KenyaCritical Information Infrastructure Regulations, Licensed Internet Gateway Operators
Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024 (Legal Notice No. 44 of 2024), reg. 35
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds a licensed operator of an international or the national internet gateway (reached by declaring that you provide telecom services); it does not depend on a designation of the gateway as critical information infrastructure.
- Comply with the cybersecurity standards provided under the Regulations, which the Committee shall require of you (regulation 35(1)).
- When the Committee asks, submit a safety standards compliance report within thirty days of the request, and prepare, maintain and submit the technical records, internet portal address allocation records and route identification of traffic transiting the national internet gateway (regulation 35(2) and (4)).
- In the event of internet traffic congestion or suspicious activity, report immediately to the Committee on the connection status of the congested route, specifying the solutions for the congestion (regulation 35(3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Committee, which in consultation with the sector Regulator recommends the restriction, suspension or revocation of a non-compliant operator's license under regulation 35(5).
What this law does
Regulation 35(1) provides that the Committee shall require a licensed operator of an international or the national internet gateway to comply with the cybersecurity standards provided under the Regulations. Regulation 35(2) requires a licensed operator of an international or the national gateway to submit a safety standards compliance report within thirty days of the Committee's request.
Regulation 35(3) requires the operator to report immediately to the Committee on the connection status of the congested route, specifying the solutions for the congestion, in the event of internet traffic congestion or suspicious activity.
Regulation 35(5) provides that, where the operator fails to comply, the Committee shall in consultation with the sector Regulator recommend the restriction, suspension or revocation of the operator's license or take any other action in accordance with the relevant laws. The Regulations were published in the Kenya Gazette on and commenced on .
When LexLint raises it
When your app profile says your app provides telecom services.