LexLint.ioBeta

Know the law your code answers to.

Law / Gabon

Sécurité des systèmes d'information (dispositions communes)

Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre III, Section 2, arts. 28-35

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://journal-officiel.ga/20087-027-2023-/

In force since .

A security baseline statutes rule binding public and private bodies.

Obligation class
Security, Governance, Disclosure

What it requires

  • This binds any operator of an information system with effects in Gabon, a term Law No. 027/2023 defines without a sector or size gate as an organised set of resources that collects, groups, classifies, processes or disseminates information, and separately binds any person whose activity is to offer users access to an information system.
  • Take all technical and administrative measures necessary to guarantee the security of the services you offer, including a standardised system to identify, evaluate, treat and continuously manage the risks affecting your information systems' security.NIST CSF 2.0ID.RA-06NIST CSF 2.0GV.RM-06
  • Deploy technical mechanisms addressing threats to your systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, and have those mechanisms cleared for conformity with the competent administrative authority's cybersecurity policy.NIST CSF 2.0PR.IR-03NIST CSF 2.0GV.OC-03
  • If your activity is to offer users access to an information system, inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and offer them at least one such means.NIST CSF 2.0RC.CO-04
  • Retain your systems' connection and traffic data for ten years, and submit your networks and information systems to a mandatory, periodic security audit on terms a regulation sets.NIST CSF 2.0PR.PS-04NIST CSF 2.0GV.OC-03
  • Comply within six months of the law's entry into force; Article 98 does not itself state what sanction follows a late or missing compliance with this duty.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • GV.RM-06A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated
  • ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
  • PR.PS-04Log records are generated and made available for continuous monitoring
  • PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • RC.CO-04Public updates on incident recovery are shared using approved methods and messaging
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 3.5Incident response
  • 6.10Vulnerability handling and disclosure
1 more

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 98 gives every person concerned by the law six months from its entry into force to comply, under pain of a sanction the law does not itself specify as criminal, administrative or civil for this duty.

Who enforces it

Enforcement body

The competent administrative authority for the digital domain (autorité administrative compétente), an office the law defines only generically and does not itself name; Article 28 requires that authority's conformity clearance for the operator's security mechanisms against its own cybersecurity policy.

Settledness

As of
Open questions
What specific administrative, civil or criminal sanction attaches to a failure of the Article 28 to 35 duty, given Article 98 threatens an unspecified sanction after a six-month grace period but names no fine, scale or procedure for this duty?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Articles 28 to 35 of Law No. 027/2023 require any operator of an information system, a term the law defines without any sector or size gate as an organised set of resources that collects, groups, classifies, processes or disseminates information, to take all technical and administrative measures necessary to guarantee the security of the services it offers.

Each operator must adopt standardised systems to identify, evaluate, treat and continuously manage the risks affecting its information systems' security, and must deploy technical mechanisms addressing threats to the systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, with those mechanisms subject to a conformity clearance from the competent administrative authority on its cybersecurity policy.

A person whose activity is to offer users access to an information system must inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and must offer at least one such means. An operator of an information system must retain its connection and traffic data for ten years.

Its networks and information systems are also subject to a mandatory, periodic security audit on terms a regulation sets. Article 98 gives every person concerned by the law six months from its entry into force to comply, under pain of sanctions the article does not itself specify.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example  ·  Lint your app

Page updated .