KenyaCritical Information Infrastructure Regulations, Incident Reporting by an Owner
Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024 (Legal Notice No. 44 of 2024), reg. 65
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an owner of critical information infrastructure, which includes the operator or authorized person in control of it, where the infrastructure is a system the Director has designated under section 9 of the Computer Misuse and Cybercrimes Act, 2018 by notice in the Kenya Gazette (reached by declaring that you operate an essential service); it does not bind the owner of a system that has not been designated. The Regulations apply to the public sector and the private sector (regulation 5).
- Report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident (regulation 65(c)). The Regulator of the specific Sector in which the infrastructure is domiciled or, where applicable, the relevant Ministry is the Sector Cybersecurity Operation Centre (regulation 11(1)).
- In the event of a cybersecurity incident, facilitate the investigations by law enforcement agencies, and report and mitigate the impact of the incident in accordance with the cybersecurity standards formulated by the Committee (regulation 65(a) and (b)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Sector Cybersecurity Operation Centre, which is the Regulator of the specific Sector in which the critical information infrastructure is domiciled or, where applicable, the relevant Ministry.
What this law does
Regulation 65(c) requires the owner of a critical information infrastructure to report all cybersecurity incidents to the relevant Sectoral Cybersecurity Operations Centre within twenty-four hours of becoming aware of an incident. Regulation 65(a) and (b) require the owner to facilitate investigations by law enforcement agencies and to report and mitigate the impact of the incident in accordance with the cybersecurity standards formulated by the Committee.
Regulation 11(1) deems the Regulator of the specific Sector in which the critical information infrastructure is domiciled, or where applicable the relevant Ministry, to be the Sector Cybersecurity Operation Centre. The Regulations were published in the Kenya Gazette on and commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.