Morocco's Law 05-20 on Cybersecurity: Obligations and Skills

Law No. 05-20 on cybersecurity was enacted in July 2020. It is Morocco's first statute dedicated specifically to information systems security. Before it, most rules came from regulations and from frameworks such as the DNSSI. The law gives those requirements a legal footing, specifies who must apply them and empowers a national authority to check compliance.

It is supplemented by an implementing decree (Decree No. 2-21-406, adopted in 2021), which sets out how the obligations apply to each category of entity, and by decisions and frameworks issued by the national authority. In practice, you need to read the law together with its decree and the DGSSI's technical documents: that combination defines what an organization actually has to put in place.

The idea behind the text is straightforward: cybersecurity is no longer a purely technical matter left to each IT department, but a governance obligation, with named responsibilities, minimum measures, controls and penalties for non-compliance.

The General Directorate for Information Systems Security (DGSSI), which reports to the National Defence Administration, is the national cybersecurity authority referred to in the law. It drafts frameworks, supports the entities concerned, qualifies certain providers (security audit providers, for example) and monitors compliance.

maCERT, the national centre for monitoring, detecting and responding to cyberattacks, sits within the DGSSI. It is the operational contact when an incident occurs: it publishes vulnerability alerts, receives incident reports and can assist affected organizations. For any Moroccan security team, following its bulletins is basic hygiene.

The law does not apply uniformly to every company in the country. It primarily targets the public sector and organizations whose failure would have a serious national impact. Requirements vary by category, with critical infrastructure operators carrying the heaviest load.

Private companies outside these categories are not directly subject to the law. They are, however, often affected indirectly as suppliers or subcontractors of a covered entity that passes security requirements down through contracts. To know exactly whether your organization is covered, refer to the law, its decree and, if needed, ask the DGSSI.

Obligations fall into three groups: governance (who is accountable, under which policy), risk management and technical measures, and the relationship with the national authority (incident reporting, audits, inspections). Critical infrastructure operators face additional requirements, such as having sensitive systems approved before they go live and rules on where their sensitive data is hosted.

The law provides for penalties in case of non-compliance. Since amounts and conditions depend on the type of breach and the category of entity, check the law itself rather than figures quoted without a source.

The National Information Systems Security Directive (DNSSI), published by the DGSSI in 2013, is the reference catalogue of security measures for government bodies and critical infrastructure. It draws heavily on ISO/IEC 27002 and covers security organization, asset management, physical security, access control, operations, incident management and business continuity. An organization that has already built an ISO 27001 ISMS therefore has a strong basis for demonstrating DNSSI compliance.

Law 09-08 on the protection of individuals with regard to the processing of personal data has a different goal: protecting people's rights. It is overseen by the CNDP (the national data protection commission) and applies to any public or private organization processing personal data. Among other things, it requires filings with the CNDP and an obligation to secure the data being processed.

The two regimes complement each other: a single data leak can be both an incident to report under Law 05-20 and a personal data security failure under Law 09-08. That is why a single governance model works best, with the CISO and the data protection lead sharing the same registers, the same risk assessment and the same incident procedure.

Compliance with Law 05-20 is first and foremost an organizational project, but it also requires technical skills to detect and handle incidents. Few organizations have every profile in-house, so upskilling existing teams is often the most realistic route.

A pragmatic approach is to first check whether and in which category your organization falls under the law, then run a gap assessment against the DNSSI, appoint a security officer, formalize the incident reporting procedure and finally schedule audits. Each of these steps depends on trained people.

GATech offers training in Morocco for the certifications above, official exam included: ISO 27001 Lead Implementer from 17,900 MAD (5 days), CISM from 19,900 MAD (4 days), CISSP from 23,900 MAD (5 days), CND v3 from 15,900 MAD (5 days) and CySA+ from 12,900 MAD (5 days), in class or online.

This guide is provided for general information only and does not constitute legal advice. For an assessment of your situation, consult the official texts, the DGSSI or a qualified lawyer.