Côte d'IvoireMandatory Information Systems Security Audit and Certification
Décret n°2021-917 du 22 décembre 2021, Arts. 3-4, 19-21
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- Where your service's information system connects through Côte d'Ivoire's public telecommunications networks, or you automatically process your customers' personal data in providing your service, you fall inside Article 3's mandatory-audit population; a telecommunications or ICT company, a telecommunications or internet service provider, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider are each named as their own category, and each falls inside that same population.
- Undergo a security audit for certification of your information system every three years, performed by ANSSI or by an audit provider (PASSI) that ANSSI has approved.
- Undergo a further mandatory periodic security audit eighteen months after your certificate is issued.
- Correct a major nonconformity the auditing authority identifies and have your information system re-audited within twelve months, or receive a formal notice ordering you to comply.
- Expect a financial penalty proportional to the breach's severity and the advantage you gained, capped at 300,000,000 CFA francs and doubled on a repeat breach, if you fail to complete the mandatory audit.
These lines are LexLint's reading of the law's text. Also read by: Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- ID.IM-01Improvements are identified from evaluations
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 20's sanction for failing to complete the mandatory audit is an administrative financial penalty that the décret gives to ARTCI to impose; no article of the décret makes the failure a criminal offence.
Penalty structure
Article 20 caps the sanction at 300,000,000 CFA francs (XOF) for a structure named in Article 3 that fails to complete the mandatory periodic security audit, doubled to 600,000,000 CFA francs on a repeat breach. The décret states only this ceiling; it names no floor.
- Rule
- Fixed only
- As of
- Currency
- XOF
- Fixed cap
- 300,000,000
Who enforces it
Enforcement body
Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), which approves the audit providers and carries out audit and certification under the décret; the décret's own text names the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI) in those roles.
Settledness
- As of
- Guidance link
- https://anssi.gouv.ci/agrement-passi/
- Guidance body
- Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI)
- Open questions
- Does the eighteen-month periodic audit Article 4 requires after certification run within the same three-year certification cycle, or start a new one, given the décret states both clocks without reconciling them?
- Does ARTCI keep any of the powers Décret n°2021-917 gives it in Articles 4 and 20, now that Ordonnance n°2024-950 has repealed Article 50 of Loi n°2013-546 and ANSSI states that it is empowered to audit and certify under that décret?
What this law does
Article 3 subjects every public-sector information system and an enumerated set of private-sector categories, a telecommunications or ICT company, a telecommunications or internet service provider, a company whose information system connects through Côte d'Ivoire's public telecommunications networks, a company that automatically processes its customers' personal data in providing its service, an electronic-transactions company, an ARTCI-approved service provider, and an electronic-archiving or record-keeping provider, to a mandatory periodic security audit.
Article 4 sets a three-year certification audit cycle, with a further mandatory periodic audit eighteen months after a certificate issues. Article 20 caps the financial penalty for failing to complete the audit at 300,000,000 CFA francs, doubled on a repeat breach. Ordonnance n°2024-950 of repeals Article 50 of Loi n°2013-546 du 30 juillet 2013 relative aux transactions électroniques.
ARTCI's own security-audit page states that the audit of information-systems security in Côte d'Ivoire is governed by Article 50 of that Loi n°2013-546. The Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) states that it is empowered to audit and certify the information systems of legal entities established in Côte d'Ivoire under Décret n°2021-917. ANSSI states that the mandatory audit takes place every three years and is carried out by audit providers that ANSSI approves.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .