Republic of the CongoCybersecurity Law: Mandatory Periodic Security Audit
Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 12 à 16
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the information systems and electronic communications networks of public bodies, other than those of the ministries in charge of national defence and public security and of diplomatic and consular missions, and of the bodies on the list that Article 12 leaves to regulation; it is reached by declaring that you operate an essential service.
- Have your systems and networks audited for security, periodically; the nature of the audit, its periodicity and the follow-up of its recommendations are fixed by regulation (Articles 12 and 13).
- Have the audit carried out by an expert previously approved by the agency (Article 16).
- If you have not carried out the audit, carry it out within three months of the agency's warning; after that period the agency appoints an expert to audit at your expense (Article 14).
- Collaborate with the agency and the audit experts, and put at the agency's disposal all documents and files relating to IT security (Article 15).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 39 refers the Law's infractions to the penal code and to the law relating to the fight against cybercrime; the consequence Article 14 states for a body that does not audit is an expert appointed at its expense.
Who enforces it
Enforcement body
The agency in charge of the security of information systems and networks (l'agence nationale de sécurité des systèmes d'information), which under Article 14 warns a body that has not carried out the audit and then appoints an expert at the body's expense.
Settledness
- As of
- Open questions
- Has the regulation Article 12 calls for, listing the bodies beyond public bodies that are subject to the audit, been issued?
- Has the regulation Article 13 calls for, fixing the nature and periodicity of the audit, and the regulation Article 16 calls for, fixing the approval of audit experts, been issued?
What this law does
Article 12 subjects the information systems and electronic communications networks of public bodies to a mandatory and periodic security audit, except those of the ministries in charge of national defence and public security and those of diplomatic and consular missions. Article 12 also subjects to the same mandatory and periodic audit the systems and networks of the bodies on a list to be fixed by regulation.
Article 13 leaves the nature of the audit, its periodicity and the follow-up of the recommendations in the audit report to be fixed by regulation. Article 14 provides that when a body does not carry out the mandatory audit the agency warns it, the body must audit within three months of the warning, and after that period the agency must appoint an expert to carry out the audit at the body's expense.
Article 15 binds the public and private bodies covered by the Law to collaborate with the agency and the audit experts and to put at the agency's disposal all documents and files relating to IT security. Article 16 provides that the audit is carried out by experts, individuals or companies, previously approved by the agency.
When LexLint raises it
When your app profile says your app runs an essential service.