Complying with the Benin State security policy
Benin's State Information Systems Security Policy (PSSIE), led by ANSSI Benin, governs the security of the information systems of public administrations and bodies, as well as their providers. It explicitly relies on ISO/IEC 27001 (security controls) and ISO/IEC 27005 (risk management), which makes it structurally close to ISO 27001, with requirements specific to the State context.
Controls classified by criticality
The 121 PSSIE controls are spread across 23 security objectives and classified by criticality (Critical or Normal). This classification guides prioritization: an unaddressed critical control represents a risk deemed unacceptable for a State information system, while a normal control can be covered by a longer-term treatment plan.
Who is concerned
Beyond the administrations themselves, any provider that hosts, develops or operates an information system on behalf of a Beninese State body may be assessed against the PSSIE - directly or through the security clauses of its contract.
The ISO 27001 legacy as a foundation
An organization already pursuing ISO 27001 has a set of controls directly reusable for the PSSIE: security policy, access management, incident management, business continuity. The additional work mainly concerns the requirements specific to the State context (system classification, controls specific to data sovereignty) rather than the whole framework.
Suggestion provided for educational purposes - human validation required. This guide does not constitute legal advice and does not replace an accredited external auditor.