Law / 
Democratic Republic of the Congo
Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty
Code du numérique Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds the operator of an information system, public or private, and more broadly any natural or legal person operating in, or possessing expertise in, the digital sector, without any sector limitation.
- Cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions.NIST CSF 2.0RS.CO-03
- Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.NIST CSF 2.0RS.CO-02
- Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption.NIST CSF 2.0RS.MI-01
- No fixed numerical notification deadline is stated; the duty runs from the operator's own awareness of the attack, intrusion or penetration.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
No provision reviewed here states a criminal or administrative penalty specific to an operator's failure to notify or cooperate with the Agence Nationale de Cybersécurité under Articles 276 or 281.
Who enforces it
Enforcement body
L'Agence Nationale de Cybersécurité, the national authority in charge of cybersecurity and information-system security the Digital Code establishes.
Settledness
- As of
- Open questions
- Does the organizing Ordonnance Article 275 calls for set a numerical notification deadline for the Article 276 duty that the statutory text itself leaves unstated?
What this law does
Article 281 requires a natural or legal person operating in the digital sector, or possessing expertise in it, to cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions. Article 276 requires the operator of an information system, public or private, to inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network.
Article 276 further requires that operator to comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption, including isolation of the affected information system. Neither Article 276 nor Article 281 states a fixed numerical deadline for the notification, or a fixed administrative or criminal penalty for a failure to notify or cooperate.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .