DNSSI Morocco: what the DGSSI national information security directive requires (2023 version)

The short answer: the DNSSI (Directive nationale de la sécurité des systèmes d’information, Morocco’s national information security directive) is the baseline of minimum security rules set by the DGSSI. Its current version, dated 12 January 2023, applies to central government bodies, public institutions and companies, local authorities and all critical infrastructure (IIV), whether public or private. It also covers the suppliers and subcontractors who work on their systems. It spans 14 areas, from security policy to business continuity, and requires a compliance schedule followed by an annual review.

This guide sums up what the text actually requires, rule by rule for the most demanding ones, and sets out a compliance method. Every obligation quoted here comes from the text published by the DGSSI on dgssi.gov.ma; we add no figure that is not in it. At ALLSAFE SOLUTIONS, we support this work as part of our business cybersecurity services in Morocco.

The DNSSI at a glance: origin and legal position

Milestone	What the official source says
First version	Put into effect on 10 March 2014 by circular no. 3/2014 of the Head of Government
Current version	Updated by the DGSSI, document dated 12 January 2023 (circular no. 2/2023)
Legal basis	Law no. 05-20 on cybersecurity and article 9 of decree no. 2-21-406
Origin	The 2014 version drew on the Moroccan standard NM ISO/CEI 27002:2009
Structure	14 chapters and 31 security objectives, broken down into coded rules
Tracking tool	Compliance assessment tool published by the DGSSI (spreadsheet)

The DNSSI does not replace the law: it puts it into practice. Morocco’s cybersecurity Law 05-20 sets the general obligations (CISO, incident reporting, classification, audits of sensitive systems); the DNSSI turns them into concrete organisational and technical rules. The preamble is explicit: this baseline “should not be considered sufficient”, and each organisation must also rely on the DGSSI’s guides and frameworks.

Who it applies to, including the private sector

The 2023 text covers two groups:

• “entities” as defined by Law 05-20: central government bodies, local authorities, public institutions and companies, and other public-law legal persons;
• critical infrastructure (IIV), whether public or private.

The point that matters most for SMBs is elsewhere. The directive applies to every natural or legal person working on the information systems of entities and IIVs, staff and third parties alike, including suppliers, subcontractors and their employees. A software vendor, a managed service provider, a network integrator or a telephony supplier working for a public institution or an IIV is therefore bound, by contract, to follow its client’s security policy. The “Supplier relationships” chapter also calls for security and service-level clauses, plus audit and reversibility clauses.

For a private company outside these groups, the DNSSI is still an excellent free framework, written for the Moroccan context. It is often a better starting point than a foreign control catalogue.

The directive’s 14 chapters

Chapter	Example rules (codes from the text)
Information security policy	Risk analysis (POL-RISQUE), policy approved by management (POL-FORMEL), action plan, dashboard
Security organisation	Governance, CISO appointment, roles and segregation of duties, secure remote work
Human resources security	Background checks for sensitive roles, regular training, leaver process
Information asset management	Inventory, owners, acceptable use policy, IT map, classification, removable media, laptops
Access control	Named accounts, access rights matrix, annual rights review, privileged accounts, passwords
Cryptography	Usage policy, key management across the full lifecycle
Physical and environmental security	Zones, access control, CCTV, fire, cabling, UPS, air conditioning
Operations security	Change management, anti-malware, backups, logging, hardening, vulnerabilities, patches
Communications security	Segmentation, filtering, encrypted remote access, Wi-Fi, email
Acquisition, development and maintenance	Security in projects, secure development, testing, protection of test data
Supplier relationships	Risks, policy, contractual requirements, monitoring of services
Cybersecurity incident management	Procedures, categorisation, reporting, response, maCERT alerts, evidence
Business continuity	Business impact analysis, BCP/DRP, annual tests, crisis exercises
Compliance	Applicable legislation, Law 05-20, licences, Law 09-08, cryptography, regular audits

The rules that take the most work

In practice, written policies are rarely the problem. The gaps are in the technical rules that require tools and ongoing operations. These are the ones we most often see missing.

Centralised, retained logs

Rule EXP-JOURN/SURV-JOURNAL requires you to identify the logs to collect (servers, security and network devices, applications, workstations), centralise them, protect them against tampering and keep them for at least six months. Maintenance work must be logged and the records kept for at least three months. Clocks must be synchronised on a trusted NTP service, and the centralisation rule refers to the monitoring and detection capabilities required by Law 05-20. In practice, this means a log collector or an SMB-sized SIEM, and someone who reads the alerts.

Named accounts, access rights and privileges

Each user needs a unique ID, leavers’ accounts must be deleted or locked immediately, and an access rights matrix must describe everyone’s rights. Rights are reviewed at least once a year. Generic accounts are only allowed if approved, documented and inventoried. Administrator actions must be traceable, which rules out a shared “admin” account. For sensitive access, the text lists strong authentication among the expected mechanisms: see our MFA rollout guide.

Vulnerabilities and patches

The DNSSI requires a vulnerability management procedure based on the asset inventory, with roles, response times and remediation methods, and states that vulnerabilities deemed critical must be reported to the DGSSI. A patch policy tailored to each system completes the picture, along with configuration hardening (default passwords and certificates changed, unnecessary services closed). Our method is detailed in the patch management guide.

Encrypted, tested, off-site backups

For each system, the backup procedure states the type, frequency and media, and sensitive data is backed up encrypted. Restores are tested regularly following a documented procedure, and media are kept in a fire-resistant cabinet or moved to a site far enough from the main one. This is exactly the logic of the immutable 3-2-1 backup.

Segmented network and controlled remote access

The network must be split into zones (public, users, servers…) with strict, documented filtering between them. Only authorised devices may connect to the internal network. Remote access goes through encrypted tunnels with appropriate authentication, and Wi-Fi is segmented behind a gateway that logs access. That is the job of a well-configured firewall, like those we deploy as a Fortinet integrator in Morocco.

Incidents and maCERT alerts

Procedures must cover every type of incident, classify incidents by impact, ensure reporting to the competent authorities and organise the response. When an alert comes from the DGSSI’s maCERT, the entity acknowledges it and, if affected, sends back an execution report. An incident register and an evidence-collection procedure complete the chapter. Our first-hour incident response plan gives a template.

Business continuity

The DNSSI requires a business impact analysis (BIA), a BCP/DRP describing everyone’s role, an annual technical test plan and regular crisis exercises. The difference between the two plans is explained in our article on BCP vs DRP.

Schedule and review: how to get compliant

The text sets out the method: a compliance schedule, drawn up no later than six months after publication, separating immediate, short-term and medium-term measures; then an annual review using the DGSSI assessment tool, sent to the DGSSI on request. Compliance is also checked during audits by the DGSSI or by auditors it has qualified.

This is the order we follow with an organisation starting out:

Step	Deliverable	DNSSI rules covered
1. Scoping	Scope, CISO appointed, governance	ORG-INTER-GOUV, ORG-INTER-RSSI
2. Inventory and mapping	Asset list (serial numbers, licences, versions), network diagram	ACTIF-RESP-INV, ACTIF-RESP-CARTO
3. Classification and risks	Asset classification, risk analysis	ACTIF-CLASSIF-INFO, POL-RISQUE
4. Self-assessment	DGSSI assessment tool completed, gaps listed	Whole directive
5. Immediate measures	Named accounts, MFA, tested backups, critical patches	Access control, operations
6. Short and medium-term measures	Centralised logging, segmentation, BCP/DRP, supplier contracts	Operations, communications, continuity, suppliers
7. Follow-up	Dashboard, annual review, regular audits	POL-TDB, CONF-REVU-SSI

Two tips straight from the text. First, deviations are accepted if they are properly justified: document every exception rather than hiding it. Second, the DNSSI points to other texts you must handle in parallel, in particular Law 09-08 and the CNDP for personal data, and an IT acceptable use policy signed by users, which rule ACTIF-RESP-CHARTE makes mandatory.

DNSSI, ISO 27001 and audits: how they fit together

The three approaches complement each other:

• the DNSSI sets the minimum rules expected in Morocco within its scope;
• ISO 27001 adds a management system and a certification recognised by clients and foreign partners (see ISO 27001 for SMBs in Morocco);
• an audit measures the real technical gap and feeds the action plan (see security audit and penetration test).

An organisation serving the public sector or an IIV is better off mapping its controls once and linking them to both frameworks, rather than running two separate projects.

What ALLSAFE SOLUTIONS can take on

As a managed service provider based in Casablanca, we mostly handle the technical and operational side, the part that needs continuous follow-up: inventory and mapping, hardening, accounts and MFA, firewalls and segmentation, tested backups, logging and 24/7 monitoring, patch management, alert handling. We also prepare the evidence you will give your public-sector or IIV clients when they ask you to prove your compliance as a supplier. With our managed IT services in Morocco, critical incidents are handled in under 15 minutes.

To find out where you stand against the DNSSI, start with an assessment: we offer a free initial audit, with a reply within 24 business hours. Contact us.