Cybersécurité: ce que prévoit la nouvelle loi pour les entreprises et les infrastructures critiques
Senegal is strengthening its legal framework for cybersecurity. Invited to the program "RTS Viewpoint," Colonel Aly Mime, Director General of Cryptography and Information Systems Security, discussed the evolution of the Senegalese legal framework and the new obligations imposed on public and private actors.
According to him, Senegal had already taken a certain lead in this area with several texts adopted since 2008, particularly on the protection of personal data, information systems security and cryptography. "Senegal started in 2008 with its legal instrument to address cybersecurity issues," he explains.
The official points out, however, that over the years, several measures were essentially based on recommendations or circulars, without any real binding character.
The creation of new specialized structures has gradually strengthened the system. In particular, the Directorate of Cybersecurity and Information Systems Security (DCSC) was established to contribute to the protection of national information systems and the deployment of operational mechanisms such as the national CERT.
With the new law, the objective is now to move from recommendations to actual obligations.
“Decrees allow for the organization of the administration, but it is laws that allow for the creation of obligations and sanctions for the private sector, the public sector, and the administration,” explains Colonel Aly Mime.
What are the obligations for companies?
The new legislation concerns all entities that implement and operate information systems.
The obligations mentioned include the appointment of an information systems security officer, the development of a security policy, the implementation of a business continuity and disaster recovery plan, the protection of sensitive data, and the performance of security audits.
The entities concerned will also have to notify cybersecurity incidents. In the event of a personal data breach, they will also have an obligation to inform the individuals concerned.
A strengthened regime for critical infrastructure
The law also provides for a specific regime for critical information infrastructure. These are systems whose interruption could have serious consequences on the functioning of the State or on essential services to the population.
These infrastructures will be subject to stricter requirements: implementation of a cybersecurity program, SOC-type monitoring systems, regular audits and notification of incidents to the national cybersecurity authority. For certain critical infrastructures, incidents must be reported within 24 hours.
Why do some infrastructures remain secret?
Colonel Alimim explains that the precise list of systems considered critical cannot be made public for security reasons.
"We cannot say that such and such an entity is a critical infrastructure," he explains, stressing that this classification falls under the jurisdiction of the national cybersecurity authority.
However, some sectors are considered particularly sensitive, notably defense, public safety, justice and certain central administrations. Other sectors, such as water, telecommunications, electricity or civil status, will be specifically identified as part of the implementation of the law.
A new phase dedicated to identification
According to the Director General of Cryptography and Information Systems Security, Senegal has now entered a new phase: the concrete implementation of the law. Various sectors will have to identify systems likely to be classified as critical. Once an entity is notified, it will have specific deadlines to implement its cybersecurity program and deploy the required monitoring systems.
It will also need to provide for regular audits, with periodic internal controls and external audits.
For Colonel Aly Mime, the logic is simple: a system is considered critical when an interruption in its operation is likely to have "serious impacts for the State" or to disrupt an essential service.
Commentaires (4)
Prenons un exemple très récent : de l'achat de CAPACITÉS EN BANDE PASSANTE SATELLITAIRE SUR ONEWEB-EUTELSAT par le Sénégal.
Contrairement au réseau satellitaire Starlink, qui utilise des liaisons laser inter-satellites pour répartir la bande passante entre ses satellites en orbite terrestre basse (LEO), le service OneWeb d'Eutelsat nécessite des stations au sol réparties dans le monde entier pour capter la bande passante des câbles sous-marins et la relayer vers les satellites. C'est précisément ce qui semble avoir été mis en place à Gandour, au Sénégal, un petit village situé à quelques kilomètres seulement de la côte, au large de Dakar. Dakar constitue un point de convergence pour une douzaine de câbles sous-marins — dont certains parmi les plus modernes et performants au monde, tels que 2Africa (Meta), MainOne et Equiano (Google), aux côtés de câbles plus anciens toujours en service. Comment, dès lors, justifier l'affirmation selon laquelle cette initiative viserait à accroître la bande passante satellitaire du Sénégal dans le cadre d'un « New Deal technologique » ? Il est déconcertant — et difficile à accepter — d'entendre de telles absurdités destinées à bercer les Africains d'un faux sentiment de sécurité. Doit-on croire que l'État sénégalais investit (via sa participation au capital d'Orange SN/SONATEL) dans des capacités de bande passante satellitaire alors que celles-ci sont déjà largement disponibles juste sous ses pieds à Gandour, grâce aux câbles sous-marins situés au large de Dakar ? Par conséquent, contrairement aux annonces officielles, nous avons affaire ici à une station relais clandestine de OneWeb ; le réseau OneWeb-Eutelsat devrait verser une somme substantielle à l'État
Participer à la Discussion
Règles de la communauté
💡 Astuce : Utilisez des emojis depuis votre téléphone ou le module emoji ci-dessous. Cliquez sur GIF pour ajouter un GIF animé. Collez un lien X/Twitter, TikTok ou Instagram pour l'afficher automatiquement.
Se connecter
Commentez avec votre profil, votre photo, et soyez averti des réponses.