Cybersecurity · 6 September 2026 · 7 min read
Morocco's Law 09-08 and the CNDP: what companies must put in place
Declaring processing, securing data, contractors, transfers abroad: the concrete obligations of Law 09-08 and how IT answers them.
Industry
Finance & insurance
Secure, traceable IT worthy of the trust your clients place in you.
Lenders, brokers, insurance agencies and wealth managers handle sensitive personal and financial data every day. A poorly controlled login, a fraudulent e-mail or lost data can cost far more than the incident itself: the trust of your clients and your partners.
We build IT where every access is authenticated, every action is logged and every piece of data is backed up out of reach. We help you document these controls to meet Morocco’s Law 09-08 requirements and answer questions from partners or auditors.
The challenges in your industry
01
Highly sensitive client data
ID documents, statements, contracts: a leak can create liability under Law 09-08 and damages your reputation for the long term.
02
Payment fraud and phishing
Fake payment orders and impersonation of executives or clients: finance teams are a favourite target for attackers.
03
Traceability of access and actions
Who opened which file, from which device, at what time? Without reliable logs, you cannot answer an audit or investigate an incident.
04
Evidence of client conversations
Advice, policy sales and complaints often happen by phone. Without recording and archiving, disputes are settled with no evidence.
Our solutions for this industry
CybersecurityWe deploy next-generation firewalls, EDR on every endpoint and MFA on every login, with permissions limited to what each role actually needs.
Managed cloudWe harden Microsoft 365 with conditional access, anti-phishing protection, data loss prevention and e-mail archiving so every exchange stays on record.
IP TelephonyWe set up 3CX telephony with call recording, archiving and restricted access to recordings, so you keep evidence of client conversations.
Virtualisation & serversWe back up servers and data with Veeam following the 3-2-1 rule, including an immutable copy, and test restores regularly as part of a recovery plan.
Managed ITWe monitor your systems 24/7, centralise access and admin logs, and handle joiners, leavers and permission changes through a documented process, down to office access badges.
Our projects in this industry
Financial services company
3CX IP telephony for a financial services company
Modern telephony usable anywhere, delivered on time and certified by the client as compliant with the specifications.
Read the case studyPrivate institution
Access control: doors, locks and lift
Controlled, traceable access managed from a single point, with no hassle for authorised users.
Read the case studyUseful guides for you
Cybersecurity · 14 September 2026 · 1 min read
Rolling out MFA in an SMB: the five-step guide
Multi-factor authentication blocks most intrusions through stolen passwords. Where to start, what to protect first, and how to avoid a user revolt.
Cybersecurity · 16 September 2026 · 3 min read
Phishing in Morocco: the 8 email scams targeting SMBs in 2026
Fake supplier bank details, fake DHL, fake Microsoft, CEO fraud: the 8 phishing scenarios we see every week at our clients, and the habits that stop them.
Frequently asked questions
What does Morocco’s Law 09-08 require from a financial firm?
Law 09-08 governs the processing of personal data and is overseen by the CNDP. Among other things, it requires client data to be kept secure. We implement the technical controls (access, encryption, logging, backup) and help you document them; the legal side should be confirmed with your counsel.
How do we protect ourselves against payment fraud?
We combine MFA on e-mail, anti-phishing filtering, alerts on suspicious forwarding rules and staff awareness training. We also help you set up an out-of-band double check for any change to bank details.
Can client calls be recorded on an IP phone system?
Yes. 3CX can record calls per extension or per queue, archive them and restrict access to authorised people only. We also set up the caller notice and the retention period you choose.
How can we prove who accessed a client file?
We enable and centralise access logs across Microsoft 365, file servers and compatible applications, with named accounts protected by MFA. After an audit request or an incident, you can see who did what and when.
Is every access to your data really traced?
We audit the security and traceability of your IT systems free of charge.
Reply within one business day · Free initial audit · No commitment