Côte d'IvoireRGSSI and PPIC Compliance Duty
Décret n°2021-916 du 22 décembre 2021, Arts. 1-2
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- Where your service's information system connects through Côte d'Ivoire's public telecommunications networks, or you automatically process your customers' personal data in providing your service, comply with the RGSSI (the ISO 27001/27002-based security standard Décret n°2021-917's audits check you against) and, if you also operate a designated critical-infrastructure asset, the PPIC.NIST CSF 2.0GV.OC-03
- Do not expect this décret to state its own penalty for noncompliance: enforcement runs through Décret n°2021-917's audit, certification and sanction mechanism, filed as its own row in this jurisdiction.
- Where you are designated and notified as a critical-infrastructure operator or manager, renew a complete risk analysis of your critical infrastructure at least every six months and designate a cybersecurity focal point, a designation this vocabulary does not separately express.NIST CSF 2.0ID.RA-05NIST CSF 2.0GV.RR-02
These lines are LexLint's reading of the law's text. Also read by: Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
This décret states no penalty of its own for noncompliance with the RGSSI or the PPIC; the sanction attaches to the Article 3 audit obligation under Décret n°2021-917 Article 20, filed as its own row.
Who enforces it
Enforcement body
Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), through the audit and certification mechanism of Décret n°2021-917; the décret and its annexes name the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI).
Settledness
- As of
- Guidance link
- https://anssi.gouv.ci/agrement-passi/
- Guidance body
- Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI)
- Open questions
- Does the RGSSI apply its full ISO 27001/27002-based control set uniformly to every organization Décret n°2021-917 Article 3 names, or does the référentiel itself scale requirements by an entity's size or risk profile?
What this law does
Article 1 adopts the Référentiel Général de Sécurité des Systèmes d'Information (RGSSI) and the Plan de Protection des Infrastructures Critiques (PPIC) as annexes to this décret. The RGSSI states that it draws heavily on ISO 27001:2013 and ISO 27002:2013. Article 2 requires every public body and private enterprise to comply with the RGSSI and the PPIC. Décret n°2021-917 Article 14 anchors that compliance duty to the same population its own Article 3 lists.
The PPIC requires an organization the State has designated and notified as a critical-infrastructure operator or manager to renew a complete risk analysis of its critical infrastructure at least every six months. The same organization must also designate a cybersecurity focal point who liaises with ARTCI, a sector cybersecurity officer, and CI-CERT.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .