TanzaniaComputer Emergency Response Team Regulations, Cyber Security Duties of Service Providers
Electronic and Postal Communications (Computer Emergency Response Team) Regulations 2018 (GN No. 60 of 2018), regs. 8 and 9 as amended by GN No. 570 of 2023
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a service provider, meaning a person licensed to provide electronic communication services (regulation 8), and an application service licensee (regulation 9(1)), with the added duties of regulation 9(2) falling on a national application service licensee (reached by declaring that you provide telecommunications services). Government Notice No. 60 was published on and the 2023 amendment on .
- Provide a secure environment for the connectivity of your subscriber base by maintaining updated systems that have a protection mechanism against information security threats (regulation 8(a)).
- Establish and maintain internal processes to handle the cyber security attacks that may endanger the security of the cyber space or the usability of your communication services and network, and collaborate and cooperate with the national CERT in incident handling (regulation 8).
- Abide by the CERT guidelines and directives that the Authority prescribes from time to time, and disconnect a subscriber from the network where the national CERT proves that the subscriber endangers the security of the cyber space, under the CERT's predefined guidelines (regulation 8).
- Maintain up to date and reliable mechanisms for identifying the sources of malicious traffic in your incoming and outgoing traffic, and filter the traffic you identify as malicious (regulation 9(1)).
- If you are a national application service licensee, maintain cybersecurity personnel for cyber incident response, and perform vulnerability assessment and penetration testing of your network, systems and applications at least twice a year (regulation 9(2)(a) and (b)).
- If you are a national application service licensee, perform security testing before any system or application moves into production, fix the vulnerabilities you identify by applying patches or secure configuration, and conduct a cyber security risk assessment at least twice a year while maintaining an updated risk register (regulation 9(2)(c), (d) and (k)).
- If you are a national application service licensee, put in place documented security policies and procedures to mitigate all known risks associated with your services, and take all required security measures to guarantee the confidentiality, integrity and availability of your network, systems and services for the entire duration of the licence (regulation 9(2)(h) and (j)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Regulation 13(1), renumbered regulation 17 by the 2023 amendment, makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Electronic and Postal Communications Act, and regulation 13(2) lets the Director General compound the offence by collecting a sum not exceeding the fine prescribed for it.
Who enforces it
Enforcement body
The Tanzania Communications Regulatory Authority, within whose structure the National CERT is established as a unit.
Settledness
- As of
- Open questions
- What is the amount of the fine that the Electronic and Postal Communications Act prescribes for a contravention of these Regulations under regulation 13(1)?
- Do the Computer Emergency Response Team (Amendment) Regulations, 2025 (Government Notice No. 56 of 2025) change any of the duties described here?
- Who is a national application service licensee for the purposes of regulation 9(2), given that the Regulations do not define the term?
What this law does
Government Notice No. 60, published on , makes the Regulations under section 165 of the Electronic and Postal Communications Act (Cap. 306). Government Notice No. 570, published on , amends the Regulations. Government Notice No. 56, published on , amends the Regulations again. Regulation 2 applies the Regulations to electronic communication operators, internet service providers and users.
Regulation 3 defines a service provider as a person licensed to provide electronic communication services. Regulation 8(a) requires a service provider to provide a secure environment for the connectivity of its subscriber base by maintaining updated systems that have a protection mechanism against information security threats.
Regulation 8 also requires a service provider to establish and maintain internal processes to handle various cyber security attacks that may endanger the security of the cyber space or the usability of the communication services and the communication network.
Regulation 9(1) requires the constituencies and application service licensees to maintain up to date and reliable mechanisms for identifying the sources of malicious traffic from the incoming or outgoing traffic and to filter such traffic that it has identified as malicious traffic.
Regulation 9(2), added by the 2023 amendment, requires a national application service licensee to perform vulnerability assessment and penetration testing of its network, systems and applications at least twice a year. Regulation 9(2) also requires a national application service licensee to conduct a cyber security risk assessment at least twice a year and maintain an updated risk register.
Regulation 13(1) makes any contravention of the Regulations an offence punishable on conviction by a fine prescribed under the Act. Regulations 12, 13 and 14 were renumbered as regulations 16, 17 and 18 by the 2023 amendment.
When LexLint raises it
When your app profile says your app provides telecom services.