Cybersecurity
Twenty-four hours
The proposed reporting deadline sounds simple. But can we detect incidents that fast?
A cybersecurity incident occurs.
Nobody yet knows exactly what happened. Teams need to preserve evidence, assess the scope, decide which systems to isolate and notify the right people.
Then one question begins to matter: how long do we have before we must report it?
Senegal's bill 25/2026 on critical information infrastructure includes a 24-hour incident notification requirement.
On paper, that's a line of text.
In an organisation without monitoring, clear procedures or assigned responsibilities, it can be a serious challenge.
A response to a real need
Senegal's National Assembly adopted bill 25/2026 on August 20, 2026, with 127 votes in favour and none against or abstaining.
The proposal available from public archives sets out a specific framework to protect systems and services classified as critical.
It aims to strengthen cybersecurity governance, incident reporting and oversight of sensitive infrastructure.
Important legal distinction: parliamentary adoption alone does not establish when every provision becomes enforceable. Promulgation, official publication and implementing regulations must be checked.
What stands out to me
The proposal includes:
- A national cybersecurity authority.
- Security programmes for critical infrastructure operators.
- Incident reporting duties.
- Monitoring and response capabilities, including security operations centres.
- Rules around hosting certain public-sector data.
- Oversight and sanctions.
These may be important developments. But a law does not secure a server merely by existing.
Effectiveness depends on resources, qualified teams, coordination and implementation.
Detecting versus discovering
An organisation that discovers a breach three weeks after the fact cannot promise to report it quickly.
To act within 24 hours, you first need to know an incident occurred.
That's why monitoring, useful logs, clear alerts and preparedness matter as much as the legal deadline.
Critical services also need continuity plans.
What organisations can prepare
Regardless of the final applicable framework, several practices are worthwhile:
- Identify services whose interruption would have the greatest impact.
- Document ownership and emergency contacts.
- Define detection, classification and escalation procedures.
- Test backups and recovery plans.
- Review privileged access and critical dependencies.
- Train teams to recognise and report unusual activity.
It sounds like an IT checklist, but it's also a leadership issue.
The question I keep asking
Senegal needs reliable digital systems, from major infrastructure to the services citizens use every day.
But publishing a text, achieving paperwork compliance and building operational security are not the same thing.
The better question isn't “Do we have a document?” It's “What can we actually do when something goes wrong?”
Editorial analysis of the proposal adopted on August 20, 2026. For binding requirements, consult officially published legal acts and implementing regulations.
