Guide · Compliance

DGSSI & Loi 05-20, step by step.

Morocco’s Loi 05-20 and the DGSSI national directive require operators of vital and sensitive information systems to implement and maintain defined security measures. These five steps are the path we follow with clients.

Identify & classify your assets
Map information systems and determine which fall under “vital” or “sensitive” categories per Loi 05-20. Classification drives the level of controls required.
Run a gap assessment
Compare current controls against the DGSSI directive — governance, access control, logging, incident response, business continuity — and document the gaps with risk ratings.
Implement technical controls
Deploy segmentation, hardening, centralised logging (SIEM), backup/restore and access governance. Each control should be testable and produce evidence.
Establish incident response
Define detection, escalation and notification procedures — including mandatory reporting to maCERT/DGSSI within the legal window — and rehearse them.
Audit, document & maintain
Produce the audit dossier, run periodic reviews and keep the security posture current as systems evolve. Compliance is continuous, not a one-time certificate.

Who is concerned?

Operators of Vital Importance (OIV), Operators of Essential Services (OSE) and their subcontractors with access to critical systems — in energy, water, transport, finance, health, telecommunications and public administration.

Main obligations

Declaration to the DGSSI · technical & organisational security measures · incident notification · periodic audits · accreditation of sensitive systems.