MauritiusCybersecurity and Cybercrime Act 2021, Critical Information Infrastructure Protection
Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), Part V (ss. 33-34 and 37)
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This binds the owner of an asset, facility, system, network or process that the National Cybersecurity Committee has declared a critical information infrastructure after consulting the regulatory authority in control of it, whether the owner is public or private (reached by declaring that you operate an essential service). Part V of the Cybersecurity and Cybercrime Act 2021 applies from its proclamation on .
- Carry out the assessments your sector's regulatory authority directs you to carry out: of the threats, vulnerabilities, risks and probability of a cyber-attack on the infrastructure, of your overall preparedness against damage or unauthorised access, and of any other risk based factor appropriate to protect it (section 34(a) to (c)).
- Implement an information security policy, conduct periodic IT security risk assessments of the infrastructure and develop a security awareness programme when the regulatory authority directs you to (section 34(d), (e) and (g)).
- Carry out an independent IT security audit every year and on any major upgrade or change in your IT infrastructure, and submit the audit report to the National Cybersecurity Committee to evaluate compliance (section 37(1) and (2)).
- Provide the Committee, within the period it specifies, any additional information it requests to evaluate the issues the audit raised (section 37(3)).
- Do not hinder, obstruct or attempt to influence the person who carries out the audit or any member of the Committee who evaluates it (section 37(4)(d) and (e)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 37(4) makes failing to carry out the independent IT security audit, failing to submit its report, failing to provide additional information the Committee requests, and hindering, obstructing or attempting to influence the auditor or the Committee an offence punishable by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 5 years.
Penalty structure
Section 37(4) caps the fine at 100,000 rupees and the imprisonment at 5 years, and states them together ('and'), for an owner who fails to carry out or submit the audit, fails to provide the additional information requested, or hinders or attempts to influence the auditor or the Committee.
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The National Cybersecurity Committee, which receives the independent IT security audit report to evaluate compliance and may request from the owner the additional information it needs to evaluate any issues the audit raised.
Settledness
- As of
- Open questions
- Which information infrastructures has the National Cybersecurity Committee declared critical information infrastructures under section 33, and which sector regulator directs each owner under section 34?
- Were sections 33 to 37 proclaimed on together with the rest of the Act, given that section 56(2) allows different dates for different sections?
What this law does
Section 33(1) of the Cybersecurity and Cybercrime Act 2021 lets the National Cybersecurity Committee, after consulting the regulatory authority in control of an information infrastructure identified as a potential critical information infrastructure, identify the information structures that need to be declared critical information infrastructures.
Section 33(2) selects a system as a critical information infrastructure if a disruption of the system or its data would interrupt a life sustaining service such as the supply of water, health services and energy, have an important effect on the economy, cause massive casualties or fatalities, or cause failure or substantial disruption of the money market.
Section 34 requires the regulatory authority of a critical information infrastructure, in consultation with the Committee, to direct the owner to assess the threats, vulnerabilities, risks and probability of a cyber-attack on it. Section 34 also has the regulatory authority direct the owner to conduct periodic IT security risk assessments, implement an incident reporting policy and develop a security awareness programme.
Section 37(1) requires the owner of a critical information infrastructure to carry out an independent IT security audit every year or where there is a major upgrade or change in the IT infrastructure. Section 37(2) requires the report of the independent IT security audit to be submitted to the National Cybersecurity Committee to evaluate compliance.
Section 37(4) makes it an offence for the owner to fail to carry out the audit or to submit its report, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 5 years. The Act was assented to by the Acting President on . The Information and Communication Technologies Authority of Mauritius lists the Act as proclaimed on .
When LexLint raises it
When your app profile says your app runs an essential service.