BeninDigital Code: Trust Service Provider Security Measures and Conformity Audit
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), under Article 308, and a qualified provider under the audit rules of Articles 318 and 319; you are reached by declaring that you operate an essential service.
- Take the technical and organisational measures necessary to prevent and manage the risks to the security of the trust services you provide, at a level of security proportionate to the degree of risk (Article 308).
- Take measures to prevent and limit the consequences of security incidents and to inform the parties concerned of their harmful effects (Article 308).
- If you are a qualified provider, undergo an audit by a conformity assessment body, at your own expense, at least every 24 months, and send the conformity assessment report to the control body within three working days of receiving it (Article 318).
- If you are a qualified provider, submit to a further audit or conformity assessment at any time at the control body's request, at your own expense (Article 319).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The control body for trust service providers (organe de contrôle), attached to the ministry in charge of electronic communications.
Settledness
- As of
- Open questions
- Has the order of the minister in charge of electronic communications that Article 317 requires, fixing the organisation and functioning of the control body for trust service providers, been issued?
What this law does
Article 308 requires qualified and non-qualified trust service providers to take the technical and organisational measures necessary to prevent and manage the risks to the security of the trust services they provide. Article 308 requires the security measures of trust service providers to keep the level of security proportionate to the degree of risk. Article 308 provides that measures are in particular taken to prevent and limit the consequences of incidents.
Article 308 provides that measures are also taken to inform the parties concerned of the harmful effects of security-related incidents. Article 317 creates a control body for trust service providers, attached to the ministry in charge of electronic communications. Article 318 requires qualified trust service providers to undergo, at least every 24 months, an audit carried out at their own expense by a conformity assessment body.
Article 318 requires qualified trust service providers to send the conformity assessment report to the control body within three working days of receiving it. Article 319 lets the control body subject qualified trust service providers to an audit, or ask for a conformity assessment, at any time and at their expense. Article 321 lets the control body withdraw the qualified status of the provider or service concerned, taking into account the scale, duration and consequences of a breach.
When LexLint raises it
When your app profile says your app runs an essential service.