You regularly read that “law 05-20 requires a cybersecurity audit of every Moroccan company”. That is inaccurate, and the confusion pushes company directors to buy services they do not need, while neglecting the ones that genuinely concern them.
Law 05-20: who is actually targeted
Promulgated by dahir of 25 July 2020, law 05-20 on cybersecurity is part of the national strategy led by the Direction générale de la sécurité des systèmes d’information, attached to the National Defence Administration.
Its scope is precise: state administrations, public bodies, vital infrastructure and digital operators such as access providers, hosting companies and cybersecurity providers. The sectors concerned are energy, water, transport, banking and telecommunications.
In practical terms: if your SME does not belong to those categories and does not supply a critical service to an entity that does, law 05-20 does not require an audit of you. It concerns you indirectly if you are a subcontractor to a vital operator, since that operator will pass on its own requirements.
Law 09-08: the one that really applies to you
This is the text most SMEs overlook even though it applies to them. Law 09-08 on the protection of individuals with regard to the processing of personal data, promulgated in February 2009, applies to any organisation that collects or processes personal data.
Customer file, prospect database, personnel records, video surveillance recordings, badge data: all of it falls within scope. The supervisory authority is the Commission nationale de contrôle de la protection des données à caractère personnel.
The main obligations are declaring processing operations to the commission, which is free and done online, informing the people concerned, and putting proportionate security measures in place.
The penalties are not theoretical
Beyond administrative measures — warning, formal notice, suspension of processing — the law provides for criminal penalties aimed at the company director personally, with prison terms and fines that can reach several hundred thousand dirhams depending on the nature of the offence.
An important point: the authority has shifted its doctrine. After a long period focused on awareness, it now runs targeted sector campaigns with compliance deadlines attached.
The measures that genuinely count for an SME
Independently of any obligation, here is what actually protects a mid-sized company, in order of effectiveness against cost.
1. Tested backups
A backup that has never been restored is not a backup. The proven rule remains three copies, two different media, one copy off site. And a real restore test at least twice a year.
2. Two-factor authentication
On business email and remote access as a priority. It is the measure that blocks the largest proportion of intrusions for the lowest cost.
3. Access rights management
Each employee has access to what they need, nothing more. And the accounts of people who have left are disabled on the day of departure, not the following quarter.
4. Updates
Most intrusions exploit known flaws that have been patched for months. An update schedule beats an expensive tool.
5. Awareness
Phishing remains the leading vector. A short session, repeated twice a year, produces more effect than any technical configuration.
Frequently asked questions
Does my SME have to run a cybersecurity audit?
Legally, no, unless you fall under vital infrastructure or digital operators. Commercially, an audit may be required by a client. Technically it is useful, but it is not the first expense to commit to.
Do we have to declare our customer database?
Yes. Any processing of personal data must be declared to the supervisory authority, and the procedure is free of charge.
Does video surveillance of the premises count?
Yes, images of identifiable people are personal data. That means a declaration, visible notice to the people filmed and a limited retention period.
What should we do in a ransomware attack?
Isolate the affected machines without switching them off, preserve the evidence, do not pay, and restore from an offline backup. Paying guarantees nothing and marks you as a receptive target.
How we help
Systomap runs security audits, sets up backups and strong authentication, and supports compliance work on data processing. See our services or write to us.
