MozambiqueCybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure
Lei n.º 13/2026, arts. 57 a 66
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Disclosure
What it requires
- It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.
- Notify your sectoral computer security incident response team (CSIRT) and the National CSIRT of a cybersecurity incident with a significant impact, judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself, and file a monthly report on your response and resolution.NIST CSF 2.0RS.CO-02NIST CSF 2.0RS.CO-03
- If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content.NIST CSF 2.0RS.CO-02
- If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 76's own sanctions for this Law's contraventions are administrative fines rather than a criminal penalty, though its introductory clause leaves room for a more serious penalty under separate criminal legislation for the same conduct.
Who enforces it
Enforcement body
Autoridade Nacional de Segurança Cibernética (National Cybersecurity Authority), empowered by Article 11(b) to regulate, supervise, oversee, and impose sanctions in the field of cybersecurity.
Settledness
No court decision or regulator guidance construing these articles has been published yet; the Law's own implementing regulation is still pending.
- As of
- Open questions
- What notification deadline, in hours or days, will the National Cybersecurity Authority set for a significant incident, given that Articles 58 through 64 each defer the clock to a deadline the Authority determines rather than fixing one in the Law itself?
What this law does
Article 57 defines a cybersecurity incident of significant impact by five alternative tests: its assessed severity, whether it stops an essential service beyond its maximum tolerable outage, whether it disrupts another essential-service provider, whether it requires an extraordinary remediation measure, or whether it harms a critical infrastructure's own users.
Articles 58 through 64 require the Public Administration and Private Sector at large, and separately the critical-infrastructure, essential-service, digital-service, digital-intermediary-service, data-centre, and cloud-computing-platform categories, to notify such an incident to their sectoral computer security incident response team (CSIRT) and the National CSIRT within a deadline the National Cybersecurity Authority sets rather than the Law itself, and to file a monthly report on the incident's causes, resolution time, and measures taken; a data-centre or cloud-platform operator must also notify its own subscribers of an incident affecting their content.
Article 66 gives a good-faith safe harbour to a person who discloses a security vulnerability, provided among other conditions that they give at least 90 calendar days' notice before publishing it. Breach of the notification duty is punishable by a fine of 80 to 100 times the minimum public-service wage.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .