In this article
The bottom line Presidential decree 26-07 of 7 January 2026 requires every public institution, administration and body to set up a unit dedicated to the security of its information systems, separate from the IT department and reporting to the head of the organisation. It is not one more box on the org chart: it is a control function with precise missions, which has to exist and deliver.
What the text says
Presidential decree no. 26-07 of 7 January 2026, published in the Official Journal on 21 January 2026, organises information systems security in public institutions, administrations and bodies, and in the organisations under their supervision.
It is part of the 2025-2029 national cybersecurity strategy, adopted at the end of December 2025 and made public in March 2026 by the Information Systems Security Agency (ASSI), which reports to the Ministry of National Defence.
The core principle fits in one sentence: each entity must have a unit in charge of the security of its information systems, separate from the unit that runs those systems, and reporting directly to its head.
The unit's missions
According to the published presentations of the text, the unit must:
- draft the entity's information systems security policy and monitor its application, in line with the national strategy;
- map risks and steer the treatment plans;
- monitor systems continuously;
- report security incidents without delay;
- carry out security audits on a schedule set in advance;
- ensure, with the competent national authority, that personal data processing complies with the law;
- work with the procurement unit so that subcontracting contracts include security clauses.
Taken together, these missions describe a steering and control function, not one more technical team.
Why separation from IT matters
The separation is not a formality. The IT department is judged on availability: applications running, users served, projects moving. Security sometimes demands the opposite: refusing access, delaying a release, shutting an exposed service.
When the same team carries both, security nearly always loses the argument, and nobody checks the person who administers. A separate unit reporting to the head makes these trade-offs visible and brings risks to where decisions are made.
What most often gets in the way
Creating the unit is quick. Making it work requires things that are often missing:
- An asset inventory. You cannot protect what you do not know: servers, applications, accounts, contractor access.
- Usable logs. Without retained traces, neither monitoring nor post-incident investigation is possible.
- Verified backups. A backup that has never been test-restored is not a guarantee.
- A reporting procedure. "Without delay" assumes everyone knows who alerts whom, through which channel, with what information.
- Up-to-date subcontracting contracts. Many ongoing contracts include neither a security clause nor an obligation to report an incident.
Where to start: five steps
- Appoint the head of the unit and formalise the reporting line, through a written decision setting out its missions and its access to management.
- Build the inventory and the risk map, starting with the systems that carry the activity and personal data. This is the starting point of an information system audit.
- Write a short, applicable security policy, aligned with the national strategy, rather than an exhaustive document nobody reads.
- Write the incident management procedure, from detection to reporting, and test it once with an exercise.
- Plan the audits and review procurement, so that every new service contract includes security requirements.
These steps largely overlap with the basic measures we also recommend to private companies in our cybersecurity checklist.
What about private companies?
The decree does not apply to them directly. But any company working for a public body, as a supplier, integrator or subcontractor, will be affected by the security clauses these bodies will add to their contracts. Being able to describe your own measures, your backups and your incident procedure becomes an advantage, then a condition.
The threats targeting Algerian SMEs are the same ones that hit public bodies, often through the same route: a poorly protected contractor access.
What the text does not yet specify
At the time of writing, we have not found a public implementing text setting a deadline, a minimum headcount or a standard profile for the head of the unit. These points may be clarified by later texts or by the ASSI. Until then, the right reading is the missions: a unit that does not map risks, monitor or audit does not meet the obligation, whatever its title.
Frequently asked questions
Which bodies does decree 26-07 cover?
Public institutions, administrations and bodies, and the organisations under their supervision. Each must have its own unit in charge of the security of its information systems.
Can the IT manager run this unit?
The text requires a unit separate from the one that runs the information systems. Giving both roles to the same person would empty that separation of its meaning: whoever administers cannot be the one who checks.
Can an external provider be used?
The unit and its responsibility stay in-house, but it can rely on providers for specific missions: audits, risk mapping, penetration tests, writing procedures or training staff.
Sources: Algérie360, TSA, Radio Algérie. The reference text is the Official Journal of 21 January 2026, available on joradp.dz.