hour clock, no article reviewed here states a deadline for any of these notifications.
Article 47 has the Law enter into force on the date of its publication, the Official Gazette's Diário da República Iª Série n.º 27 of , following approval by the National Assembly on and promulgation by the President on .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .