TunisiaDécret-loi n° 2023-17, Security Measures for Vital Digital Infrastructure Operators
Décret-loi n° 2023-17, Arts. 21-22
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a structure that manages a vital digital infrastructure and is on the list a decree fixes under article 21; you are reached by declaring that you operate an essential service.
- Use only software and equipment that carry the 'sécurisé' label (article 22).
- Keep your own main hosting center and a backup center with a cloud-computing provider that has obtained the label (article 22).
- Follow the measures and procedures needed to ensure business continuity and to protect sensitive databases in a cyber crisis, as set out in the procedures manual a decree approves on the minister's proposal (article 22).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Agence Nationale de la Cybersécurité (National Cybersecurity Agency).
Settledness
- As of
- Open questions
- Which structures has the decree under article 21 placed on the list of vital digital infrastructure managers, and has the decree approving the procedures manual under article 22 been issued?
- Articles 24 and 25 name the failures that draw a classification downgrade or a fine, and the Article 22 measures are not among those listed: what sanction follows a failure to take them?
What this law does
Article 3 of Décret-loi n° 2023-17 defines a vital digital infrastructure as information systems that house assets and services sensitive at the national level, whose stoppage or whose security disturbance could affect national security. Article 21 provides that the list of structures that manage vital digital infrastructures is fixed by decree. Article 22 requires the structures that manage vital digital infrastructures to use software and equipment that carry the 'sécurisé' label.
Article 22 requires those structures to have their own main hosting center and a backup center with a cloud-computing provider that has obtained the label. Article 22 requires those structures to follow the measures and procedures needed to ensure business continuity and to protect sensitive databases whose integrity breach could affect national security in a cyber crisis, according to a procedures manual approved by decree.
Article 30 of the décret-loi has its provisions enter into force six months after the date of its publication in the Journal officiel de la République tunisienne. The décret-loi was published in the Journal officiel n° 26 of .
When LexLint raises it
When your app profile says your app runs an essential service.