KenyaComputer Misuse and Cybercrimes Act, Critical Information Infrastructure Designation, Directives and Compliance Report
Computer Misuse and Cybercrimes Act (No. 5 of 2018), ss. 9 and 13
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds the owner or operator of a system that the Director of the National Computer and Cybercrimes Co-ordination Committee has designated as critical infrastructure by notice in the Kenya Gazette under section 9(1) of the Act (reached by declaring that you operate an essential service), and does not bind an owner or operator of a system that has not been designated. A system is designated by reference to the effects of its disruption that section 9(2) lists, which include the interruption of a life sustaining service such as the supply of water, health services and energy, an adverse effect on the economy of the Republic, massive casualties or fatalities, and disruption of the money market of the Republic.
- Comply, within the period the Director sets, with the directives the Director issues for the critical information infrastructure on the classification of data, the protection, storing and archiving of data, cyber security incident management, disaster contingency and recovery measures, and minimum physical and technical security measures (section 9(4)).
- Submit a compliance report on the critical information infrastructure to the Committee every year, in line with a critical infrastructure framework (section 13(1)).
- Cooperate with an audit of the critical information infrastructure: assist and provide technical assistance to a person authorised to carry out the audit, and provide the Director with any additional information requested within the specified period (section 13(5)(b), (e) and (f)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
An owner or authorised person in control of a critical information infrastructure who fails to file a compliance report and fails to cooperate with an audit, fails to provide additional information the Director requests, hinders or obstructs a person authorized to carry out an audit, or fails to cooperate with or assist such a person commits an offence under section 13(5) and is liable on conviction to a fine not exceeding two hundred thousand shillings, imprisonment for a term not exceeding five years, or both.
Penalty structure
Section 13(5)'s fine cap of two hundred thousand shillings; the same subsection separately authorises imprisonment for up to five years, either alone or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- KES
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The Director of the National Computer and Cybercrimes Co-ordination Committee, who monitors, evaluates and reports on the adequacy and effectiveness of any audit of a critical information infrastructure under section 13(3) of the Act.
What this law does
Section 9(1) of the Act requires the Director to designate certain systems as critical infrastructure by notice in the Gazette.
Section 9(2) of the Act lists, as the effects of a disruption for which the Director shall designate a system as critical infrastructure, the interruption of a life sustaining service including the supply of water, health services and energy; an adverse effect on the economy of the Republic; an event that would result in massive casualties or fatalities; failure or substantial disruption of the money market of the Republic; and an adverse and severe effect on the security of the Republic.
Section 9(4) of the Act requires the Director to issue directives that regulate the classification, protection and archiving of data held by a critical information infrastructure, its cyber security incident management, its disaster contingency and recovery measures, and the minimum physical and technical security measures it must implement.
Section 13(1) of the Act requires the owner or person in control of a critical information infrastructure to submit a compliance report to the Committee every year. An owner or authorised person in control of a critical information infrastructure who commits an offence under section 13(5) of the Act is liable on conviction to a fine of up to two hundred thousand shillings, imprisonment of up to five years, or both. The Act was published in the Kenya Gazette on , assented to on and commenced on .
When LexLint raises it
When your app profile says your app runs an essential service.