KenyaComputer Misuse and Cybercrimes Act, Critical Infrastructure Owner's Report of Threats to the Committee
Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 11
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the owner or operator of a system that the Director of the National Computer and Cybercrimes Co-ordination Committee has designated as critical infrastructure by notice in the Kenya Gazette under section 9(1) of the Act (reached by declaring that you operate an essential service), and does not bind an owner or operator of a system that has not been designated. A system is designated by reference to the effects of its disruption that section 9(2) lists, which include the interruption of a life sustaining service such as the supply of water, health services and energy, an adverse effect on the economy of the Republic, massive casualties or fatalities, and disruption of the money market of the Republic.
- Report to the National Computer and Cybercrimes Co-ordination Committee any incident likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime, together with the action you intend to take to prevent the threat (section 11(1)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Director of the National Computer and Cybercrimes Co-ordination Committee, who may institute an investigation of a computer and cybercrime attack on the Director's own volition and take necessary steps to secure any critical infrastructure without reference to the entity under section 11(3) of the Act.
What this law does
Section 11(1) of the Act requires the owner or operator of a system designated as critical infrastructure to report to the Committee any incidents likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime, and the action the owner or operator intends to take to prevent the threat.
Section 11(2) of the Act requires the National Security Council to provide technical assistance to the owner or operator to mitigate the threat once the Committee receives a report. Section 11(3) of the Act allows the Director to institute an investigation of a computer and cybercrime attack on the Director's own volition and to take necessary steps to secure any critical infrastructure without reference to the entity. The Act was published in the Kenya Gazette on , assented to on and commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.