SomaliaSomalia Cybersecurity Act (2026)
Somalia Cybersecurity Act (2026) (Federal Republic of Somalia) approved by the House of the People of the Federal Parliament; no law number located
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Reporting, Licensing
What it requires
- If the Law is enacted as the House of the People approved it, this duty would reach your service only where the National Communications Authority has designated your systems as Critical Information Infrastructure; the Authority names telecommunications, financial services, energy, water, transportation and government digital systems as the covered sectors, and the Authority's description does not state the designation criteria or process.
- If the Law is enacted, a designated Critical Information Infrastructure operator would have to meet the cybersecurity standards the National Communications Authority sets and comply with its incident reporting obligations; the Authority's description does not state a reporting clock, a reporting threshold, or a penalty for a missed report.NIST CSF 2.0GV.OC-03NIST CSF 2.0RS.CO-02
- If the Law is enacted, you would need a current National Communications Authority licence or registration before providing cybersecurity services, or working as a cybersecurity professional, in Somalia.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The National Communications Authority, designated by the Law as the highest government authority responsible for the governance and management of Somalia's cybersecurity
What this law does
The House of the People of the Federal Parliament approved Somalia's Cybersecurity Law. The National Communications Authority's National Cybersecurity Compliance Framework refers to it as the Somalia Cybersecurity Act (2026). No notice of the Law's approval by the Upper House, its promulgation or its commencement has been located. As the Authority describes it, the Law designates the National Communications Authority as Somalia's highest cybersecurity governance authority.
It directs the Authority to identify and designate Critical Information Infrastructure across the telecommunications, financial services, energy, water, transportation and government digital-systems sectors, and requires a designated operator to meet the cybersecurity standards the Authority sets and to comply with the Authority's incident reporting obligations.
It separately requires a cybersecurity company or a cybersecurity professional operating in Somalia to hold a National Communications Authority licence or registration. The Law's own numbered text has not been located, so its designation criteria, its incident reporting clock and threshold, and its penalty provisions are not stated.
When LexLint raises it
When your app profile says your app runs an essential service, provides telecom services or provides financial services.
Back to the example · Lint your app
Page updated .