MoroccoLoi n° 05-20, Vital Infrastructure Incident Declaration
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.dgssi.gov.ma/sites/default/files/legislative/brochure/2023-03/loi%2005-20.pdfIn force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the person in charge of a vital infrastructure (infrastructure d'importance vitale), an installation, structure or system indispensable to the vital functions of society that the government authority or public body coordinating its vital sector designates after the opinion of the national cybersecurity authority; the list of designated infrastructures is kept secret (Articles 2 and 16; reached by declaring that you operate an essential service).
- Declare to the national cybersecurity authority, as soon as you become aware of it, any incident affecting the security or operation of your information systems (Articles 8 and 14).
- When the national cybersecurity authority asks, give it without delay further information on incidents affecting the security or operation of your information systems, and send the technical data and incident information it specifies in the manner it specifies (Article 8).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A fine of 100,000 to 200,000 dirhams for failing the incident declaration obligations of Articles 8, 30 and 33 (Art. 50), doubled on recidivism within four years (Art. 52).
Penalty structure
Article 50 fixes a fine of 100,000 to 200,000 dirhams for failing the incident declaration obligations of Articles 8, 30 and 33; Article 52 doubles the sanctions on recidivism.
- Rule
- Fixed only
- As of
- Minimum
- 100,000
- Currency
- MAD
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The national cybersecurity authority (autorité nationale) designated by regulation, which receives the declarations; agents of the authority establish offences by procès-verbal (Articles 8 and 48).
Settledness
- As of
- Open questions
- Which technical data and incident information must a declaration contain, and in what manner is it sent, given that Article 8 leaves both to the national authority to specify?
What this law does
Article 2 of Loi n° 05-20 defines vital infrastructures as the installations, structures and systems indispensable to the maintenance of the vital functions of society, health, safety, security and economic or social well-being. Article 14 applies the provisions of Section 1 of Chapter II to vital infrastructures.
Article 16 provides that the government authority, public establishment or other public-law legal person that coordinates a vital sector designates the vital infrastructures of that sector after the opinion of the national authority, and that the list of designated infrastructures is kept secret. Article 8 requires an entity, as soon as it becomes aware of an incident affecting the security or operation of its information systems, to declare it to the national authority.
Article 8 also requires the entity, at the national authority's request, to give it without delay further information on incidents affecting the security or operation of its information systems. Article 50 punishes with a fine of 100,000 to 200,000 dirhams anyone who fails the incident declaration obligations of Articles 8, 30 and 33. Article 52 doubles the sanctions the Law provides in case of recidivism.
Article 53 provides that the Law enters into force on the date the Bulletin officiel publishes the texts taken for its application. Bulletin Officiel n° 7011 publishes Décret n° 2.21.406 of 4 hija 1442 (), taken for the application of Loi n° 05-20 relative à la cybersécurité. Dahir n° 1-20-69 of promulgated Loi n° 05-20 relative à la cybersécurité.
When LexLint raises it
When your app profile says your app runs an essential service.