MauritiusCybersecurity and Cybercrime Act 2021, Reports on Critical Information Infrastructure Incidents
Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), s. 35
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the owner of an asset, facility, system, network or process that the National Cybersecurity Committee has declared a critical information infrastructure, whether the owner is public or private (reached by declaring that you operate an essential service). Part V of the Cybersecurity and Cybercrime Act 2021 applies from its proclamation on .
- Report to the National Cybersecurity Committee any cybersecurity incident that impacts national security, public safety or the public interest, together with the action you intend to take to mitigate the incident (section 35(1)).
- Implement the incident reporting policy that the regulatory authority of your critical information infrastructure directs you to adopt (section 34(f)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Cybersecurity Committee, which receives the report and, on receipt, directs CERT-MU to advise the owner on mitigation of the incident.
Settledness
- As of
- Open questions
- By what time after an incident must the owner of a critical information infrastructure report it to the Committee under section 35(1), given that the section states no period?
- Were sections 33 to 37 proclaimed on together with the rest of the Act, given that section 56(2) allows different dates for different sections?
What this law does
Section 35(1) of the Cybersecurity and Cybercrime Act 2021 requires the owner of a critical information infrastructure to report to the Committee any cybersecurity incident impacting the national security, public safety or public interest and the action the owner intends to take to mitigate the incident. Section 35(2) has the Committee, on receipt of a report, direct CERT-MU to advise the owner of the critical information infrastructure on the mitigation of the incident.
Section 34(f) has the regulatory authority direct the owner to implement an incident reporting policy. Section 33(3)(f) has the regulatory authority monitor and report to the Committee on reporting to CERT-MU, by the owners of critical information infrastructure, of cybersecurity incidents impacting national security, public safety and public interest. The Act was assented to by the Acting President on . The Information and Communication Technologies Authority of Mauritius lists the Act as proclaimed on .
When LexLint raises it
When your app profile says your app runs an essential service.