BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits
In force.
A product security requirements rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Security, Disclosure
What it requires
- Before or while selling an information and communication technology product in Benin, have an independent security expert accredited by the ministry in charge of electronic communications carry out a vulnerability test and a security assurance evaluation of the product.NIST CSF 2.0ID.RA-01
- Inform consumers of every vulnerability detected in that test, together with the solution recommended to remedy it.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Ministère chargé des communications électroniques, which accredits the independent security experts who must carry out the vulnerability test and security assurance evaluation; no distinct sanction naming this article specifically was located
Settledness
- As of
- Open questions
- Does Article 601's fine for failing to maintain a previously established protection measure reach a vendor's own Article 598 vulnerability-testing and disclosure duty, or is it confined to the electronic-communications operator's own Article 599 event-detection duty in the same Chapter?
- Does the accreditation requirement reach a vendor with no physical establishment in Benin that sells an information and communication technology product to a consumer located there?
What this law does
A vendor of an information and communication technology product must have an independent security expert, accredited by the ministry in charge of electronic communications, carry out a vulnerability test and a security assurance evaluation of the product. The vendor must then inform consumers of every vulnerability detected in the product, along with the solution recommended to remedy it.
The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.
Back to the example · Lint your app
Page updated .