LexLint.ioBeta

Know the law your code answers to.

Law / Democratic Republic of the Congo

Digital Code, Livre IV: Digital Services Provider Security Obligations

Code du numérique, Livre IV, Titre III, Chapitre I, Section 2, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 295 à 297)

In force since .

A security baseline statutes rule binding public and private bodies.

Obligation class
Security

What it requires

  • This binds a digital services provider (fournisseur des services numériques) generally, regardless of the sector in which it operates.
  • Implement systems qualified to detect events likely to affect the security of your own information systems; the qualification of the detection systems and of the service providers operating them is delivered by the Ministry responsible for digital affairs, the Agence Nationale de Cybersécurité having been consulted.NIST CSF 2.0DE.CM-09
  • Submit your information system to controls the Agence Nationale de Cybersécurité conducts to verify its security level and its compliance with security rules, at your own cost.NIST CSF 2.0GV.OC-03
  • Expect the Agence Nationale de Cybersécurité to be able to obtain your users' or system holders' identity, postal address and electronic address when their systems are vulnerable, threatened or attacked, so as to alert them.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
CIS Controls
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
FINOS AIGF
1 more
ENISA NIS2 guidance
  • 2.1Risk management framework
  • 3.1Incident handling policy
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
2 more
  • 9.1Cryptography
  • 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

No provision reviewed here states a criminal or administrative penalty specific to a digital services provider's noncompliance with Articles 295 to 297.

Who enforces it

Enforcement body

L'Agence Nationale de Cybersécurité, the national authority in charge of cybersecurity and information-system security the Digital Code establishes, which conducts the Article 296 security controls and is consulted on qualifying the Article 295 detection systems.

Settledness

As of
Open questions
Has the Ordonnance of the President of the Republic organizing the Agence Nationale de Cybersécurité, which Article 275 calls for, been issued, and does it specify further operational procedures for the Article 295 to 297 duties?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 295 requires a digital services provider to implement systems qualified to detect events likely to affect the security of its own information systems. Article 296 requires a digital services provider to submit its information system to controls the Agence Nationale de Cybersécurité conducts to verify the system's security level and its compliance with security rules, at the provider's own cost.

Article 297 lets the Agence Nationale de Cybersécurité obtain a provider's users' or system holders' identity, postal address and electronic address when their systems are vulnerable, threatened or attacked, so as to alert them to the vulnerability or compromise. None of the three articles states a fixed administrative or criminal penalty for a digital services provider's noncompliance.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .