Cabo VerdeCybersecurity Regime: Incident Notification by Critical Infrastructure and Essential-Service Operators
Decreto-lei nº 9/2021, arts. 16 and 18 (regime jurídico de cibersegurança)
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds the public administration (central, local, independent administrative entities, public institutes, public companies and public associations), the operators of critical infrastructure and the operators of essential services, public or private, in the sectors the Annex lists: energy, transport, banking, financial market infrastructure, health, drinking water, and digital infrastructure and telecommunications (Articles 2, 3 and 11 and the Annex), reached by declaring that you operate an essential service.
- If you are a public administration body or a critical infrastructure operator, notify the Centro Nacional de Cibersegurança of incidents with a relevant impact on the security of the networks and information systems, within the period set by the regulation Article 14 provides for (Article 16(1)).
- If you are a critical infrastructure operator, include in the notification the information that lets the Centro determine the cross-border impact of the incident (Article 16(2)).
- If you are an essential-service operator, notify the Centro of incidents with a relevant impact on the continuity of the essential services you provide, within the period set by regulation, and include the information that lets it determine the cross-border impact (Article 18(1)-(2)).
- If you are an essential-service operator that depends on a third-party digital service provider, notify every important impact on the continuity of your services that results from incidents affecting that provider (Article 18(10)).
- Weigh whether an incident's impact is relevant by the number of users affected, the duration of the incident and its geographic spread (Articles 16(4) and 18(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 23 classifies infractions of the decree-law as contraordenações (administrative offences), which Articles 24 and 25 punish with fines.
Penalty structure
Article 25 punishes a serious infraction, which includes failing to notify an incident under Articles 16, 18 and 20, with a fine of 80,000$00 to 250,000$00 for a legal person and 20,000$00 to 80,000$00 for an individual.
- Rule
- Fixed only
- As of
- Minimum
- 80,000
- Currency
- CVE
- Fixed cap
- 250,000
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança, the national cybersecurity authority, which holds the powers of inspection and of applying sanctions under the decree-law.
Settledness
- As of
- Open questions
- What period does the regulation Article 14 provides for set for notifying an incident, since Articles 16 and 18 leave the deadline to it?
- Has the Centro Nacional de Cibersegurança been installed, since Article 33 starts Articles 16 to 28 180 days after its installation?
What this law does
Article 16 requires the public administration and the operators of critical infrastructure to notify the Centro Nacional de Cibersegurança of incidents with a relevant impact on the security of the networks and information systems, within the period that separate regulation sets. Article 18 requires the operators of essential services to notify the Centro of incidents with a relevant impact on the continuity of the essential services they provide, within the period that separate regulation sets.
Article 33 provides that Articles 16 to 28 take effect 180 days after the Centro Nacional de Cibersegurança is installed.
When LexLint raises it
When your app profile says your app runs an essential service, is a bank, provides telecom services or handles health records.