SIGIL SARL — Buea, Cameroon
What to require of a cybersecurity company in Cameroon
The legal baseline: two laws and one agency
For a public institution and a small business alike, cybersecurity in Cameroon rests on a specific foundation: a 2010 law that governs network security and punishes cybercrime, a national agency with a defined mandate, and — since December 2024 — a personal-data-protection law. This guide lays out that foundation, the documented threat picture, and six concrete requirements an organization should put to any cybersecurity company in Cameroon — including us.
Law No. 2010/012 of 21 December 2010 relating to cybersecurity and cybercriminality in Cameroon does three things that concern every organization directly. It governs the security framework of electronic communication networks and information systems; it defines and punishes offences related to the use of information and communication technologies; and it establishes the legal regime of digital evidence, security activities, cryptography, and electronic certification. Two practical consequences follow. First, the security of your systems is not merely a matter of prudence: it is a matter the law regulates. Second, a properly built audit trail has evidentiary weight — digital evidence is a legal regime, not a technical luxury.
The same law charges the National Agency for Information and Communication Technologies (ANTIC) with carrying out technology watch and issuing alerts and recommendations on the security of electronic communication networks and certification. For its security-intelligence mission, ANTIC operates the national CIRT (Computer Incident Response Team), which carries two responsibilities: preventing cyber-attacks, and, when an incident occurs, intervening to clear the attack and identify the attacker. The CIRT also monitors critical national cyberspace infrastructure, issues security alerts and bulletins, assists users and companies with incidents, and collaborates with other CIRTs. A Cameroonian organization hit by a serious incident therefore has an institutional counterpart — and a serious security partner must know how to work with it, not around it.
Since 23 December 2024, the foundation has widened: Law No. 2024/017 relating to personal data protection is Cameroon's first law devoted entirely to personal data. It governs the collection, processing, storage, and transfer of personal data, provides for a Personal Data Protection Authority, subjects cross-border transfers to strict conditions, and backs it all with substantial penalties. The eighteen-month compliance window ran to June 2026 — it has now closed. The useful question is no longer "will we have to comply?" but "can you demonstrate that you do?".
For a small or medium-sized business, this framework can feel distant; it is not. It determines what a provider is allowed to do on your systems, what its reports are worth before an auditor or a judge, and what you risk if your customers' data is processed without a legal basis. The six requirements in this guide are its operational translation.
The documented threat picture
Public figures on cybercrime in Cameroon are scarce, and the most solid ones come from ANTIC itself. They measure only identified and reported cases — a floor, not a ceiling. We cite only sourced figures here; everything else would be conjecture.
In August 2023, ANTIC's Director General put Cameroon's losses to cyber scamming at 7 billion FCFA since 2010, with scamming representing about 80% of recorded cybercrime cases in 2021. The same address reported nearly 6,000 identity-theft incidents targeting high-profile state dignitaries and state institutions, of which around 4,000 accounts had been shut down.
In the financial sector, ANTIC stated as early as 2019 that local banks had lost over 3 billion FCFA in the preceding years, with close to 1,200 recorded cases of identity theft and over 800 registered scam cases.
What these figures tell an organization is simple: the threat is real, documented by the national authority, and concentrated where the money is — fraud, identity theft, and intrusions into financial systems. What they do not tell you is your own exposure. That is not read off a national statistic: it is measured on your systems, by someone authorized to do so, and proven piece by piece.
What to require of a cybersecurity company in Cameroon
The market does not lack offers; it lacks ways to tell them apart. Here are six concrete requirements an institution or a small business can put to any cybersecurity partner — an audit firm, a security operator, or a vendor like us. Each is testable: it invites a verifiable yes or an instructive no. They derive from the doctrine we call governed cybersecurity; you do not need to take our word for anything to use them. Technical terms are defined in our glossary.
- Written, bounded, attributable authorization. No test, no scan, no intervention without a written mandate stating the scope, the duration, and the responsible party. The 2010 law punishes offences against information systems: a provider who "tests" without a formal mandate exposes you as much as itself. Every consequential action must remain attributable to a precise identity and a precise authorization.
- Independent re-verification of findings. A tool's or an agent's alert is not a fact; it is a lead. Require that any finding presented as confirmed has been re-verified by an independent, deterministic check, and that reports separate what is proven from what is merely observed. Require honesty about the null result too: the absence of a signal is not proof of absence.
- No remote control channel — no kill-switch. A vendor able to disable your system from afar holds, by construction, a channel into your infrastructure. If a usage right must be revocable, revocation should take the form of a signed certificate verified locally — a document your system reads — never a remote command. And it is you, not the vendor, who must be able to stop the system.
- Data residency and key custody. Your data, your keys, and your reports stay under your control, on infrastructure you choose. The vendor should hold no default access, no hidden administrative account, no silent operational telemetry. Since the 2024 law, cross-border transfers of personal data are subject to conditions: where your data lives is no longer just an architecture choice, it is a compliance parameter.
- Signed reports with re-verifiable evidence. A serious finding carries its raw evidence, a digest, its context, and its provenance, so that a third party — an auditor, a regulator, a judge — can re-verify it later, offline, without trusting the tool that produced it. Cameroon's digital-evidence regime gives this discipline direct legal reach.
- Reversibility: read, export, stop. Whatever the state of the contract or licence, you must always be able to read your data, export it in open formats, and trip a safe stop. A licence expiry may block new sensitive actions; it must never cut you off from your own data or prevent you from stopping the system.
Six questions to write into your tender documents
These requirements are not reserved for large institutions. A small business can raise them in a sales meeting; an institution can write them, as they stand, into a tender specification or an evaluation grid: who authorizes each action, and where is that recorded? How is a finding re-verified before it is presented as confirmed? Does any remote channel into our deployment exist, and can we audit it? Where does our data reside and who holds the keys? Are your reports signed, and is their evidence re-verifiable by a third party? What can we still read, export, and stop if the contract ends?
These six questions cost nothing to ask and reveal a great deal: a partner who cannot answer them precisely is, in effect, asking you for faith. An organization should not have to believe its vendor; it should be able to check.
Where SIGIL fits — honestly
SIGIL SARL is a Cameroonian company founded in 2023 and based in Buea (RCCM No. RC.BUA.2026.B.0190). We build VIGIL, a governed cybersecurity and evidence platform: it helps duly authorized operators find, confirm, remediate, and document vulnerabilities, under one rule — a technical capability is never an authorization. The six requirements above were not written for this guide: they are the doctrine VIGIL is built to, set out on our governed cybersecurity page and in how we build.
One point of honesty, because it conditions everything else: VIGIL is pre-deployment. SIGIL today has no customers, no deployments, no pilots, and no revenue. What we can show is the design — and it is made to be tested: the institution holds the keys; the data stays under the institution's control; every consequential action is authorized, bounded, and proven. Apply this guide's six requirements to us; that is exactly the examination our systems are designed for.
For the local context — Buea, Silicon Mountain, and what it changes for an organization in the region — see our cybersecurity in Buea page. For any question: info@sigilsovereign.com.
Frequently asked
Which laws govern cybersecurity in Cameroon?
Two main texts. Law No. 2010/012 of 21 December 2010 relating to cybersecurity and cybercriminality governs the security of electronic communication networks and information systems, punishes ICT-related offences, and establishes the legal regime of digital evidence. Law No. 2024/017 of 23 December 2024 relating to personal data protection is Cameroon's first standalone personal-data law; its eighteen-month compliance window ran to June 2026. ANTIC carries out technology watch and security alerts, and operates the national CIRT.
What is ANTIC's national CIRT?
The CIRT (Computer Incident Response Team) is the national incident-response team operated by ANTIC. It carries two main responsibilities: preventing cyber-attacks, and, when an incident occurs, intervening to clear the attack and identify the attacker. It also monitors critical national cyberspace infrastructure, issues security alerts and bulletins, assists users and companies, and collaborates with other CIRTs.
How should an organization choose a cybersecurity company in Cameroon?
Put six testable requirements to it: written, bounded, attributable authorization for every intervention; independent re-verification of any finding presented as confirmed; no remote control channel of any kind (no kill-switch); data residency and key custody with you; signed reports whose evidence a third party can re-verify; and reversibility — the ability to always read, export, and stop. A serious partner answers each one precisely; a refusal or a vague answer is itself information.