LexLint.ioBeta

Know the law your code answers to.

Law / Democratic Republic of the Congo

Digital Code, Livre IV: ICT Product and Service Vendor Security Certification

Code du numérique, Livre IV, Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 294)

In force since .

A product security requirements rule binding private bodies.

Obligation class
Security, Disclosure

What it requires

  • This binds a vendor of information and communication technology products, or a provider of information and communication technology services, regardless of the sector in which the product or service is deployed.
  • Apply to the Minister responsible for digital affairs for a compliance certificate, which issues only after a vulnerability analysis and a security-guarantee evaluation performed by information security experts the Minister has accredited.NIST CSF 2.0GV.OC-03
  • Inform consumers of every vulnerability detected in your information and communication technology products and services, and of the solutions you have deployed to remedy them.NIST CSF 2.0RS.CO-02

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • PR.PO-P10A vulnerability management plan is developed and implemented.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF
ENISA NIS2 guidance
  • 3.5Incident response
  • 6.10Vulnerability handling and disclosure

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

No provision reviewed here states a criminal or administrative penalty specific to a vendor's failure to obtain the Article 294 certificate or make its consumer vulnerability disclosure.

Who enforces it

Enforcement body

The Minister responsible for digital affairs (Ministre ayant le numérique dans ses attributions), who issues the compliance certificate after an evaluation performed by accredited information security experts.

Settledness

As of
Open questions
Has the Minister responsible for digital affairs issued the implementing order naming the accredited information security experts and the certification procedure Article 294 contemplates?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 294 requires a vendor of information and communication technology products, or a provider of information and communication technology services, to apply to the Minister responsible for digital affairs for a compliance certificate. Article 294 conditions issuance of that certificate on a vulnerability analysis and an evaluation of the security guarantee performed by information security experts the Minister has accredited.

Article 294 separately requires the vendor or provider to inform consumers of every vulnerability detected in its information and communication technology products and services, and of the solutions deployed to remedy them. Neither Article 294 nor the other sections of the Digital Code reviewed here state a fixed administrative or criminal penalty specific to a vendor's failure to obtain the certificate or make the disclosure.

When LexLint raises it

When your app profile says your app distributes a software product or ships a mobile app.

Back to the example  ·  Lint your app

Page updated .