Ethiopia's Critical Infrastructure Cybersecurity Proclamation No. 1426/2026
A plain-language, article-referenced guide to what the proclamation says, when it applies and which details still depend on implementing directives.
A national system to identify, oversee and protect designated critical infrastructure.
INSA designates particular infrastructure. Being in a listed sector is not enough by itself.
Article 7 sets 18 duties covering governance, assets, risk, people, suppliers, monitoring, incidents and audit follow-up.
Published 21 July 2026; Article 28 points to entry into force on 21 July 2027.
Designation, licensing and operational details may be clarified by implementing directives.
Bottom line: use this guide to understand the framework, then confirm organization-specific questions with INSA or qualified Ethiopian counsel.
How an organization moves into the regime
Infrastructure operates in or supports a sector listed in Article 4.
INSA applies the criteria and assessment process in Articles 5 and 6.
The particular infrastructure is designated; sector membership alone is not a final decision.
The designated owner implements the Article 7 duties and applicable directions.
Navigation summary based on Articles 4–7. It is not a designation test or legal determination.
When does it take effect?
The Federal Negarit Gazette is dated 21 July 2026. Article 28 says the proclamation enters into force one year after publication, which points to 21 July 2027.
As of 10 August 2026, the proclamation is published but its delayed effective date has not arrived. Existing laws and pre-existing INSA powers may still apply independently.
Who can be covered?
Article 4 identifies sectors including information and communication technology, finance, security, transport, education, health, water and energy, government, disaster management, agriculture, trade and industry. Sector membership alone is not a final designation.
Under Articles 5 and 6, INSA designates and may later remove specific infrastructure after applying the proclamation's criteria and assessment process. Therefore, this platform uses phrases such as potentially relevant or possible designation exposure, never “you are definitely designated.”
What must a designated owner do?
Article 7 contains 18 duties. The six groups support scanning; the expandable index underneath preserves every numbered duty and its Article 7 reference.
Governance
Create cybersecurity programs, implement mandatory or recognized frameworks, establish an internal framework and create the required organizational structure.
Art. 7(1)–(3), (9)Assets and risk
Classify and protect critical assets; conduct regular cybersecurity risk assessments and impact analyses; participate in the annual national risk survey.
Art. 7(4)–(6)Audit and correction
Maintain and renew the required audit or inspection certificate and correct findings within the required time.
Art. 7(7)–(8)People
Use appropriately certified cybersecurity professionals; conduct training and exercises; meet personnel clearance and ethics requirements.
Art. 7(10), (16)–(18)Technology and suppliers
Address technology supply-chain security and obtain required security clearance before integrating new or upgraded ICT systems.
Art. 7(11)–(12)Monitoring and incidents
Establish a monitoring/reporting/response center, notify the national emergency response center within 48 hours, and exchange information through INSA's system.
Art. 7(13)–(15)Show all 18 duties with article references
- 1
Create cybersecurity programs based on the national cybersecurity frameworks.
Article 7(1) - 2
Implement mandatory cybersecurity frameworks issued or recognized by INSA.
Article 7(2) - 3
Develop and implement an internal cybersecurity framework based on applicable national laws, policies and INSA technical policy.
Article 7(3) - 4
Classify and protect critical assets under the standard issued by INSA.
Article 7(4) - 5
Conduct periodic cybersecurity risk assessments and impact analyses through the system established by INSA.
Article 7(5) - 6
Participate in INSA's annual National Cybersecurity Risk Survey and provide relevant information.
Article 7(6) - 7
Maintain and renew the cyber-audit and cyber-inspection-and-evaluation certificate issued by INSA.
Article 7(7) - 8
Take corrective action on cyber-audit or inspection-and-evaluation findings within the required period.
Article 7(8) - 9
Create the required cybersecurity organizational structure under the national framework.
Article 7(9) - 10
Use cybersecurity professionals certified by, or recognized by, INSA and ensure existing professionals obtain the required certification.
Article 7(10) - 11
Protect the supply chain of the technology products used.
Article 7(11) - 12
Before integration, obtain security clearance for new or upgraded ICT systems acquired by purchase, donation, development or another means.
Article 7(12) - 13
Establish and manage a center for monitoring, reporting and responding to cyberattacks under the framework to be issued by INSA.
Article 7(13) - 14
Notify the National Computer Emergency Response Center of cybersecurity incidents within 48 hours using INSA's system, and implement directions provided.
Article 7(14) - 15
Periodically exchange important information through the information-exchange system established by INSA.
Article 7(15) - 16
Develop and run cybersecurity exercises and training, and participate in exercises and training facilitated by INSA.
Article 7(16) - 17
Ensure employees and officers with access to critical resources receive security clearance from the relevant government body.
Article 7(17) - 18
Ensure compliance with the professional ethics required for cybersecurity work.
Article 7(18)
Plain-language index only. Confirm the exact wording in the official proclamation.
What is the 48-hour incident rule?
Article 7(14) requires a critical-infrastructure owner to notify the National Computer Emergency Response Center of cybersecurity incidents within 48 hours, using the system established by INSA. The official English text does not, by itself, answer every operational question about when the clock starts, required fields or follow-up format.
See the official reporting routesWhat does the provider-licensing regime cover?
Articles 16–20 create a separate track for people and organizations that provide cybersecurity products or services. Article 16 says INSA issues the licence and prohibits providing covered products or services without it. A future INSA directive is expected to identify the product and service types that require a licence and specify the application, licence content, renewal, oversight, security-clearance and complaint procedures.
The published criteria include legal-personality or establishment documents, security clearance, qualified personnel and technology, operational systems, capital and guarantee requirements, a permanent Ethiopian address and integrity-related requirements. Several details are left to directive.
Use the licence only within its purpose and scope; do not transfer or lend it without approval; report material requirement changes; protect confidential information; cooperate with INSA oversight; and follow the proclamation and implementing rules.
The proclamation lists grounds for revocation and permits suspension where those grounds may exist. The exact process and safeguards should be checked against the official text and later rules.
Until the Article 16 directive identifies the covered product and service types, CyberMela cannot decide whether a particular consulting, managed-security, software or product activity requires a licence.
What penalties and complaint routes are published?
Article 22 lists administrative fines for intentional violations by critical-infrastructure owners. The amounts below reproduce the ranges in the official English text as a navigation aid.
| Published violation | Article 22 range |
|---|---|
| Mandatory framework not implemented on time | ETB 500,000–1,000,000 |
| 48-hour incident notice or required corrective action not completed | ETB 1,500,000–2,000,000 |
| Necessary information or cooperation not provided to the national incident-response center | ETB 300,000–500,000 |
| Required cooperation not provided for periodic cybersecurity audits | ETB 1,500,000–2,000,000 |
| Audit findings not corrected on time as directed | ETB 800,000–1,000,000 |
| ICT systems used without the required cybersecurity inspection and evaluation | ETB 800,000–1,000,000 |
Article 22 provides a reduced fine for negligent conduct. It also permits INSA to use a written corrective warning where an offence is a first occurrence and caused no damage. Confirm how the reduction applies from the bilingual official text.
Providing covered cybersecurity services without a valid licence, or breaching Article 18 duties, carries a published ETB 1.2–2 million range. A repeat offence may be fined at three times the stated maximum.
Article 23 provides a written complaint to INSA within 30 consecutive days, an INSA decision within 15 consecutive working days, a later grievance-board route and a court appeal within 60 consecutive days after the board decision.
Administrative amounts may later be revised by Council of Ministers regulation. This summary does not predict enforcement or calculate a penalty.
What remains uncertain or evolving?
- The exact designation process and notices used for specific organizations.
- Detailed implementation rules for the 18 duties and certification renewal.
- The catalogue and conditions for cybersecurity product and service provider licences under Article 16.
- Operational details of the 48-hour incident reporting system.
- How newer directives will interact with pre-existing INSA standards and sector rules.
These points should be confirmed with INSA or qualified Ethiopian counsel before making organization-specific legal or investment decisions.
Official sources
Official proclamation PDFINSA documentation libraryINSA publication announcementHow to use this guide: verify important decisions against the linked official text. This page provides general information, not legal advice, designation, audit, certification or a compliance finding.