MoroccoLoi n° 05-20, Vital Infrastructure Security Regime
Loi n° 05-20, Chapitre II, Section 2, Arts. 14 à 25 (infrastructures d’importance vitale)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.dgssi.gov.ma/sites/default/files/legislative/brochure/2023-03/loi%2005-20.pdfIn force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Licensing
As of .
What it requires
- This binds the person in charge of a vital infrastructure (infrastructure d'importance vitale), an installation, structure or system indispensable to the vital functions of society that the government authority or public body coordinating its vital sector designates after the opinion of the national cybersecurity authority; the list of designated infrastructures is kept secret (Articles 2 and 16; reached by declaring that you operate an essential service).
- Apply the security rules that Chapter II, Section 1 of the Law sets for entities, which Article 14 extends to vital infrastructures.
- Draw up, from a risk analysis, the list of your sensitive information systems and send it, with its updates, to the national cybersecurity authority; where the authority makes observations, amend the list and send the amended list within two months of receiving them (Articles 17 and 18).
- Have the security of every sensitive information system approved (homologation) before you put it into operation (Article 19).
- When the national cybersecurity authority asks, submit your sensitive information systems to an audit carried out by the authority or by an auditor it has qualified; give the authority or the auditor the information needed, including your security policy and earlier audit results, and access to the networks and systems audited; send the auditor's report to the authority; and bear the cost of a qualified auditor (Articles 20 to 23).
- Put in place an action plan to implement the recommendations of the audit reports and send it to the national cybersecurity authority (Article 24).
- Use the services, products or solutions that strengthen security functions as the national authority defines them, and use only providers qualified by the authority if you outsource cybersecurity services (Article 25).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of 200,000 to 400,000 dirhams for putting a sensitive information system into operation without the Article 19 approval, entrusting its audit to a non-qualified provider, or outsourcing cybersecurity services to a non-qualified provider (Art. 49); a fine of 100,000 to 200,000 dirhams for obstructing the Article 20 audits (Art. 50); doubled on recidivism within four years (Art. 52).
Penalty structure
Article 49 fixes a fine of 200,000 to 400,000 dirhams for putting a sensitive information system into operation without the Article 19 approval, for entrusting the audit of sensitive systems to a non-qualified provider (Article 20) and for outsourcing cybersecurity services to a non-qualified provider (Article 25); Article 50 fixes a fine of 100,000 to 200,000 dirhams for obstructing the Article 20 audits. Article 52 doubles the sanctions on recidivism.
- Rule
- Fixed only
- As of
- Minimum
- 100,000
- Currency
- MAD
- Fixed cap
- 400,000
Who enforces it
Enforcement body
The national cybersecurity authority (autorité nationale) designated by regulation, which audits sensitive information systems of vital infrastructures and qualifies auditors and cybersecurity providers; agents of the authority establish offences by procès-verbal (Articles 20, 25 and 48).
Settledness
- As of
- Open questions
- Which sectors of vital importance and which infrastructures has the regulation under Article 15 and the designation under Article 16 named, given that the list of designated infrastructures is kept secret?
What this law does
Article 2 of Loi n° 05-20 defines vital infrastructures as the installations, structures and systems indispensable to the maintenance of the vital functions of society, health, safety, security and economic or social well-being. Article 14 applies the provisions of Section 1 of Chapter II to vital infrastructures.
Article 16 provides that the government authority, public establishment or other public-law legal person that coordinates a vital sector designates the vital infrastructures of that sector after the opinion of the national authority, and that the list of designated infrastructures is kept secret.
Article 17 requires the person in charge of a vital infrastructure to draw up, on the basis of a risk analysis, the list of its sensitive information systems and to send it, with its updates, to the national authority. Article 19 requires every sensitive information system to undergo a security approval (homologation) before it is put into operation.
Article 20 requires the persons in charge of vital infrastructures, at the national authority's request, to submit their sensitive information systems to an audit carried out by the authority or by an auditor it has qualified. Article 24 requires each audited vital infrastructure to put in place an action plan to implement the recommendations of the audit reports and to send it to the national authority.
Article 25 requires the persons in charge of vital infrastructures to use the services, products or solutions the national authority defines to strengthen security functions, and to use providers the authority has qualified when they outsource cybersecurity services. Article 49 punishes with a fine of 200,000 to 400,000 dirhams the person in charge of a vital infrastructure who puts a sensitive information system into operation without the approval Article 19 requires.
Article 50 punishes with a fine of 100,000 to 200,000 dirhams anyone who obstructs or prevents the security audits of the sensitive information systems of vital infrastructures that Article 20 provides for. Article 52 doubles the sanctions the Law provides in case of recidivism. Article 53 provides that the Law enters into force on the date the Bulletin officiel publishes the texts taken for its application.
Bulletin Officiel n° 7011 publishes Décret n° 2.21.406 of 4 hija 1442 (), taken for the application of Loi n° 05-20 relative à la cybersécurité. Dahir n° 1-20-69 of promulgated Loi n° 05-20 relative à la cybersécurité.
When LexLint raises it
When your app profile says your app runs an essential service.