EthiopiaCritical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations
Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 art. 3, art. 4, art. 5, art. 7, art. 8, art. 22(1)(a), art. 22(1)(d)-(f), art. 22(2)-(3), art. 22(5), art. 25(1)(a), art. 25(1)(c)-(d), art. 25(2)-(4), art. 28
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a critical infrastructure owner, or its delegated cybersecurity service provider, that the Information Network Security Administration has designated by Directive under Article 5 as critical infrastructure within one of twelve named sectors (information technology and communication, finance, security and safety, transport, education, health, water and energy, government services, disaster management, agriculture, trade, and industry). It reaches a designated critical infrastructure located outside Ethiopia's territory as well as inside it, and the primary text confirms no duty yet on an organization the Administration has not designated.
- Formulate and implement your own cybersecurity program and cybersecurity framework consistent with the mandatory national cybersecurity frameworks the Administration issues, classify and protect your critical assets to the Administration's standard, create the cybersecurity organizational structure the national framework calls for, and establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks.NIST CSF 2.0GV.PO-01NIST CSF 2.0ID.AM-05NIST CSF 2.0DE.CM-09
- Conduct regular cybersecurity risk assessments and impact analyses, participate in the Administration's annual National Cybersecurity Risk Survey and supply the information it requests, and obtain and renew a cyber audit certificate and a cybersecurity inspection-and-evaluation certificate from the Administration, taking appropriate corrective action within the time the Administration sets on any gap the audit or inspection finds.NIST CSF 2.0ID.RA-05NIST CSF 2.0ID.IM-01
- Employ cybersecurity professionals who hold a certification the Administration issues or recognizes, ensure the security of the supply chain of the technology products you use, obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system acquired by purchase, donation, development, or any other means, and ensure that any employee or officer with access to your critical assets holds a security clearance from the relevant government body.NIST CSF 2.0GV.RR-04NIST CSF 2.0GV.SC-01NIST CSF 2.0ID.RA-09
- You may perform these obligations yourself or delegate them to a person licensed to provide cybersecurity services under this Proclamation, unless the Administration has identified your infrastructure, on national-security grounds, as one whose cybersecurity duties may not be delegated.
- Not implementing a mandatory cybersecurity framework in a timely manner is an administrative offense fined from 500,000 to 1,000,000 Birr; not cooperating with a periodic cybersecurity audit is fined from 1,500,000 to 2,000,000 Birr; not taking timely corrective action on an audit or inspection finding, and using an information and communication technology system that has not undergone the required cybersecurity inspection and evaluation, are each fined from 800,000 to 1,000,000 Birr. A negligent violation is fined at no more than half those amounts, a first violation causing no damage may be resolved with a written warning instead, and a repeat violation is fined at triple the stated maximum for that offense.
- An officer, employee, member of the management body, or owner of the critical infrastructure who intentionally fails to implement a mandatory cybersecurity framework, fails to take timely corrective action on an audit finding, or uses an information and communication technology system that has not undergone the required inspection and evaluation, is separately subject to imprisonment of up to one year, rising to rigorous imprisonment of seven to ten years, or three to five years if committed negligently, where the failure interrupts, disrupts, or damages the critical infrastructure's service, compromises its integrity or confidentiality, or harms national security, national interest, public health, life, or the environment.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.RR-04Cybersecurity is included in human resources practices
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-01A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
- ID.AM-05Assets are prioritized based on classification, criticality, resources, and impact on the mission
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.RA-09The authenticity and integrity of hardware and software are assessed prior to acquisition and use
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 25(1)(a), (c), and (d): a cybersecurity officer, employee, member of the management body, or owner of a critical infrastructure who intentionally fails to implement or ensure the timely implementation of a mandatory cybersecurity framework, fails to take timely corrective action on a gap the Administration's cyber audit identifies, or uses or causes to be used an information and communication technology system that has not undergone cybersecurity testing and evaluation, is punishable with simple imprisonment of up to one year. Article 25(2) raises this to rigorous imprisonment of seven to ten years where the failure interrupts, disrupts, or damages the critical infrastructure's service, compromises its integrity or confidentiality, or causes harm to national security, national interest, public health or life, or the environment; Article 25(3) and (4) set six months' simple imprisonment and three to five years' rigorous imprisonment respectively where the same conduct is committed negligently.
Penalty structure
Four distinct administrative-fine bands inside Article 22(1): not implementing a mandatory cybersecurity framework in a timely manner is fined from 500,000 to 1,000,000 Birr (art. 22(1)(a)); not cooperating with a periodic cybersecurity audit is fined from 1,500,000 to 2,000,000 Birr (art. 22(1)(d)); not taking timely corrective action on an audit or inspection finding is fined from 800,000 to 1,000,000 Birr (art. 22(1)(e)); and using an information and communication technology system that has not undergone the required cybersecurity inspection and evaluation is fined from 800,000 to 1,000,000 Birr (art. 22(1)(f)). Article 22(2) fines a negligent violation of any of these at no more than half the stated amount; Article 22(3) lets the Administration resolve a first violation that caused no damage with a written warning instead of a fine; Article 22(5) fines a repeat violation at triple the stated maximum for that offense. The lowest and highest fines span all four bands, not one uniform range.
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- ETB
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
The Information Network Security Administration.
Settledness
The Proclamation grants a one-year implementation period from its own publication before it enters into force, during which the Administration has publicly stated it will issue implementation directives and publish standards; no such directive is confirmed as a separately published text in the primary sources located here.
- As of
- Open questions
- Which specific institutions within the twelve named sectors has the Administration designated as critical infrastructure under Article 5, and has that designation Directive been published?
- Have the mandatory national cybersecurity frameworks and standards Article 7 and Article 9(1) peg an owner's obligations to been published, given the Proclamation's own one-year implementation period?
- Which critical infrastructure has the Administration identified, under Article 8(2), as infrastructure whose cybersecurity duties may not be delegated to a licensed cybersecurity service provider?
What this law does
The Information Network Security Administration may designate a critical infrastructure owner under Article 5. A designated owner sits in one of twelve named sectors, including information technology and communication, finance, transport, education, health, water and energy, government services, disaster management, agriculture, trade, and industry.
A designated owner must formulate and implement its own cybersecurity program based on the Administration's mandatory national cybersecurity frameworks. A designated owner must hold a current cyber-audit certificate and a cybersecurity inspection-and-evaluation certificate that the Administration issues. A designated owner must ensure the security of the supply chain of the technology products it uses.
A designated owner must obtain the Administration's security clearance before integrating a new or upgraded information and communication technology system. A designated owner must establish and manage a center responsible for monitoring, reporting, and responding to cyberattacks. An owner may perform these obligations itself or delegate them to a person providing cybersecurity services licensed under this Proclamation.
The Administration may identify infrastructure whose cybersecurity service may not be delegated on national-security grounds.
Not implementing a mandatory framework in time is fined from 500,000 to 1,000,000 Birr, not cooperating with a periodic audit is fined from 1,500,000 to 2,000,000 Birr, and not correcting an audit or inspection finding in time, or using an information and communication technology system that has not undergone the required inspection and evaluation, is each fined from 800,000 to 1,000,000 Birr, with a negligent violation of any of these fined at no more than half the stated amount, a first violation causing no damage resolved with a written warning instead, and a repeat violation fined at triple the stated maximum.
A critical infrastructure officer, employee, manager, or owner who intentionally commits the underlying failure is separately liable to imprisonment of up to one year, a term that rises to rigorous imprisonment of seven to ten years, or three to five years if committed negligently, where the failure damages the infrastructure's service or harms national security, national interest, public health, life, or the environment.
The Proclamation was published in the Federal Negarit Gazette, Year 32, No. 41, on . Under its own Article 28, it enters into force one year later, on .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.
Back to the example · Lint your app
Page updated .