National Cybersecurity Law (2025)

National Cybersecurity Law (2025) (Federal Republic of Somalia); no law number located

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sector security regimes rule binding public and private bodies.

As of 20 September 2026.

What it requires

This duty reaches your service only where the National Communications Authority has designated your systems as Critical Information Infrastructure; the Authority names telecommunications, financial services, energy, water, transportation and government digital systems as the covered sectors, and the located text does not state the designation criteria or process.
As a designated Critical Information Infrastructure operator, meet the cybersecurity standards the National Communications Authority sets and comply with its incident reporting obligations; the located text does not state a reporting clock, a reporting threshold, or a penalty for a missed report.
If you provide cybersecurity services, or work as a cybersecurity professional, in Somalia, hold a current National Communications Authority licence or registration before operating.

Who enforces it

Enforcement body

The National Communications Authority, designated by the Law as the highest government authority responsible for the governance and management of Somalia's cybersecurity

What it reaches

Obligation class

Security, Reporting, Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Law designates the National Communications Authority as Somalia's highest cybersecurity governance authority. It directs the Authority to identify and designate Critical Information Infrastructure across the telecommunications, financial services, energy, water, transportation and government digital-systems sectors, and requires a designated operator to meet the cybersecurity standards the Authority sets and to comply with the Authority's incident reporting obligations.

It separately requires a cybersecurity company or a cybersecurity professional operating in Somalia to hold a National Communications Authority licence or registration. The Law's designation criteria, its incident reporting clock and threshold, and its penalty provisions were not located in the primary text, so they are not stated here.

When LexLint raises it

operates_essential_service
provides_telecom_services
provides_financial_services

Read the law

National Communications Authority, official description of the Cybersecurity Department's mandate under the Law
the Law's own numbered text was not located

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app