GabonCybersecurity Law: Critical Infrastructure and Service Operator Protection Regime
Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre Ier, arts. 9-18 et 35
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://journal-officiel.ga/20087-027-2023-/In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the operator of an infrastructure or a service that a classification decree designates as critical, in the sovereign, human, economic and technological domains (Article 11); you are reached by declaring that you operate an essential service.
- Draw up, from a risk analysis, the list of your sensitive information systems and send it, with each update, to the competent administrative authority; amend the list as that authority's observations require and send it again within the period a regulation sets (Article 12).
- Take all useful measures to organise and ensure the security of the critical infrastructure, on the conditions and terms a regulation sets (Article 13).
- Draw up a plan of protection measures, including monitoring, alert and physical protection devices that keep the infrastructure permanently operational, and submit it to the competent administrative authority for approval (Articles 14 to 16).
- Carry out an approved plan within the period the authority sets, and have the effective carrying out of the measures certified as to security (Articles 16 and 17).
- Apply the common information-system security duties of Articles 28 to 34 as well, subject to any more demanding security measures a regulation sets, since Article 35 extends that section to critical-infrastructure operators.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent administrative authority (autorité administrative compétente), which approves the operator's plan of protection measures.
Settledness
- As of
- Open questions
- Has the decree adopting the criteria for classifying critical-infrastructure operators under Article 10, or a classification decree under Article 11, been issued, and does it designate any operator?
- What does the fine for missing the execution period under Article 17 come to, given that the law fixes it by the importance of the damage and leaves its application to the finance law?
What this law does
Article 11 requires each ministerial department to identify the critical infrastructures and services in its sector, notably in the sovereign, human, economic and technological domains. Article 11 provides that a classification decree, notified to the operator of the critical infrastructure, lists those sectors and infrastructures.
Article 12 requires the operator of a critical infrastructure to draw up, on the basis of a risk analysis, the list of its sensitive information systems and to send it, with its updates, to the competent administrative authority. Article 12 requires the operator to amend that list in line with the authority's observations and to send the amended list within a period set by regulation.
Article 13 requires the operator of a critical infrastructure to take all useful measures to organise and ensure the security of that infrastructure, on the conditions and terms set by regulation. Article 15 provides that the protection measures include monitoring, alert and physical protection devices that guarantee the permanent operability of the infrastructure.
Article 16 requires the operator to draw up a plan of protection measures and submit it to the competent administrative authority for approval. Article 16 provides that the effective carrying out of those measures is the subject of a security certification.
Article 17 provides that, once a plan is approved, the competent authority sets the operator a period for carrying it out, and that missing the period exposes the operator to a fine whose amount depends on the importance of the damage caused or likely to be caused. Article 35 provides that the provisions of its section apply to critical-infrastructure operators, subject to any more demanding security measures set by regulation.
When LexLint raises it
When your app profile says your app runs an essential service.