Morocco cybersecurity law 05-20: obligations for companies and the role of the DGSSI

The short answer: Morocco’s law no. 05-20 on cybersecurity, enacted on 25 July 2020 and supplemented by decree no. 2-21-406 of 15 July 2021, applies to three categories: public entities (state administrations, local authorities, public institutions and companies), critical infrastructure designated in sectors such as banking, energy, telecoms, health or transport, and operators (telecom operators, internet access providers, cybersecurity service providers, hosting providers, cloud providers, internet platforms). A private SMB outside these categories has no direct obligation except one: following the DGSSI’s directives if its system is used, without its knowledge, in an attack. In practice, public-sector clients and large accounts often impose the same requirements by contract.

This guide summarises, from the published texts, what the law requires of each category, how the decree classifies information systems, what the DGSSI does, and what an SMB should put in place even when not required to. It is not legal advice: for a specific case, reading the texts and consulting a lawyer remain essential.

The reference texts

Text	Purpose
Law no. 05-20 on cybersecurity (dahir no. 1-20-69 of 25 July 2020, Official Bulletin no. 6906)	Information systems security rules, national governance, obligations and penalties
Decree no. 2-21-406 of 15 July 2021	Designation of the DGSSI, system classification, CISO duties, critical sectors, provider qualification
National Information Systems Security Directive (DNSSI)	Organisational and technical rules set by the DGSSI, published on its website
Decree no. 2-24-921	Use of cloud service providers by public entities and critical infrastructure with sensitive systems
Law no. 09-08	Personal data protection, overseen by the CNDP (a separate text)

The law came into force with the publication of its implementing texts. Do not confuse it with law 09-08: one protects information systems, the other protects people’s data. We cover the latter in Morocco’s data protection law 09-08.

Who does law 05-20 apply to?

Public entities

The law uses “entity” for state administrations, local authorities, public institutions and companies, and any other legal person under public law. They carry the broadest set of obligations.

Critical infrastructure

These are the facilities and systems essential to the vital functions of society, health, security or the economy. The decree’s annex lists the sectors: public security, foreign affairs, finance, legislation, agriculture, health, industry, trade and the digital economy, broadcasting, energy, mining, transport, water, banking, telecommunications, insurance and social welfare.

The infrastructures themselves are designated by the authority coordinating each sector (for example Bank Al-Maghrib for banking, the ANRT for telecoms), after consulting the DGSSI. The list is kept secret: a company knows it is covered because it is notified, not by checking a public list. Critical infrastructure can be a private company.

Operators

The third group brings together public telecom network operators, internet access providers, cybersecurity service providers, digital service providers and internet platform publishers. The law explicitly counts hosting providers (datacentres) and cloud providers among digital service providers, alongside online marketplaces and search engines.

What about a typical SMB?

A firm, distributor, agency or industrial SMB that falls into none of these categories is not subject to the chapters on entities or critical infrastructure. Three situations change that:

1. You are a subcontractor to an administration, bank, insurer or operator: the contract often carries over the security policy, audits, incident reporting and hosting in Morocco.
2. You host or run a digital service for third parties: you may fall into the digital service provider category.
3. Your system is compromised and used as a relay for an attack: article 50 provides for a fine if you do not apply the DGSSI’s directives after being informed.

Obligations for public entities

Articles 3 to 13 of the law set a baseline that closely resembles a standard security programme:

Obligation	Article
Comply with the DGSSI’s directives and frameworks	3
Adopt an information systems security policy, assess risks, audit regularly	4
Audit the security of any system providing digital services to third parties before go-live	4
Classify information assets and systems, define access clearances	5
Appoint an independent information systems security officer (CISO)	6
Deploy monitoring and detection capabilities	7
Report incidents to the DGSSI as soon as they are known	8
Prepare and regularly test a business continuity or recovery plan	9
Ensure the provider follows DGSSI rules when outsourcing a sensitive system	10
Host sensitive data exclusively in Morocco	11
Govern the outsourcing of a sensitive system by a contract under Moroccan law (protection, auditability, reversibility, service levels)	12

The continuity plan is often the weakest point: we explain the two kinds of plan in business continuity vs disaster recovery plan.

Additional obligations for critical infrastructure

Critical infrastructure applies the whole baseline above, plus:

• Draw up the list of its sensitive information systems from a risk analysis and send it to the DGSSI, which can request changes (articles 17 and 18).
• Accredit each sensitive system before go-live, following the DGSSI’s guide: the person in charge attests to knowing the measures in place and accepts the residual risks (article 19).
• Undergo audits requested by the DGSSI, carried out by the DGSSI or by qualified audit providers, then submit a remediation action plan (articles 20 to 24).
• Use DGSSI-qualified providers when outsourcing cybersecurity services, and use the products or solutions defined by the authority (article 25).

The decree adds that the audited organisation keeps the audit report and its documents for at least three years.

Obligations for operators, hosting and cloud providers

Operators covered by the law must in particular:

• Retain the technical data needed to analyse an incident (connection logs, system and security product traces); the law sets this period at one year, which regulation may change (article 26).
• Inform their customers of vulnerabilities or breaches that could affect them (article 27).
• Notify the DGSSI without delay when they detect an event threatening their customers (article 30).
• For digital service providers, manage their risks to ensure service continuity and report incidents with a significant impact (articles 32 and 33). The DGSSI may inspect them (article 34).

For a client company, this has a practical consequence: your hosting provider, telecom operator and cloud provider have duties to inform you. Ask how they meet them, and where your data is hosted. We compare local options in hosting servers and backups in a Moroccan datacentre.

System classification under decree 2-21-406

The decree provides a precise method that is useful even without an obligation. You assess the impact an incident affecting the confidentiality, integrity or availability of each asset would have, on a four-level scale: very serious, serious, moderate, limited.

System class	Rule	Sensitive?
Class A	At least one possible incident with very serious impact	Yes
Class B	Impact serious at most	Yes
Class C	Impact moderate at most	No
Class D	Impact limited at most	No

Data is classified separately by confidentiality: “Top secret”, “Secret”, “Confidential”, “Restricted”. The first two levels constitute sensitive data, which must stay in Morocco. Classification must be reviewed at least every three years and after any significant change.

The decree also sets out the CISO’s duties: analyse risks, define security objectives and measures, steer the security policy and its action plan, follow up incidents, report to management and raise staff awareness.

The role of the DGSSI

The General Directorate of Information Systems Security is the national authority designated by the decree. Its missions, set by article 38 of the law, include:

• publishing the national information systems security directive and frameworks (classification, accreditation, incident management, outsourcing);
• qualifying audit providers and cybersecurity service providers, and publishing their list;
• carrying out or commissioning audits of sensitive systems;
• providing threat watch, detection and alerts, notably through maCERT, its incident response centre;
• publishing cyber hygiene advice for the private sector and individuals.

For an SMB, the DGSSI website is first a free resource: vulnerability bulletins, alerts and best-practice guides. In a serious incident, maCERT is a contact to know, as we point out in phishing in Moroccan SMBs: the scams to know.

Qualified providers: what to check

For critical infrastructure, regulatory audits and outsourced cybersecurity services (incident detection, analysis and handling) must be entrusted to DGSSI-qualified providers. The decree sets the criteria: a company under Moroccan law, a dedicated structure, qualified staff, detection services hosted and operated exclusively in Morocco, and stricter conditions for class A systems. Qualification is valid for three years at most.

If you are critical infrastructure, check that your provider appears on the list published by the DGSSI for the relevant domain and class. If you are not, nothing forces that choice, but the same criteria (hosting in Morocco, method, clear contract) remain a good yardstick. Our guide to security audits and penetration tests for SMBs describes how an audit unfolds.

Penalties

Articles 49 and 50 provide for fines, doubled for repeat offences, notably for:

• hosting sensitive data outside national territory;
• putting a sensitive system into operation without accreditation;
• using a non-qualified audit or cybersecurity provider, and providing those services without qualification;
• failing to report incidents;
• obstructing audits or inspections;
• refusing to apply DGSSI directives when a system was used, without its owner’s knowledge, to spread malware.

That last point is the one that most broadly affects private companies: an infected workstation or poorly protected server used as a relay for an attack makes you liable if you do not act once informed.

What an SMB should do, even without an obligation

Law 05-20 essentially describes a reasonable security approach. Here is how to translate it for an SMB, with proportionate means:

Requirement in the law	Pragmatic SMB equivalent
Security policy and CISO	A designated internal owner and a short policy approved by management
Classification	An inventory of critical data and systems, with their impact if stopped or leaked
Monitoring and detection	Up-to-date firewall, EDR on workstations and servers, 24/7 monitoring
Incident reporting	A written procedure: who to notify internally, at clients, at maCERT
Business continuity	3-2-1 backups with an immutable copy, tested restores, a written recovery plan
Hosting in Morocco	An informed choice of where data lives, especially for public-sector clients
Outsourcing contract	A contract with service levels, reversibility and audit rights
Regular audits	Audits at an interval set by management, and after every major change

For detection, see managed EDR and 24/7 monitoring; for backup, the 3-2-1 rule with an immutable copy; for identity, rolling out MFA. On contracts, our benchmarks are in the key clauses of a managed IT contract.

How we support companies

At ALLSAFE SOLUTIONS, we help Moroccan SMBs and organisations build this foundation: assessing the current state, pragmatic inventory and classification, drafting the security policy and incident procedures, deploying protection and monitoring. We work with solutions we partner with, such as Fortinet for firewalls, Kaspersky for endpoint protection and Veeam for backup. Our teams monitor systems 24/7 and handle critical incidents in under 15 minutes. For a regulatory audit of a critical infrastructure’s sensitive system, we refer you to a provider on the DGSSI list and prepare your system beforehand.

Discover our cybersecurity services in Morocco and our managed IT services in Morocco, then request your free initial audit: we reply within 24 business hours with an assessment and the priorities to address.