TanzaniaComputer Emergency Response Team Regulations, Security Duties of Constituencies and Users
Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018 (GN No. 60 of 2018), regs. 7 and 11 as amended by GN No. 570 of 2023
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a constituency of the National CERT, meaning the people or organizations the CERT is designed to serve or support (regulation 7), and a user of any computer or equipment with data processing capability (regulation 11), so it reaches any organisation that operates a system. Government Notice No. 60 was published on and the 2023 amendment on .
- Maintain a secure environment for your organization, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats (regulation 7(a)).
- Maintain your organization's Information Communication Technology and cyber security policy for information and computer security, and comply with the security standards, guidelines and minimum security specifications the national CERT recommends (regulation 7(b)).
- Engage licensed security penetration testers, and perform independent information security assessments at least once a year to know and apply remedial measures against your security weaknesses (regulation 7(h) and (i)).
- Protect your organization's domain names by applying secure protocols such as HTTPS and DNSSEC (regulation 7(k)).
- Establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, implement a disaster recovery plan for restoring services after a cybersecurity incident or disaster, and create and update a cybersecurity incidents register (regulation 7(l) to (n)).
- As a user of a computer or equipment with data processing capability, perform vulnerability assessment and penetration testing of your network, systems and applications, perform security testing before any system or application moves into production, and fix identified vulnerabilities by applying patches or secure configuration (regulation 11(b) to (d)).
- As such a user, put in place documented security policies and procedures to mitigate all known risks associated with the services you offer, run cyber security awareness for your customers, and monitor and comply with the security standards and guidelines the Authority provides (regulation 11(g) to (i)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulation 13(1), renumbered regulation 17 by the 2023 amendment, makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Electronic and Postal Communications Act, and regulation 13(2) lets the Director General compound the offence by collecting a sum not exceeding the fine prescribed for it.
Who enforces it
Enforcement body
The Tanzania Communications Regulatory Authority, within whose structure the National CERT is established as a unit.
Settledness
- As of
- Open questions
- What is the amount of the fine that the Electronic and Postal Communications Act prescribes for a contravention of these Regulations under regulation 13(1)?
- Do the Computer Emergency Response Team (Amendment) Regulations, 2025 (Government Notice No. 56 of 2025) change any of the duties described here?
- Which people and organizations has the national CERT recorded as its constituencies, and does regulation 11 reach an individual end user as well as an organisation?
What this law does
Government Notice No. 60, published on , makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on , amends the Regulations. Government Notice No. 56, published on , amends the Regulations again. Regulation 2 applies the Regulations to electronic communication operators, internet service providers and users.
Regulation 3 defines a constituency as the people or organizations that the CERT is designed to serve or support. Regulation 7 requires the constituencies to maintain a secure environment for their organizations, Internet connectivity and internal network by maintaining updated systems that have a protection mechanism against information and computer security threats.
Regulation 7 also requires the constituencies to maintain an organization's Information Communication Technology and cyber security policy for information and computer security. Regulation 7, as amended in 2023, requires the constituencies to engage licensed security penetration testers and to perform independent information security assessments at least once a year.
Regulation 7, as amended in 2023, also requires the constituencies to establish, adopt and maintain policies, processes and procedures for managing cybersecurity incidents, to implement a disaster recovery plan and to create and update a cybersecurity incidents register.
Regulation 11, as substituted in 2023, requires a user of any computer or equipment with data processing capability to perform vulnerability assessment and penetration testing of its network, systems and applications and to fix the identified vulnerability by applying patches or secure configuration. Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.