KenyaCritical Information Infrastructure Regulations, Owner Security, Continuity and Compliance Report
Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024 (Legal Notice No. 44 of 2024), regs. 28 to 34, 42 and 46
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds an owner of critical information infrastructure, which includes the operator or authorized person in control of it, where the infrastructure is a system the Director has designated under section 9 of the Computer Misuse and Cybercrimes Act, 2018 by notice in the Kenya Gazette (reached by declaring that you operate an essential service); it does not bind the owner of a system that has not been designated. The Regulations apply to the public sector and the private sector (regulation 5).
- Implement the Director's directives within the time specified in the notice the Director issues on designation, and implement effective measures for the physical security of the hardware where the system is located, limits on access to the infrastructure and the information stored in it, periodic maintenance and security testing, prompt access for authorized persons during an incident or an audit, administrative control of the personnel who have access, limits on removable storage devices, and preparedness plans against damage, breach or loss (regulation 29(1) and (2)).
- Develop and implement an internal cybersecurity policy and review it at least annually (regulation 31(1)(a)). Adopt the technical and organizational measures regulation 31(2) lists, which include identifying and cataloguing all assets, security monitoring and response for timely detection of incidents, a business continuity and disaster recovery plan that is periodically tested and updated, an annual cybersecurity risk assessment, annual cybersecurity internal audits, a cybersecurity risk register, and cybersecurity exercises and drills with the Committee.
- Designate or appoint a Chief Information Security Officer (regulation 32(1)); owners may jointly appoint one officer who is accessible to each of them (regulation 32(2)). A person qualifies for the post if the person is a citizen of Kenya, has at least five years of demonstrable professional experience in the protection of critical information infrastructure and meets the other conditions in regulation 33.
- Formulate, and then review and update every year, organizational policies, procedures and codes of practice for the protection, preservation and management of the critical information infrastructure, a duty that fell due within six months of the commencement of the Regulations on (regulation 34(1)).
- Keep the infrastructure on which critical information is domiciled in Kenya, unless you apply to the Committee in Form CMCA 3 to locate critical information outside Kenya (regulation 28(1) and (2)).
- Establish a disaster recovery and backup site located in a different location from the main location of the critical information infrastructure (regulation 42(1)).
- In the annual compliance report you submit under section 13(1) of the Act, include a risk assessment specifying the risks the infrastructure is prone to and the mitigation measures you may apply, and your cybersecurity risk register (regulation 46(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of the National Computer and Cybercrimes Co-ordination Committee, who issues a notice to show cause to an owner that has not implemented the directives and may then order the suitable actions or administrative sanctions regulation 21(3) lists, which include a report on non-compliance to the National Security Council, a recommendation to the sector Regulator to impose specifications, a multi-agency committee, full implementation of the directives by the Director and a recommendation that law enforcement agencies investigate.
What this law does
Regulation 2 defines critical information infrastructure as a system designated pursuant to section 9 of the Act. Regulation 5 applies the Regulations to cyber security matters in the public sector and the private sector, including the owners of critical information infrastructure. Regulation 29(1) requires an owner of a critical information infrastructure to implement the Director's directives within the time specified in the notice the Director issues.
Regulation 31(1) requires an owner of a designated critical information infrastructure to develop and implement an internal cybersecurity policy that is reviewed at least annually, to implement the directives issued under regulation 20 and to appoint or designate a Chief Information Security Officer.
Regulation 31(2) requires the owner to adopt technical and organizational measures that include an annual cybersecurity risk assessment, annual cybersecurity internal audits, a cybersecurity risk register and cybersecurity exercises and drills. Regulation 32(1) requires an owner of critical information infrastructure to designate or appoint a Chief Information Security Officer.
Regulation 33 provides that a person is qualified as a Chief Information Security Officer if the person is a citizen of Kenya, has at least five years of demonstrable professional experience in the protection of critical information infrastructure and satisfies the other conditions it lists.
Regulation 34(1) requires an owner of a critical information infrastructure, within six months from the commencement of the Regulations, to formulate, and then review and update on an annual basis, organizational policies, procedures and codes of practice to ensure the protection, preservation and management of the critical information infrastructure.
Regulation 28 requires an owner of a critical information infrastructure to ensure that the infrastructure on which critical information is domiciled is located in Kenya, and an owner who intends to have critical information located outside Kenya must apply to the Committee in Form CMCA 3.
Regulation 42(1) requires an owner of a critical information infrastructure to establish a disaster recovery and backup site located in a different location from the main location of the critical information infrastructure. Regulation 46(2) requires the compliance report an owner submits to the Director to contain a risk assessment and the owner's risk register.
Regulation 21(1) requires the Director, where an owner has failed to implement the directives by the expiry of the timelines, to issue a notice to show cause to the owner. Regulation 21(3) lists the actions that may follow, which include a report on non-compliance to the National Security Council, a recommendation to the sector Regulator to impose specifications, and a recommendation that law enforcement agencies investigate. The Regulations were published in the Kenya Gazette on and commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.