MozambiqueCybersecurity Law, General Security Requirements for the Public Administration and the Private Sector
Lei n.º 13/2026, arts. 47 a 50
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- It reaches you regardless of sector or size: Article 2 covers the whole private sector and the public administration alongside named categories of infrastructure, service, and platform operator, and Article 49 makes the minimum security requirements below compulsory for every entity the Law covers.
- Adopt a written information-security policy, a cyber-risk-management methodology, incident-notification procedures, mechanisms to prevent, correct, or mitigate cyber risk, a backup and recovery infrastructure, internal security-audit and oversight mechanisms, and a staff security-awareness and training programme.NIST CSF 2.0GV.PO-01
- Name a person responsible for information security and stand up a team dedicated to detecting and responding to security incidents.NIST CSF 2.0GV.RR-02
- If you are part of the Public Administration or the Private Sector at large, rather than one of the specifically named operator categories, also name an internal cybersecurity auditor, adopt an institutional information-security policy, and establish an institutional computer security incident response team (CSIRT).NIST CSF 2.0GV.RR-02NIST CSF 2.0GV.PO-01
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 76's own sanctions for this Law's contraventions are administrative fines rather than a criminal penalty, though its introductory clause leaves room for a more serious penalty under separate criminal legislation for the same conduct.
Who enforces it
Enforcement body
Autoridade Nacional de Segurança Cibernética (National Cybersecurity Authority), empowered by Article 11(b) to regulate, supervise, oversee, and impose sanctions in the field of cybersecurity.
Settledness
No court decision or regulator guidance construing these articles has been published yet; the Law's own implementing regulation is still pending.
- As of
- Open questions
- What specific technical and organisational measures will satisfy Article 48's minimum-security-requirements list, given that Article 79(2) leaves the Council of Ministers 180 days from publication to issue the implementing regulation?
What this law does
Articles 47 through 50 of Mozambique's Cybersecurity Law (Lei n.º 13/2026) set minimum cybersecurity requirements binding every entity the Law covers, with no sector or size gate, and Article 50 restates the duty specifically for the Public Administration and the Private Sector at large.
A covered entity must maintain an information-security policy, a cyber-risk-management methodology, incident-notification procedures, risk-prevention and mitigation mechanisms, backup and recovery infrastructure, internal security-audit and oversight mechanisms, a staff security-awareness programme, a named person responsible for information security, and an incident detection-and-response team, and the Public Administration and the Private Sector must additionally name an internal cybersecurity auditor and establish an institutional computer security incident response team (CSIRT).
Breach of these requirements is punishable by a fine of 90 to 160 times the minimum public-service wage.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .