TunisiaCybersecurity Incident Reporting and Emergency Response
Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
What it requires
- This duty runs to the same Article 6 population: telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises automatically processing their users' personal data over telecommunications networks, and state-designated vital digital infrastructure.
- Create your own cybersecurity emergency response center, or join a public, sectoral or private one, and have it coordinate with the national emergency-response contact point.NIST CSF 2.0ID.IM-04
- Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders.NIST CSF 2.0RS.CO-02NIST CSF 2.0RS.MI-01
- Where an incident or attack has disrupted your information system or communications network, or endangered the national cyberspace's security, remedy the failure within thirty days of the Agency's warning, or expect the minister of communication technologies to order the temporary isolation of your systems.NIST CSF 2.0RC.RP-02
- If you are classified at the first or second digital-trust level, expect a classification downgrade, rather than a fine, for failing to comply with an emergency measure or to create or join a response center.
- If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for the same failures.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.MI-01Incidents are contained
- RC.RP-02Recovery actions are selected, scoped, prioritized, and performed
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The décret-loi names only an administrative reclassification downgrade (art. 24) for a first- or second-level organization and a financial penalty (art. 25) for a third-level one as the sanctions for an emergency-response or reporting failure; article 23's referral of constated infractions to the Public Prosecutor is a general enforcement mechanism rather than a named criminal offence for this duty.
Penalty structure
Article 25: a fine of 50,000 to 100,000 dinars for an Article 6 organization classified at the third, unclassified level that fails to comply with an emergency measure, to remedy a failure within the article 17 deadline, or to create or join an emergency response center. A first- or second-level organization draws the article 24 classification downgrade instead of this fine for the same failures.
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- TND
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Agence Nationale de la Cybersécurité (National Cybersecurity Agency), through its designated national emergency-response contact point, and the ministre chargé des technologies de la communication (Minister of Communication Technologies) for the isolation, downgrade and financial-penalty decisions.
Settledness
- As of
- Open questions
- Article 17 lets the Agency warn an organization to remedy a disruptive incident within thirty days, but does not state what happens if that thirty-day remedy period and the ministerial isolation order under the same article run concurrently: can the minister isolate a system before the thirty days the Agency's own warning grants have run?
What this law does
Article 19 requires the same Article 6 population, telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises that automatically process their users' personal data over telecommunications networks, and vital digital infrastructure, to create its own cybersecurity emergency response center or to join a public, sectoral or private one, and to coordinate that center with the national emergency-response contact point Article 18 has the Agency designate.
Article 20 requires those organizations to immediately inform the national contact point or their emergency response center of any cybersecurity incident or attack, and to comply with the emergency measures either one orders.
Article 17 lets the Agency warn an organization whose incident or attack has disrupted its information system or communications network, or endangered the national cyberspace's security, to remedy the failure within thirty days, and lets the minister of communication technologies order the temporary isolation of its systems on the Agency's own reasoned report.
Article 24 lets the minister downgrade an organization classified at the first or second level, rather than fine it, for failing to comply with an emergency measure, to remedy a failure within the Article 17 deadline, or to create or join an emergency response center. Article 25 fines an organization classified at the third level 50,000 to 100,000 dinars for the same failures.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .