Building a Cybersecurity Unit Under Decree 26-07: A Staffing and Budget Blueprint

From Mandate to Operating Reality

Presidential Decree 26-07, published in the Official Gazette on January 21, 2026, established the institutional framework for cybersecurity within Algerian public institutions. It builds on Presidential Decree 25-321 of December 30, 2025, which approved the National Cybersecurity Strategy 2025-2029. Together, these two decrees moved the country from strategic intent to operational mandate.

The decree’s core requirement — a dedicated cybersecurity unit reporting to institutional leadership — is a clean structural directive. What it does not specify, because no decree should, is how to staff, budget, and operate that unit at the level of detail an institution’s head needs to actually stand it up. This guide fills that operational gap with a practical blueprint based on international best practices adapted to Algerian institutional realities.

The blueprint is organized into three institutional sizes: small institutions (under 200 staff), medium institutions (200-2,000 staff), and large institutions (over 2,000 staff or critical infrastructure operators). Each tier has different baseline expectations, role compositions, and budget envelopes.

Core Roles in a Cybersecurity Unit

Regardless of institutional size, every cybersecurity unit requires a core set of role functions. The number of people per role scales with size; the function set does not.

Cybersecurity Unit Lead (CISO equivalent). Reports directly to the head of the institution. Owns the cybersecurity policy, the incident response plan, the budget, and the relationship with ASSI, ANSSI, DZ-CERT, and sector regulators. Single accountable point for the institution’s cybersecurity posture.

Security Operations Analyst. Monitors security events from the institution’s systems, triages alerts, escalates incidents, and coordinates with technical teams on remediation. The day-to-day defender role.

Security Engineer. Implements security controls, configures detection and prevention tooling, hardens systems, and maintains the security technology stack. The builder role that translates policy into technical reality.

Governance, Risk, and Compliance (GRC) Specialist. Maintains the policy library, conducts audits, manages third-party risk assessments, handles data protection compliance under Law 18-07, and coordinates regulatory reporting. Often a part-time role in smaller institutions or shared with the legal department.

Incident Responder. Leads response to confirmed incidents — containment, eradication, recovery, and lessons-learned. Often a senior security engineer wearing this hat in smaller units; a dedicated function in larger ones.

Identity and Access Management Specialist. Owns the identity platform, MFA coverage, OAuth governance, privileged access, and user lifecycle. Identity-related weaknesses dominate the global attack landscape; this role is increasingly critical even in mid-sized organizations.

Tier 1: Small Institution (Under 200 Staff)

A minimum viable cybersecurity unit for a small Algerian public institution can be built with three full-time roles plus shared functions:

Composition (3 FTE):

• Cybersecurity Unit Lead (1 FTE)
• Security Operations Analyst / Engineer dual role (1 FTE)
• GRC Specialist / Identity Specialist dual role (1 FTE)

Operating model:

• Detection and incident response augmented through DZ-CERT subscription and a managed detection and response (MDR) contract for 24/7 coverage
• Annual security audit conducted by external accredited provider (under existing accreditation framework)
• Quarterly tabletop exercises and annual penetration testing
• Identity platform configured with enterprise MFA across all users

Indicative annual budget: Roughly equivalent to 3-4 senior public-sector salaries plus a tooling and services budget covering MDR contract, identity platform licensing, audit fees, and tabletop facilitation. The exact figure depends on institutional procurement frameworks, but the order of magnitude is in the low millions of dinars annually for staffing plus a comparable amount for tools and services.

Common pitfall: Treating the unit as an extension of IT operations. The decree’s intent is structural separation; the lead must report to institutional leadership, not to the IT director.

Tier 2: Medium Institution (200-2,000 Staff)

A medium-sized institution requires deeper specialization and the beginning of dedicated operational coverage:

Composition (6-8 FTE):

• Cybersecurity Unit Lead (1 FTE)
• Deputy Lead / Senior Architect (1 FTE)
• Security Operations Analysts (2 FTE)
• Security Engineers (2 FTE)
• GRC Specialist (1 FTE)
• Identity and Access Management Specialist (1 FTE, optional at lower end of tier)

Operating model:

• In-house Tier 1 SOC operating during business hours; MDR contract for after-hours and weekend coverage
• Documented incident response plan with named on-call rotation
• Quarterly tabletop exercises; annual full-scope penetration test plus targeted assessments
• Vendor risk management program with continuous monitoring of top-tier vendors
• Identity platform with full MFA, privileged access management, and quarterly OAuth review

Indicative annual budget: Significantly larger than Tier 1, with personnel cost reflecting 6-8 specialized roles plus a tooling stack including SIEM, identity platform, vulnerability management, and endpoint detection. Most medium institutions will also invest in formal certification training for staff (CISSP, CEH, ISO 27001 lead implementer/auditor).

Common pitfall: Under-investing in identity and access management while over-investing in perimeter tooling. Modern attack patterns target identity; the budget split should reflect this.

Tier 3: Large Institution / Critical Infrastructure (Over 2,000 Staff)

Large public institutions and operators of critical infrastructure require a full Security Operations Center capability with 24/7 in-house coverage and specialized functions:

Composition (12-15 FTE):

• Cybersecurity Unit Lead / CISO (1 FTE)
• Deputy CISO / Operations Manager (1 FTE)
• SOC Manager (1 FTE)
• Tier 1 SOC Analysts (3-4 FTE, shift coverage)
• Tier 2 SOC Analysts / Detection Engineers (2 FTE)
• Incident Response Lead (1 FTE)
• Security Architects / Engineers (2 FTE)
• GRC Lead with team (2 FTE)
• Identity and Access Management Lead (1 FTE)
• Threat Intelligence Analyst (1 FTE, optional but recommended)

Operating model:

• Full 24/7 in-house SOC with documented playbooks and detection engineering function
• Threat intelligence feed integration and proactive threat hunting
• Comprehensive vendor risk management with continuous monitoring
• Mature identity platform with privileged access management and OAuth governance
• Annual red team exercise plus continuous bug bounty or crowd-sourced testing where appropriate
• Direct integration with ASSI, ANSSI, and DZ-CERT for coordinated response

Indicative annual budget: Substantial multi-year capital plus operating commitment. Personnel costs for 12-15 specialized professionals at competitive rates dominate. Tooling stack adds significant cost — SIEM/XDR, threat intelligence platforms, GRC platforms, vulnerability management, and identity infrastructure. Training and certification budget is non-trivial given the rate at which the field evolves.

Common pitfall: Building the capability list before recruiting the leadership. A strong CISO will design the unit appropriately for institutional context; a weak CISO will inherit a capability list designed by someone else and struggle to operate it.

Recruitment in a Constrained Talent Market

Algeria’s cybersecurity talent pool is expanding but remains constrained relative to demand. The Ministry of Vocational Training’s expanded cybersecurity certification programs, the Huawei ICT Academy partnership for ICT and cybersecurity training, and university programs are all building pipeline, but most output will reach institutional readiness over a 2-3 year horizon.

For 2026, public institutions building cybersecurity units should consider three recruitment paths:

1. Internal transfer with intensive training. Identify high-potential staff in IT, internal audit, or compliance functions and invest in formal certification (CISSP, CISM, ISO 27001 Lead Auditor). This is the fastest path to a culturally embedded team.
2. External recruitment from regulated sectors. Banks, telecoms, and energy sector cybersecurity professionals have transferable skills and exposure to mature security operations.
3. Partnership with managed service providers. For roles that are difficult to fill (24/7 SOC analysts, threat intelligence), augment in-house teams with managed services rather than waiting for direct hires that may not materialize.

Working with ASSI and DZ-CERT from Day One

Every cybersecurity unit established under Decree 26-07 should establish operational relationships with the Information Systems Security Agency (ASSI), the National Agency for Information Systems Security (ANSSI), and DZ-CERT (operating under CERIST) from the first quarter of operations. This includes:

• Subscribing to advisories and threat intelligence feeds where available
• Designating a primary and backup point of contact for incident notifications
• Participating in any sector-specific cybersecurity coordination forums
• Documenting and testing the incident escalation path before any actual incident occurs

These relationships are part of the unit’s effectiveness, not optional adjuncts.

Sources & Further Reading

• Algeria Strengthens Cybersecurity Framework to Protect National Infrastructure — TechAfrica News
• Algeria Cybersecurity Framework Update — SAMENA Council
• CMS Expert Guide to Data Protection and Cyber Security Laws: Algeria — CMS
• State of Algeria Cybersecurity Insights — State of Algeria