LexLint.ioBeta

Know the law your code answers to.

Law / Mozambique

Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers

Lei n.º 13/2026, arts. 51 a 56

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

What it requires

  • It reaches you if you operate as a critical-infrastructure network operator, an essential-service network operator, a digital-service provider, a digital-intermediary-service provider, a data-centre operator, or a cloud-computing-platform operator under Articles 51 through 56.
  • Take technical and organisational measures proportionate to the risk your networks and information systems face, covering the security of your systems, infrastructure, and premises, incident handling, business-continuity management, ongoing monitoring, auditing, and testing, and conformity with applicable international standards.NIST CSF 2.0GV.PO-01
  • If you are a private critical-infrastructure operator, additionally establish an institutional computer security incident response team (CSIRT).NIST CSF 2.0GV.RR-02
  • If you operate a data centre or a cloud-computing platform, additionally give your subscribers a summary of your business-continuity, disaster-recovery, and risk-management rules and policies.NIST CSF 2.0GV.OC-04

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • GV.OC-04Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated
  • GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
  • GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.2Compliance monitoring
  • 3.2Monitoring and logging
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 76's own sanctions for this Law's contraventions are administrative fines rather than a criminal penalty, though its introductory clause leaves room for a more serious penalty under separate criminal legislation for the same conduct.

Who enforces it

Enforcement body

Autoridade Nacional de Segurança Cibernética (National Cybersecurity Authority), empowered by Article 11(b) to regulate, supervise, oversee, and impose sanctions in the field of cybersecurity.

Settledness

No court decision or regulator guidance construing these articles has been published yet; the Law's own implementing regulation is still pending.

As of
Open questions
Which specific operators will the Government designate as Critical Infrastructure or Essential Service providers under Articles 51 and 52, given that the Law defines the categories but leaves their membership to further Government action?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Articles 51 through 56 of Mozambique's Cybersecurity Law layer sector-specific security-measure duties onto six categories the Law defines: critical-infrastructure operators, essential-service operators, digital-service providers, digital-intermediary-service providers, data-centre operators, and cloud-computing-platform operators, each required to take technical and organisational measures proportionate to the risk their networks and information systems face.

A private critical-infrastructure operator must additionally establish an institutional computer security incident response team (CSIRT), and a data-centre or cloud-computing-platform operator must safeguard the integrity, confidentiality, and availability of the data it stores. Breach of these requirements shares the same fine as Articles 47 through 50: 90 to 160 times the minimum public-service wage.

When LexLint raises it

When your app profile says your app operates a social platform, distributes a software product or runs an essential service.

Back to the example  ·  Lint your app

Page updated .