Republic of South Sudan

(1) The Authority shall register a critical infrastructure. (2) The Authority shall, by publication, determine; (a) the requirements for the registration of a critical infrastructure. (b) the procedure for the registration of a critical infrastructure; and (c) any other matter relating to the registration of a critical infrastructure. (3) Where there is any change in the legal ownership of a registered critical infrastructure, the owner of the registered critical infrastructure shall, within seven days after the change, inform the Authority of the change in ownership. (4) An owner of a registe…

(1) An owner of a critical infrastructure shall; (a) report a cybersecurity incident within twenty-four hours after the incident is detected to the Authority. (b) cause an audit to be performed on a critical infrastructure; and (c) submit a copy of the audit report to the Authority. (2) An owner of a critical infrastructure who contravenes the provisions of subsection (1) of this section, is liable to pay to the Authority the administrative penalty that may be prescribed by the minister.

A person who contravenes a section of this Act for which a penalty is not provided commits an offence and shall be liable upon conviction to a fine or imprisonment for a term not exceeding five years, or both.

(1) The Authority may issue directives to an owner of a critical infrastructure, a cybersecurity service provider or service providers for the purpose of ensuring the cybersecurity of the country. (2) An owner of a critical information infrastructure, a cybersecurity service provider or a service provider who fails to comply with the directives issued under subsection (1) of this section shall be liable to pay to the Authority the administrative penalty prescribed under this Act.

The Authority shall, for the purpose of imposing an administrative penalty under this Act, take into account; (a) the size of the service provider concerned; (b) the criticality of the sector; (c) the impact of the contravention; and (d) any other relevant criterion that the Competent Minister may determine.

The Court before which a person is convicted of an offence may, in addition to any other penalty imposed, order the forfeiture of any apparatus, article or device which is the subject matter of the offence or is used in connection with the commission of the offence.