Côte d'IvoireMandatory Reporting of Attacks, Intrusions and Disruptions
Décret n°2021-917 du 22 décembre 2021, Arts. 16-17
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This duty runs to every public or private organization operating an information system in Côte d'Ivoire, with no activity or size gate.
- Inform ARTCI, the body Article 16 names, immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning; ANSSI, which now houses the national incident-response centre CI-CERT, publishes the online declaration form for every kind of entity.
- Expect ARTCI, not your own organization, to take the measures it judges necessary to stop a disruption once you have notified it.
- Where you are designated and notified as a critical-infrastructure operator or manager, expect your cybersecurity focal point to also serve as your liaison to CI-CERT and to a sector cybersecurity officer, roles this vocabulary does not separately express.
These lines are LexLint's reading of the law's text. Also read by: Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) (guidance, recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 16 states no penalty of its own for a failure to report; the Article 20 sanction on this jurisdiction's companion row is tied to the Article 3 audit obligation, not to this reporting duty.
Who enforces it
Enforcement body
Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), which houses the national incident-response centre CI-CERT; Article 16 of the décret names the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI).
Settledness
- As of
- Guidance link
- https://anssi.gouv.ci/formulaire-declaration-incident/
- Guidance body
- Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI)
- Open questions
- Does 'toutes attaques, intrusions et autres perturbations susceptibles d'entraver le bon fonctionnement' in Article 16 reach a merely attempted or blocked intrusion, or only one that actually disrupts the system's functioning?
- Does Article 16's duty to inform ARTCI now run to ANSSI, which houses CI-CERT and publishes the incident-declaration form, when the Article's wording still names ARTCI?
What this law does
Article 16 requires every public or private organization to inform ARTCI immediately of any attack, intrusion or other disruption likely to impede its information system's proper functioning. Article 17 empowers ARTCI to take all measures it deems necessary to stop a disruption it identifies.
The Plan de Protection des Infrastructures Critiques names CI-CERT, alongside ARTCI and a sector cybersecurity officer, as one of the competent authorities a designated critical-infrastructure operator's cybersecurity focal point liaises with. Since the creation of ANSSI on , the staff of CI-CERT, the national incident-response centre, belong to ANSSI. ANSSI publishes an online incident-declaration form for every kind of entity.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .