TogoCybersecurity Rules for Operators of Essential Services
Arrêté N°2022-040/PMRT du 29 juin 2022 portant adoption des règles de cybersécurité en République togolaise (Règles de Cybersécurité, version 1.0)
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an operator of essential services (opérateur de services essentiels, OSE) that ANCy has designated under decree n°2019-095/PR, for each essential infrastructure it operates; you are reached by declaring that you operate an essential service.
- Comply with the Cybersecurity Rules, which cover the governance, protection, defence and resilience of your networks and information systems.
- Establish a documented cybersecurity policy approved by your board or chief executive, send ANCy the supporting cybersecurity policies the Rules list, and review them annually and when significant changes occur (Rules G2.1.1 to G2.1.3).
- Send the contact details of your information-systems security manager, or of your cybersecurity point of contact, to your sectoral supervisory authority, to ANCy and to its delegate within six months of being notified of your designation, and after each update (Rule G1.1.6).
- Send ANCy or its delegate the list of your essential personnel within three months of being notified of your designation, and after each update (Rule G5.2.4).
- Report information-security events as quickly as possible through the appropriate management channels (Rule D1.2.2).
- Put in place detection devices able to identify events characteristic of a security incident, archive the metadata of identified events for at least six months, and run for each essential infrastructure a logging, correlation and analysis system operating 24 hours a day, 7 days a week (Rules D1.3.1 and D1.3.2).
- Submit to the annual compliance control that ANCy's delegate carries out on the security measures of your operator security plan (plan de sécurité d'opérateur) for each essential infrastructure (section 4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
L'Agence nationale de la cybersécurité (ANCy), whose delegate Cyber Defense Africa carries out the annual control of operators of essential services.
Settledness
- As of
- Open questions
- What amounts and procedure apply to the astreintes and sanctions that ANCy may impose on an operator of essential services that does not comply with the Rules?
What this law does
Arrêté N°2022-040/PMRT of adopts the Cybersecurity Rules. Section 3 of the Rules provides that, under the OSE decree, an operator of essential services must comply with the Rules under pain of sanctions. Section 3 of the Rules states that the Rules are set by ANCy under Article 11 of the OSE decree. Section 1 of the Rules defines the OSE decree as decree n°2019-095/PR of on operators of essential services, essential infrastructures and the obligations attached to them.
Rule G2.1.2 requires the operator to establish and send ANCy a set of supporting cybersecurity policies. Rule G2.1.3 requires cybersecurity policies to be maintained, reviewed and updated annually and when significant changes occur. Rule G1.1.6 requires the operator to send the contact details of its information-systems security manager or cybersecurity point of contact to its sectoral supervisory authority, to ANCy and to its delegate within six months of the notification of its designation.
Rule G5.2.4 requires the operator to send ANCy or its delegate the list of its essential personnel within three months of the notification of its designation. Rule D1.3.1 requires the operator to put in place detection devices able to identify events characteristic of a security incident. Rule D1.3.1 requires the detection devices of an operator of essential services to archive the metadata of identified events for at least six months.
Rule D1.3.2 requires the operator to run, for each essential infrastructure, a logging, correlation and analysis system operating 24 hours a day, 7 days a week. Section 4 of the Rules provides for an annual compliance control of operators of essential services by ANCy's delegate.
When LexLint raises it
When your app profile says your app runs an essential service.