LiberiaLTA Cybersecurity Regulations 2026: Cybersecurity Unit, Risk Identification, Protection, Detection and Recovery Duties of Telecommunications Service Providers
LTA Cybersecurity Regulations 2026 (LTA REG 0013 - 2026), regs. 7.1 to 7.5, 7.7, 7.8 and 10
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This reaches you where you are a telecommunications service provider, meaning a person or entity under permit or license from the Liberia Telecommunications Authority that provides a telecommunications service to the public or owns or operates a telecommunications network used to do so (regs. 3.1 and 6.0) (reached by declaring that you provide telecom services).
- Establish and maintain a Cybersecurity Unit within your entity, managed by a senior staff member with overall supervision and accountability for cybersecurity, within one year of the effective date of the Regulations, and submit the unit to mandatory cybersecurity examinations by industry-certified auditors validated by the LTA (reg. 7.1).
- Keep an updated baseline configuration and inventory of all digital assets, conduct comprehensive risk assessments annually and after significant ICT changes, document vulnerabilities, threats and current controls, and evaluate the risks of third parties connecting to your networks (reg. 7.2).
- Implement identity and access management policies and controls including multi-factor authentication, segment ICT systems by business criticality, encrypt sensitive data in transit and at rest, and deploy network and web application firewalls, intrusion detection and prevention systems and antivirus software (reg. 7.3).
- Operate continuous monitoring systems that detect anomalies, conduct penetration testing at least once a year, and maintain logs of security events for at least 12 months (reg. 7.5).
- Develop, annually test, maintain and update disaster recovery and business continuity plans and file them with the LTA (reg. 7.7).
- Implement automated tools for continuous monitoring of your networks with real-time threat detection, and conduct regular audits of your compliance with the baseline framework objectives, including risk management practices, data protection and incident response capabilities (reg. 7.8).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Liberia Telecommunications Authority (LTA)
Settledness
- As of
- Open questions
- On what day were the LTA Cybersecurity Regulations 2026 published, which fixes the one-year periods in regulations 7.1(B) and 10.7?
What this law does
The LTA Cybersecurity Regulations 2026 apply to all telecommunications service providers that own, operate or connect to telecommunications networks to provide telecommunications services in Liberia. Regulation 7.1 gives each telecommunications service provider one year from the effective date of the Regulations to complete the establishment of its Cybersecurity Unit.
Regulation 7.5 requires a provider to conduct penetration testing at least once a year and to maintain logs of security events for at least 12 months. Regulation 10.1 sets a fine of not more than USD 3,000 plus 0.15% of the preceding year annual gross revenue for a provider that fails to establish a Cybersecurity Unit. Under regulation 10.7, all penalties for violation become applicable one year after the effective date of the Regulations.
When LexLint raises it
When your app profile says your app provides telecom services.