Cybersecurity regulation in Morocco (2026)

Morocco's primary cybersecurity statute establishes a risk-based framework requiring covered entities — state administrations, local authorities, public institutions, and critical-infrastructure operators — to implement security measures, conduct risk assessments, and maintain incident-response protocols. It also creates a classification system for sensitive information systems and government data.

Decree 2-21-406 (2021), issued under Law 05-20, formally designates the DGSSI as the national cybersecurity authority. DGSSI issues binding directives, conducts audits, coordinates incident response, and certifies security products and services.

Originally issued in 2014 and subsequently updated, the NDISS sets baseline technical and organisational security standards for all in-scope entities. Covered entities have six months from each published revision to produce a compliance schedule. The updated directive incorporates lessons from audits, incident management, and evolving threat intelligence.

In January 2023 the DGSSI published a formal cybersecurity incident-management framework prescribing a six-phase response cycle and specific reporting rules for covered entities. Breach notification to DGSSI is mandatory for public entities and critical-infrastructure operators under Law 05-20; mandatory notification to affected individuals is under legislative development.

Adopted by the Council of Ministers in November 2024 and published in Morocco's Official Bulletin, Decree 2-24-921 requires entities and critical-infrastructure operators that outsource sensitive information systems to cloud providers to use DGSSI-qualified providers. Level 2 qualification mandates that providers be Moroccan legal entities with all operational and administrative systems physically on Moroccan territory.

Morocco's national strategy, anchored in the Digital Morocco 2030 programme, prioritises governance strengthening, legal and institutional capacity, critical-infrastructure protection, and workforce development. The DGSSI recorded 879 cyberattacks in its latest annual report, including 109 critical incidents affecting finance, telecoms, and public administration, underscoring ongoing implementation priorities.