DjiboutiNational Cybersecurity Authority Law: Security Duties of Operators of Vital Importance
Loi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Arts. 9, 12 et 13
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a public or private operator that manages an infrastructure of vital importance, that is an installation, system or service whose unavailability would gravely compromise national security, the economy or public health. The National Cybersecurity Authority identifies the initial list of these operators and proposes it to the Government.
- Implement the security measures the National Cybersecurity Authority prescribes for operators of vital importance.
- Apply the corrective measures the Authority orders where it finds a critical vulnerability.
- In a major cyber crisis that constitutes a grave and imminent threat to national security, apply the proportionate technical measures the Authority imposes on operators of vital importance for the length of the crisis.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 14 provides administrative sanctions only: a formal notice, an administrative fine, and in exceptional cases a temporary ban on operating certain information systems.
Penalty structure
Administrative fine of up to 2 percent of total worldwide annual turnover of the previous financial year for a private company, or up to 1 percent of the annual budget for a public entity (Article 14). Article 14 adds a formal notice to comply and, exceptionally and where there is a grave and imminent risk to national security, a temporary ban on operating certain information systems for up to one month, renewable once.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Autorité Nationale de Cybersécurité (the National Cybersecurity Authority), which pronounces the administrative sanctions after adversarial proceedings; its decisions are open to appeal before the administrative court.
Settledness
- As of
- Open questions
- Has the Government adopted the list of operators of vital importance that the Authority is to propose, and the decree that fixes the law's modalities of application?
What this law does
Article 13 requires an operator of vital importance to implement the security measures the National Cybersecurity Authority prescribes. The law defines an infrastructure of vital importance as an installation, system or service whose unavailability would gravely compromise national security, the economy or public health. An operator of vital importance is a public or private person managing an infrastructure of vital importance.
The Authority identifies and proposes to the Government the initial list of operators of vital importance. The Authority may issue security rules applicable to the information systems of the State and of operators of vital importance after consulting the entities concerned, check compliance with those rules and carry out the necessary audits. The Authority may order the implementation of corrective measures in the event of a critical vulnerability.
The Authority may order an operator of vital importance to apply proportionate technical measures to meet a major cyber crisis constituting a grave and imminent threat to national security, on a decision of the National Cybersecurity Council.
In that crisis the Authority may also order the temporary isolation of certain information systems from public networks for at most 48 hours, renewable only with the administrative judge's authorization, and the shutdown of compromised systems for at most seven days unless a judicial authorization extends it. Non-compliance with the law's obligations draws administrative sanctions the Authority pronounces after adversarial proceedings.
An administrative fine under Article 14 may not exceed 2 percent of total worldwide annual turnover of the previous financial year for a private company or 1 percent of the annual budget for a public entity. Decisions taken under Articles 11 and 13 may be challenged by a suspensive appeal to the administrative judge. The modalities of application of the law are fixed by decree adopted in the Council of Ministers.
The National Assembly adopted the law in its second public sitting of . The President of the Republic signed the law at Djibouti on . The Journal Officiel published the law on in edition n° 23 of . Article 31 provides that the law is registered and published in the Journal Officiel upon its promulgation.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means.
When LexLint raises it
When your app profile says your app runs an essential service.