DjiboutiDigital Code, Book VI: Critical Installation Protection and Operator Security Controls
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Sixième, Titre 3 (Arts. 679 à 684)
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
What it requires
- Implement a qualified system for detecting events capable of affecting your information systems' security, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti. The detection system, and any service provider you use to run it, must be qualified by the national cybersecurity authority.NIST CSF 2.0DE.CM-09
- Submit your information systems, at your own cost, to a control the cybersecurity authority conducts to verify their security level and your compliance with security rules.NIST CSF 2.0ID.IM-01
- Maintain and keep in good condition any protective device you have established: failing to do so draws a fine of up to 10,000,000 Djiboutian francs.NIST CSF 2.0PR.PS-03
- Expect the State to hold offence-capable equipment and data for cyberattack analysis and response through its own designated services, and to obtain your users' identity and contact details from you where those users hold a vulnerable, threatened or attacked information system, so the competent authority can alert them; obstructing either of these state functions draws a fine of up to 25,000,000 Djiboutian francs.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.MA-P1Maintenance and repair of organizational assets are performed and logged, with approved and controlled tools.
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Failing to maintain and keep in good condition a protective device previously established under Articles 679 and 680 draws a fine of up to 10,000,000 Djiboutian francs (Article 681). Obstructing the State's Article 682 cyberattack-response function or the Article 683 user-alert data request draws a separate fine of up to 25,000,000 Djiboutian francs (Article 684). Both sanctions sit within Book VI's own criminal-procedure framework rather than the telecoms regulator's administrative sanctions power.
Penalty structure
Graduated by offence: failing to maintain and keep in good condition a protective device previously established under Articles 679 and 680 (Article 681) caps at 10,000,000 francs; obstructing the State's cyberattack-response function under Article 682 or the user-alert data request under Article 683 (Article 684) caps at 25,000,000 francs.
- Rule
- Fixed only
- As of
- Currency
- DJF
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
Autorité nationale en charge de la cybersécurité (qualifies detection systems and service providers, and conducts the Article 680 security-level controls); a State service and a competent authority the Council of Ministers designates by decree (Articles 682 and 683).
Settledness
- As of
- Open questions
- Does Titre 3's use of 'opérateurs' reach only the Article 1 definition of an electronic communications network or service operator, or does it extend to a broader class of critical-installation operator the Code does not separately define?
What this law does
Book VI's Titre 3, headed the implementation of non-military and non-economic defence, requires an operator (the Code's own definition: any natural or legal person operating a public electronic communications network or providing a public electronic communications service to the public) to implement a qualified system for detecting events capable of affecting its information systems' security, qualified by the national cybersecurity authority together with the service providers that run such systems (Article 679).
The operator must submit its information systems to controls the cybersecurity authority conducts to verify their security level and compliance with security rules, at the operator's own cost (Article 680); omitting to maintain and keep in good condition a protective device previously established under this Chapter draws a fine of up to 10,000,000 Djiboutian francs (Article 681).
A separate Chapter lets a State service the Council of Ministers designates by decree hold equipment, instruments, programs and data capable of carrying out an offence, in order to analyse and respond to a cyberattack, a power on the State rather than a duty on the operator (Article 682), and lets a competent authority the Council of Ministers designates by decree obtain from an electronic communications operator the identity, postal address and electronic address of a user or holder of a vulnerable, threatened or attacked information system, in order to alert them to the vulnerability or compromise (Article 683).
Obstructing the accomplishment of the missions in Articles 682 and 683 draws a fine of up to 25,000,000 Djiboutian francs (Article 684). The Digital Code was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. No notice or register stating the day the Digital Code came into force has been located.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .