Law / 
Central African Republic
Cybersecurity Law: Essential-Service Operator Cybersecurity Regime
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.arcep.cf/fr/images/documents/reglementation/lois/Loi_24_002_relative_a_la_cyber_securite.pdfIn force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Licensing
What it requires
- This binds an operator, public or private, that the Agence Nationale de la Cybersécurité designates as an essential-service operator because its continuity could be gravely affected by an incident touching an electronic-communications network or an information system.
- Comply with the protective measures the Agence Nationale de la Cybersécurité sets to secure your essential infrastructure, and hold the accreditation the Agency grants to a compliant operator.
- Expect the Agence Nationale de la Cybersécurité to inspect and audit your essential infrastructure's information systems, and to impose administrative sanctions, including pecuniary ones, if you fail to meet your cybersecurity obligations; the law does not state a fixed amount.
- Expect the Agence Nationale de la Cybersécurité, acting as the national Computer Emergency Response Team, to collect technical information about an incident affecting your essential infrastructure; no fixed deadline for reporting an incident to the Agency is stated.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 10 authorizes the Agence Nationale de la Cybersécurité to impose administrative sanctions, including pecuniary ones, on a noncompliant essential-service operator; no provision reviewed here states a criminal penalty specific to that noncompliance.
Who enforces it
Enforcement body
L'Agence Nationale de la Cybersécurité (ANCy), placed under the joint oversight of the Ministère chargé de la Sécurité Publique and the Ministère chargé de l'Economie Numérique.
Settledness
- As of
- Open questions
- Has the Décret pris en Conseil des Ministres that Article 12 requires to define the Agence Nationale de la Cybersécurité's organization and functioning been issued, and is the Agency now operational rather than performed provisionally by the two supervising Ministries under Article 141?
- What amount does the Agence Nationale de la Cybersécurité's Article 10 power to impose pecuniary sanctions on a noncompliant essential-service operator actually set, since Article 10 authorizes the sanction without stating a figure?
What this law does
Article 8 creates the Agence Nationale de la Cybersécurité (ANCy), a public, non-commercial establishment with legal personality and financial autonomy, as the national authority over the security of essential infrastructure and of public authorities' information systems.
Article 10 gives ANCy the power to designate essential-service operators, whether public or private, whose continuity could be gravely affected by an incident touching an electronic-communications network or information system; to set the protective measures those operators must implement to secure their essential infrastructure and to control compliance with them; to grant accreditation to a compliant operator; and to impose administrative sanctions, including pecuniary ones, on an operator that fails to meet its cybersecurity obligations, with no fixed amount stated in the text reviewed here.
Article 11 gives ANCy the function of Computer Emergency Response Team (CERT) or Computer Security Incident Response Team (computer security incident response team (CSIRT)) for the Central African Republic and a 24/7 point of contact, under which it coordinates incident prevention and response with national partners and foreign CERTs and collects technical information about an incident affecting an essential-service operator's essential infrastructure or a State information system; the reviewed text states no deadline by which an operator must report an incident to ANCy.
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .