Zambia Cyber Security and Cyber Crimes Act 2021
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
National cybersecurity framework: software asset inventory, component integrity, supply-chain verification, and vulnerability management.
| Short name | ZM Cyber |
| Region | Middle East & Africa |
| Country or scope | Zambia |
| Sector | Government |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers ZM Cyber
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ZM-CSCCA-CII Protection Measures for Critical Information Infrastructure | Operators of critical information infrastructure must apply prescribed protection and security measures, which presumes verifiable integrity of the software components running on those systems (Cyber Security and Cyber Crimes Act 2021, Part V) | Scan |
ZM-CSCCA-REG Registration and Auditing of Critical Systems | Critical information systems are subject to registration and periodic audit, which requires an enumerated, auditable inventory of the software components they contain (Cyber Security and Cyber Crimes Act 2021, Part V) | Scan |
ZM-CSCCA-INC Security Incident Reporting Readiness | Security incidents affecting critical information must be reported to the authority; assessing what was compromised requires precisely identifiable components (PURL/CPE) across the affected systems (Cyber Security and Cyber Crimes Act 2021, Part V incident-reporting obligation) | Scan |
ZM-CSCCA-VULN Maintained, Patchable Software | Keeping critical systems resilient against cyber threats requires knowing the version of every software component so vulnerable software can be found and patched (Cyber Security and Cyber Crimes Act 2021, cybersecurity obligations) | Scan |
ZM-CSCCA-SUP Service Provider and Supply-Chain Accountability | The Act imposes duties on service providers and controllers of critical information, including controlled localization and externalization, requiring the suppliers of system software to be identified and vetted (Cyber Security and Cyber Crimes Act 2021, Part V and service-provider obligations) | Scan |
ZM-CSCCA-AUD Machine-Auditable System Records | Mandatory auditing of critical information systems is only practicable when system composition is documented in a standard machine-readable format such as SPDX or CycloneDX (Cyber Security and Cyber Crimes Act 2021, Part V audit obligation) | Scan |
Policy templates
All 22 from the standard set, adapted to ZM Cyber.
Yemen National Privacy Framework
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Zambia Data Protection Act No. 3 of 2021
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.