DjiboutiDigital Code, Book II: Electronic Communications Network and Service Security
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Deuxième, Art. 169
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- Take all appropriate measures to ensure the integrity of your network and the continuity of the services you supply, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti.NIST CSF 2.0PR.IR-03
- Take all technical and organizational measures necessary to secure your network and services at a level adapted to the existing risk, and comply with the technical security prescriptions the national cybersecurity authority issues.NIST CSF 2.0ID.RA-06NIST CSF 2.0GV.OC-03
- Give the cybersecurity authority confidential access, on request, to the arrangements you have made to secure your network, and submit your network to a security and integrity inspection the authority conducts or commissions.NIST CSF 2.0GV.OC-03NIST CSF 2.0ID.IM-01
- Where a particular risk of a security breach exists, inform your users of the risk without delay, of any available remedy, and of its cost.NIST CSF 2.0RS.CO-02
- As soon as you become aware of a security breach or integrity loss with a significant impact on your network's or service's operation, notify the cybersecurity authority and the telecoms regulator by registered letter with acknowledgement of receipt. No numeric clock is stated for this notice, unlike the 24-hour clock this jurisdiction's Digital Code sets for a trust service provider or the 72-hour clock it sets for a personal-data breach.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- ID.IM-01Improvements are identified from evaluations
- PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 169 itself states no penalty. Non-compliance is enforced through the telecoms regulator's general administrative sanctions power for the sector, an administrative financial penalty rather than a criminal charge.
Who enforces it
Enforcement body
Autorité nationale en charge de la cybersécurité (the national cybersecurity authority, which issues the technical security prescriptions and receives breach notice) and the Autorité de régulation multisectorielle de Djibouti (the telecoms regulator, which may impose an administrative financial penalty after a formal notice goes unheeded: up to 4 percent of consolidated turnover for a licence or authorization holder, and between 1,300,000 and 25,000,000 Djiboutian francs for a declarant, an agrément holder, or an alternative-infrastructure operator, doubled on repeat non-compliance, under the regulator's general Book II sanctions power).
Settledness
- As of
- Open questions
- Does the 'as soon as it becomes aware' standard for notifying the cybersecurity authority of a security breach carry any construed numeric deadline, or does it remain an unconstrued reasonableness standard?
What this law does
Article 169 requires an operator of a public electronic communications network or a provider of a public electronic communications service to take all appropriate measures to ensure the integrity of its networks and the continuity of the services it supplies, and to take all technical and organisational measures necessary to secure its network and services at a level adapted to the existing risk.
The operator must comply with the technical security prescriptions the national cybersecurity authority issues, must give that authority confidential access to its network-security arrangements on request, and must submit to a security and integrity inspection the authority conducts or commissions. Where there is a particular risk of a breach of its network's security, the operator must inform users of the risk without delay, together with any available remedy and its cost.
As soon as it becomes aware of a security breach or integrity loss with a significant impact on the operation of its networks or services, the operator must notify both the cybersecurity authority and the telecoms regulator by registered letter with acknowledgement of receipt, and must separately notify the cybersecurity authority where the breach results or may result from a cyberattack; the article states no numeric reporting clock for this notice, only that it follows as soon as the operator has knowledge of the breach.
The Digital Code was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force. Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. No notice or register stating the day the Digital Code came into force has been located.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .