LiberiaLTA Cybersecurity Regulations 2026: Incident Notification and Semiannual Reporting to the Liberia Telecommunications Authority
LTA Cybersecurity Regulations 2026 (LTA REG 0013 - 2026), regs. 7.6, 7.9 and 10.6
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This reaches you where you are a telecommunications service provider, meaning a person or entity under permit or license from the Liberia Telecommunications Authority that provides a telecommunications service to the public or owns or operates a telecommunications network used to do so (regs. 3.1 and 6.0) (reached by declaring that you provide telecom services).
- Notify the LTA within 24 hours, and your customers or subscribers within 72 hours, of security breaches and major cybersecurity incidents involving critical information infrastructure (reg. 7.6(A)(ii)).
- Develop, annually test, maintain and update incident response plans and file the plan with the LTA (reg. 7.6(A)(i)).
- Submit semiannual reports to the LTA detailing the security updates and patches you applied, the vulnerabilities you detected and the corrective actions taken, and incident logs including near misses, with anonymized data for analysis (reg. 7.9).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Liberia Telecommunications Authority (LTA)
Settledness
- As of
- Open questions
- Does the reference in regulation 10.6 to a failure to report under regulation 7.8 reach the semiannual reports required by regulation 7.9?
What this law does
Regulation 7.6 requires a telecommunications service provider to notify the LTA within 24 hours and customers or subscribers within 72 hours of security breaches and major cybersecurity incidents involving critical information infrastructure. Regulation 6.0 defines critical information infrastructure as interconnected information systems and networks that are essential for the functioning of a nation or society.
Regulation 7.9 requires a provider to submit semiannual reports detailing security updates and patches applied, detected vulnerabilities and corrective actions taken, and incident logs. Regulation 10.6 provides a fine of up to USD 25,000 and possible license suspension or revocation for continued non-compliance with a provider duty to report to the LTA.
When LexLint raises it
When your app profile says your app provides telecom services.