Cabo VerdeCybersecurity Regime: Security Measures of Critical Infrastructure and Essential-Service Operators
Decreto-lei nº 9/2021, arts. 11, 15 and 17 (regime jurídico de cibersegurança)
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex), reached by declaring that you operate an essential service.
- Take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems you use, at a level of security that suits the risk and the latest technical progress (Articles 15(1)-(2) and 17(1)-(2)).
- If you are a public administration body or a critical infrastructure operator, apply the security requirements of the decree-law that sets the information security policies, standards and rules for the State's Private Technology Network (RTPE), together with the technical implementing measures the Centro Nacional de Cibersegurança approves (Article 15(1) and (4)).
- Take adequate measures to prevent incidents that affect the security of the networks and information systems you use and to minimise their impact; an essential-service operator does so to ensure the continuity of its services (Articles 15(3) and 17(3)).
- If you are an essential-service operator, register formally with CSIRT.CV, the national computer security incident response team (Article 11(2)).
- If you are an essential-service operator, carry out an internal audit every year by 31 December and send its report to the Centro Nacional de Segurança, as Article 17(4) names the recipient, within 15 days of completing the audit (Article 17(4)).
- Follow the cybersecurity instructions the Centro Nacional de Cibersegurança issues (Articles 8(1)(b) and 24(1)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 23 classifies infractions of the decree-law as contraordenações (administrative offences), which Articles 24 and 25 punish with fines.
Penalty structure
Article 24 punishes a very serious infraction, which includes failing to implement the security requirements of Articles 15, 17 and 19 or failing to follow the instructions of the Centro Nacional de Cibersegurança, with a fine of 150,000$00 to 1,000,000$00 for a legal person and 50,000$00 to 300,000$00 for an individual.
- Rule
- Fixed only
- As of
- Minimum
- 150,000
- Currency
- CVE
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança, the national cybersecurity authority, which holds the powers of inspection and of applying sanctions under the decree-law.
Settledness
- As of
- Open questions
- Has the separate regulation that Article 32 required within 150 days of entry into force, which defines the security requirements of Articles 15 and 17, been issued?
- Has the Centro Nacional de Cibersegurança been installed, since Article 33 starts the sanctions regime of Articles 23 to 28 180 days after its installation?
What this law does
Article 15 requires the public administration and the operators of critical infrastructure, public or private, to take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems they use. Article 17 requires the operators of essential services to take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems they use.
Article 17 requires the operators of essential services to carry out internal audits every year and to send each report within 15 days of completing the audit.
When LexLint raises it
When your app profile says your app runs an essential service, is a bank, provides telecom services or handles health records.