Operators of essential services in Togo: what designation really changes for your organisation

Being designated an operator of essential services (OES) is not a badge: it is entry into a regime of enforceable obligations, coupled with an annual audit and penalties. An overview of the Togolese framework and its practical friction points.

Togo's digital transformation has a measurable downside. Between 2021 and 2024, the National Cybersecurity Agency (ANCy) reports having recorded and handled more than 333,000 incidents nationwide, with annual volumes rising from 39,168 cases in 2021 to 181,088 in 2024. In its review presented in December 2025, the Agency noted that close to 80% of recorded cyber threats consist of online fraud and scams, and confirmed the continuation of the National Cybersecurity Strategy 2024-2028. Against this background, compliance by operators of essential services ceases to be a technical matter and becomes one of directors' responsibility.

1. A three-tier framework

The Togolese OES regime rests on a straightforward normative architecture, though one often poorly identified by the businesses concerned.

2. Four domains, fourteen sub-domains

The cybersecurity rules are organised around four domains, broken down into fourteen control sub-domains, each accompanied by precise controls and sub-controls:

3. The quantified requirements not to be missed

Experience from the first accreditation cycles shows that non-conformities bear less on strategy than on dated operational points. Among the most structural:

• G1.1.5Appointment of a CISO for each OES, with a training plan comprising at least an ISO/IEC 27001-type certification or equivalent.
• D1.3.2/.6A logging, correlation and analysis system operating 24/7, with time-stamping, centralisation and archiving of events for at least six months.
• P3.3.5A prohibition on essential infrastructure connecting directly to the internet: traffic must pass through a next-generation firewall gateway, separate from DNS, mail and proxy servers.
• D1.4.4Monthly identification of internet-facing vulnerabilities, with remediation within two weeks of identification.
• G3.3.2Independent external cybersecurity assessment, including penetration testing, at least once every two years.
• R1.4.2Continuity plan testing at least twice a year, with an interval of four to six months between tests.
• P1.4.8Renewal of secret authentication credentials at least quarterly, and systematically where compromise is suspected.

4. Notification obligations: the first reflex after designation

Notification of designation as an OES triggers deadlines that start running immediately. They are frequently missed, for want of having been identified.

These notifications are not formalities: they determine the ability of the ANCy and its delegatee to characterise an incident and to mobilise the right counterpart in a crisis.

5. The annual inspection and accreditation cycle

Compliance monitoring follows a cycle that must be anticipated in the company's calendar. The OSP is implemented across the essential infrastructure; the delegatee conducts the annual audit; an audit report (covered by professional secrecy) establishes whether the level of security achieved conforms to the objectives of the OSP, having regard to known threats and vulnerabilities, and makes remediation recommendations; the OES addresses the non-conformities; the OSP is then updated as part of the accreditation procedure, taking account of events over the past year. The rules themselves are subject to revision at least every two years.

The OES must further maintain an up-to-date accreditation file containing the risk analysis and the security objectives for the essential infrastructure, the security procedures and measures applied, together with residual risks, the mitigation measures adopted and the reasons for accepting them (G1.2.2).

6. Three legal blind spots

A. The supplier chain

Sub-control G6.3.1 requires some fifteen stipulations to be built into supplier contracts: a confidentiality agreement backed by real penalties, source code escrow, an SLA for remediating vulnerabilities, access to source code during and after the contract for critical software, supplier insurance against loss arising from defective performance, and a formalised escalation procedure. Few IT contracts currently in force in Togo satisfy this requirement. A contractual review of the supplier portfolio is, in practice, the heaviest piece of compliance work.

B. The interface with data protection

The framework refers expressly to confidentiality and to the protection of personal data (G3.1.4). Law No. 2019-014 of 29 October 2019 and the now-effective activity of the Personal Data Protection Authority (IPDCP) create a second line of requirements, whose perimeters overlap without merging. An incident affecting essential infrastructure and involving personal data falls under both regimes.

C. Management responsibility

The framework expressly designates the board of directors as bearing overall responsibility for the state of the OES's cybersecurity, and the chief executive as responsible for accepting and approving the requirements. It requires the establishment of a cybersecurity steering committee chaired by the chief executive or their delegate, and recommends that the cybersecurity function should not report to the IT department, so as to avoid any conflict of interest. OES compliance is therefore, in law, a matter of corporate governance before it is a technical matter.

In practice

Whether you have already been designated, are in the middle of adversarial proceedings, or are simply liable to be designated in light of the list annexed to the OES decree, four questions warrant resolution without delay: