Law 05-20, DNSSI & Law 09-08 complianceCOMPLIANCE
Prove your security, with confidence.
We support you towards compliance with Law 05-20, the DNSSI directive, Law 09-08 and the requirements of your regulators and clients.
What we hear
in the field.
Unclear obligations
Who falls under Law 05-20? What does the DNSSI require? What must be declared to the CNDP?
No CISO
Hiring an experienced security officer is slow and costly.
Audit after audit
Regulator, statutory auditor, foreign clients: each wants its own evidence.
What we take care of.
Moroccan regulation
- Law 05-20 and its implementing decree
- DNSSI directive of the DGSSI
- Law 09-08 and CNDP formalities
- BAM, ACAPS, AMMC directives
International standards
- ISO 27001 and 27002
- PCI DSS
- GDPR for European clients
- NIST CSF 2.0
Governance
- Security policy and charters
- Risk analysis (EBIOS)
- Record of processing activities
- Security indicators
Part-time CISO
- Running the security programme
- Security committee
- Relations with auditors
- Incident management and reporting
Three levels, tailored
to your scope.
Monthly subscription or fixed price, depending on the service.
Essential
- Gap assessment against 05-20 / DNSSI
- 09-08 and CNDP review
- Roadmap
- Fixed-price engagement
Business
- Part-time CISO (2 days / month)
- Security policy and risk analysis
- CNDP formalities
- Quarterly committee
Premium
- vCISO (4 days / month and more)
- ISO 27001 readiness
- Audit management
- Full compliance file
How we work.
Assessment
Gaps against the applicable texts.
Roadmap
Prioritised, costed actions.
Compliance work
Documents, measures, formalities.
Evidence
Audits, indicators, improvement.
What you receive.
Who it is for, in practice.
Insurer
Compliance with ACAPS requirements.
Infrastructure operator
Law 05-20 programme run by a Cyberacore vCISO.
Offshoring company
ISO 27001 readiness required by a European client.
Typical scenarios, shown for illustration.
Your questions,
our answers.
What is COMPLIANCE?
COMPLIANCE is the “Compliance & governance” offer from Cyberacore, a cybersecurity entity based in Casablanca. We support you towards compliance with Law 05-20, the DNSSI directive, Law 09-08 and the requirements of your regulators and clients.
What does COMPLIANCE include?
COMPLIANCE covers four areas: Moroccan regulation (Law 05-20 and its implementing decree, DNSSI directive of the DGSSI), International standards (ISO 27001 and 27002, PCI DSS), Governance (Security policy and charters, Risk analysis (EBIOS)) and Part-time CISO (Running the security programme, Security committee).
What are the service levels of COMPLIANCE?
Three levels, on a monthly subscription or at a fixed price: Essential (Gap assessment against 05-20 / DNSSI, 09-08 and CNDP review); Business (Part-time CISO (2 days / month), Security policy and risk analysis); Premium (vCISO (4 days / month and more), ISO 27001 readiness).
How does a COMPLIANCE project start?
In four stages: Assessment (Gaps against the applicable texts), Roadmap (Prioritised, costed actions), Compliance work (Documents, measures, formalities) and Evidence (Audits, indicators, improvement). The Cyber Score Express helps frame the need beforehand.
Let’s talk about your
information system.
Two assessments to take stock: a concrete review, presented by our experts.