By December 1999- a Unit ( a “micro-CERT”) specialized in ICT Security was launched, with the objective to sensitize policy-makers and administrators of information systems, aftermath the Y2K bug, about computer security issues and to create the nucleus of a task-force of Tunisian experts, specialized in the field.

     From 2002 and after- the certification of the role of ICT security as a pillar of the emerging Information Society, this unit was in charge of starting the establishment of a national strategy and a national plan in ICT Security, after the realization of a national survey , which permitted to fix priorities and needed actions and logistic.

     By January 2003- the Council of Ministers, had taken the following decisions:

• The creation of a National agency, specialized in ICT Security (the National Agency for Computer Security), as the executive tool for the execution of the national strategy and plan in ICT security.
• The Introduction of a mandatory and periodic security risk assessment, which is one of the main pillars of our strategy .
• The creation of a “body of certified Auditors” in ICT Security,
• Moreover, a lot of other accompanying measures had been taken.(For example:the launch of a master degree in ICT security, …).

     From that historical decision and in addition to previous Laws (Law on electronic signature and e-commerce , Law on cyber-crimes, Law on protection of Privacy and Personal data), a new law related to ICT security was promulgated in February 2004 (Law N° 5-2004 and its 3 relatives decrees). This law promulgated the obligation for national companies (all public and big private companies) to do periodic (now annual) security audits of their Information systems, under the supervision of certified auditors from the private sector. The related decrees defined the process of certification of auditors and the process of audit.

     Concerning incident handling, this law promulgated the obligation to declare security incidents that could affect others national information systems, with the guarantee of confidentiality.

     This law also defined the missions of the National Agency for Computer Security (NACS), which was created under the ministry of communication technologies and which clearly does not deal with national security and defence concerns.

Related Decrees