LexLint.ioBeta

Know the law your code answers to.

Law / Democratic Republic of the Congo

Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty

Code du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 147, et art. 164 pour les sanctions)

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security

What it requires

  • This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
  • Take the technical and organizational measures necessary to prevent and manage the risks to the security of the trust services you provide, keeping the level of security proportional to the degree of risk given technological developments.NIST CSF 2.0ID.RA-06
  • Prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of your services in the event of technical failures or cessation of activity.NIST CSF 2.0RS.CO-02NIST CSF 2.0ID.IM-04

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
  • ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • RS.CO-02Internal and external stakeholders are notified of incidents
CIS Controls
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
FINOS AIGF
1 more
ENISA NIS2 guidance
  • 2.1Risk management framework
  • 3.1Incident handling policy
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
2 more
  • 9.1Cryptography
  • 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 164 frames the sanction for a trust service provider's noncompliance with the ordonnance-loi, including the Article 147 duty, as an administrative one (a fine, a service suspension, or a prohibition on operating), not a criminal offense; the section carrying Article 164 is captioned Des sanctions administratives.

Penalty structure

Article 164 tiers the administrative sanction on a trust service provider by the impact of the breach: a suspension of service for ninety to three hundred sixty five days and/or a fine of 500,000 to 5,000,000 Congolese francs where the impact is limited to the certificate holder, a fine of 10,000,000 to 50,000,000 Congolese francs where the impact touches the integrity of holders' personal data, and a prohibition on operating in the Democratic Republic of the Congo where the breach touches national defense or state security. Article 164 applies to a trust service provider's noncompliance with the ordonnance-loi generally, including the Article 147 risk-management duty, and is not confined to Article 147.

Rule
Fixed only
As of
Minimum
500,000
Currency
CDF
Fixed cap
50,000,000

Who enforces it

Enforcement body

L'Autorité Nationale de Certification Électronique.

Settledness

As of
Open questions
Does the Autorité Nationale de Certification Électronique's own implementing guidance specify further technical security-measure standards under Article 147 beyond the statutory text itself?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 147 requires a qualified or non-qualified trust service provider to take the technical and organizational measures necessary to prevent and manage the risks to the security of the trust services it provides. Article 147 requires those measures to keep the level of security proportional to the degree of risk, given technological developments.

Article 147 requires the measures to prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of services in the event of technical failures or cessation of activity.

A trust service provider that does not comply with the ordonnance-loi or with the requirements the Autorité Nationale de Certification Électronique sets faces an administrative sanction of a fine, a suspension of up to three hundred sixty five days, or a prohibition on operating in the Democratic Republic of the Congo, depending on the severity and impact of the breach.

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example  ·  Lint your app

Page updated .