Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations

AI-assisted research summary: The Committee has a set of responsibilities including advising government, approving reports, formulating standards and codes, overseeing critical information infrastructure, and coordinating with Cybersecurity Operations Centres.

AI-assisted research summary: The Committee must conduct its business in the manner provided under the First Schedule of these Regulations.

AI-assisted research summary: Section must issue notices of meetings to the Committee members and organise the venue and time for those meetings.

AI-assisted research summary: The National Cybersecurity Operations Centre shall be the national focal point for monitoring, detecting, preventing, responding, investigating and attribution of cyber threats, and must perform a range of operational functions including visibility of sector incidents, capability to act as sector and critical infrastructure SOCs, threat intelligence sharing, incident response coordination, reporting to the Committee, capacity building, awareness, research and implementation of SOPs.

AI-assisted research summary: Sector Cybersecurity Operations Centres are responsible for monitoring, detecting, preventing, responding to and investigating sector-specific cyber threats; the sector Regulator or, if applicable, the relevant Ministry is deemed the Sector Cybersecurity Operation Centre; the Regulator bears the operating costs.

AI-assisted research summary: Critical Information Infrastructure Cybersecurity Operations Centres must monitor, detect, prevent, respond to and investigate cyber threats and perform specified operational duties; owners of Critical Information Infrastructure must fund their centre's administrative costs.

AI-assisted research summary: Owners of designated critical information infrastructure must notify the Committee in writing before outsourcing, enter written agreements ensuring outsourced capabilities do not compromise confidentiality, integrity or availability, remain responsible for outsourced cybersecurity, include specified contractual limits and data-handling measures, and require external providers to report quarterly on obligations and incidents.

AI-assisted research summary: Requires monthly briefs and annual compliance reports on cybersecurity compliance status and that such briefs and reports include information on cyber risks, threats and incidents.

AI-assisted research summary: The Director of the National Computer and Cybercrimes Co-ordination Committee must, subject to section 13(3) of the Act, and in collaboration with the relevant sector Regulator on an annual basis, monitor and inspect any Cybersecurity Operations Centres to ensure compliance with the Act and these Regulations.

AI-assisted research summary: The Director may, upon request and when there is an imminent cyber-attack threat, inquire into or provide technical or non-technical support to a Cybersecurity Operations Centre.

AI-assisted research summary: Owners of critical information infrastructure must perform annual cyber-risk assessments and business impact analyses, undertake a one-time risk assessment within twelve months of commencement, and submit a risk register to the Committee through the Director that contains specified evaluations and remediation information.

AI-assisted research summary: The Committee must coordinate the collection and analysis of cyber threat intelligence by collaborating with the specified Cybersecurity Operations Centres.

AI-assisted research summary: The Director shall designate critical information infrastructure in the manner specified in the Act and these Regulations.

AI-assisted research summary: The Director must notify the owner in writing within seven days of designating a critical information infrastructure.

AI-assisted research summary: The Director must, within thirty days of issuing the regulation 19 notice, issue directives under section 9(4) of the Act to the owner/operator of critical information infrastructure, including requirements to conduct annual risk assessments, develop incident response plans, implement security measures, and train personnel.

AI-assisted research summary: If timelines expire and an owner fails to implement directives, the Director must issue a show-cause notice; the Director may enter an implementation plan after giving the owner a hearing, may order suitable actions or administrative sanctions, and the owner may appeal the Committee's decisions to the High Court.

AI-assisted research summary: The Committee must consult the owner and, within seven days of identifying a critical information infrastructure, submit recommendations for gazettement to the National Security Council; the owner may apply to the Committee for gazettement; and the Committee must be guided by criteria in section 9(2) when identifying critical information infrastructure.

AI-assisted research summary: An owner of a critical information infrastructure may apply in writing to the Director to have a system declared a critical information infrastructure.

AI-assisted research summary: If the Director declines an application to designate a system as critical information infrastructure, the Director must notify the applicant in writing with reasons within thirty days; an applicant dissatisfied with that decision may apply regulation 73 on dispute resolution. The provision also requires designation and notification by notice in the Gazette within seven days (text does not specify the actor for that requirement).

AI-assisted research summary: The Director must keep and maintain a Register of critical information infrastructure; owners must furnish the Director with additional or changed material particulars within twenty-one days of designation.

AI-assisted research summary: Owners of critical information infrastructure must notify the Director before making significant changes; notifications must use Form CMCA 2 and specify the reason; the Director may provide feedback within seven days; contravention is an offence under section 14(2)(b)(c) and (d) of the Act.

AI-assisted research summary: Owners of designated critical information infrastructure must notify the Director in Form CMCA 2 within seven days prior to a change of ownership.

AI-assisted research summary: Owners of designated critical information infrastructures must keep critical information domiciled in Kenya; to place such information outside Kenya they must apply to the Committee in Form CMCA 3, and the Committee must verify security standards, consult security bodies, and communicate its decision within thirty days.

AI-assisted research summary: Owners of designated critical information infrastructure must implement directives received under regulations 20 and 21 within the time specified in the Director's notice; owners may request written support from the Director to implement those directives.

AI-assisted research summary: Owners of critical information infrastructure must build capacity by creating administrative instruments and awareness programmes, include specified cybersecurity topics, provide communications and periodically review the awareness programme in consultation with the Committee to keep it adequate and up-to-date.

AI-assisted research summary: Section 31 lists baseline security measures and activities for designated critical information infrastructure, including regular review, data-protection measures, compliance with directives, appointment of a Chief Information Security Officer, asset identification and cataloguing, access management, personnel background checks, training and awareness, monitoring and response, physical protection, maintenance and updates, business continuity and disaster recovery tests, annual risk assessments and internal audits, a risk register, exercises and drills, and adoption of approved best practices and standards.

AI-assisted research summary: Owners of critical information infrastructure must designate or appoint a Chief Information Security Officer; multiple owners may jointly appoint a single officer if accessible to each owner.

AI-assisted research summary: Section holds a master’s degree in information security, computer science, information technology or a related field;

AI-assisted research summary: Owners of designated critical information infrastructure must create and annually update organizational policies and procedures (including storage, sharing, transfer, and software security measures) and perform vulnerability assessments and configuration reviews.

AI-assisted research summary: Licensed operators of international or national internet gateways must comply with the Regulations' cybersecurity standards, submit compliance reports on request within thirty days, immediately report congestion or suspicious activity, and prepare and submit technical and routing records on request; non-compliance may lead the Committee to recommend license restriction, suspension or revocation or other actions.

AI-assisted research summary: Operators of critical information infrastructure must integrate or permit integration with other information infrastructure if required safety standards and safeguards in paragraph (2) are satisfied.

AI-assisted research summary: Owners/operators of critical information infrastructure must implement safeguards to secure the premises and surrounding areas and must take specific measures (listed in subsections) to protect systems, equipment and confidentiality, integrity and availability.

AI-assisted research summary: Owners of critical information infrastructure must implement security clearance systems and monitor and restrict access; they must notify authorities if access requirements are violated.

AI-assisted research summary: Persons seeking virtual access to designated critical information infrastructure must follow Regulation 38 (as modified) and implement specific security measures including least-privilege access, logging and monitoring, intrusion detection/prevention, and regular audits and penetration testing.

AI-assisted research summary: Section requires a register of persons accessing critical information infrastructure and lists what that register must record; the owner may set other requirements.

AI-assisted research summary: An owner of a critical information infrastructure may place information in an archive for storage if the infrastructure or data is no longer immediately required for use.

AI-assisted research summary: Owners of critical information infrastructure must establish disaster recovery and backup sites and take specified backup, retention, restoration and incident-recording measures.

AI-assisted research summary: Owners of critical information infrastructure must notify the Director in writing if they intend to transfer part or all of the infrastructure.

AI-assisted research summary: The Director must appoint or designate auditors for critical information infrastructure audits, issue them an appointment certificate, auditors are deemed staff of the Committee, and must carry and produce the certificate when auditing.

AI-assisted research summary: The auditor has the power to enter premises (the building and surrounding area of a critical information infrastructure) to monitor and evaluate compliance with directives, provided the auditor gives a thirty-day notice to the owner of the critical information infrastructure.

AI-assisted research summary: Owners of designated critical information infrastructure must file a compliance report containing specified assessments and records; the Director must forward the report to the Committee within seven days; the Committee must issue recommendations and the Director must communicate them to the owner within seven days; the Committee must submit reports to the National Security Council; recommendations are to be evaluated by the auditor in the next audit.

AI-assisted research summary: The Director of the National Computer and Cybercrimes Co-ordination Committee must conduct an annual audit of critical information infrastructure and must also carry out an audit when there is an imminent threat or an attack that could lead to a cybercrime.

AI-assisted research summary: Audits under these Regulations must use both a compliance-based and a risk-based approach; the compliance approach requires the designated auditor to carry out compliance tests of controls, and the risk-based approach must identify risks and check that controls mitigate them.

AI-assisted research summary: Section 49 specifies the required content of an audit report for critical information infrastructure.

AI-assisted research summary: Sets procedures and timelines for audit report handling: the Auditor must furnish the Director within 14 days of completing the audit; the Director must table the report before the Committee within 7 days of receipt; the Committee must issue recommendations; the Director must communicate those recommendations to the owner within 7 days; and the auditor must evaluate recommendations in the subsequent audit.

AI-assisted research summary: National Public Key Infrastructure components include the Root Certification Authority, Certification Authorities, Registration Authorities, and Subscribers.

AI-assisted research summary: The Root Certification Authority must perform functions including establishing certificate policy, accrediting and auditing certification authorities, licensing and regulating certification authorities, overseeing cross‑certification, inspecting infrastructure, developing technical requirements, reporting to the committee at least annually, and building awareness and capacity for the digital certification ecosystem.

AI-assisted research summary: Certification Authorities must use a trustworthy system when performing services; they may be public or private and must provide public key infrastructure services.

AI-assisted research summary: The Certification Authority may appoint any person or entity as a Registration Authority.

AI-assisted research summary: Subscribers must obtain a digital certificate from a Certification Authority.

AI-assisted research summary: The Committee on the National Public Key Infrastructure must formulate national public key infrastructure policies and standards.

AI-assisted research summary: The Committee must formulate a National Cyber Protection Framework; that Framework must provide a cyber-defence strategy and must provide for training, information-sharing, guidance notes, a National Cybersecurity Academy, research on emerging technologies, and technical certification standards.

AI-assisted research summary: The Committee must formulate and periodically review the National Training Guide and carry out functions listed in Section 58(2) to promote cybersecurity training, standards, education and workforce development.

AI-assisted research summary: Establishes trusted networks of information-sharing partners and administrative guidelines for identifying trusted organizations.

AI-assisted research summary: Requires attestation of compliance of cybersecurity products, services, and processes with specified security requirements to protect data and functions throughout their life cycle.

AI-assisted research summary: The Committee must disseminate and make available the standards, reference materials, checklists, or other instruments developed under this regulation.

AI-assisted research summary: Section 62 names types of entities with which the Committee may collaborate (public bodies at national and county governments; research or training institutions; private sector entities; international organizations; industry organizations) and lists collaboration areas (development of cybercrime and cybersecurity modules, research, standards, conferences, workshops, policy development, and other relevant areas).

AI-assisted research summary: The Committee must maintain an up-to-date database of certified cybersecurity institutions and professionals in Kenya.

AI-assisted research summary: The objective is to provide actionable information or complaints that may form a basis for investigations and prosecutions.

AI-assisted research summary: Section 65 states it facilitates investigations by law enforcement agencies.

AI-assisted research summary: Section 66 lists specific items that an incidence report to the Committee may include (such as contact details, type and description of threat, date/time, screenshots and other evidence) and states the incidence report may be made either by electronic means or physical means to the Committee.

AI-assisted research summary: The National Police Service must, within twelve months of these Regulations coming into force, establish a physical and virtual cybercrimes desk at every police station and police post staffed by appropriately trained members; officers at the desk must receive, assess, act on and escalate reported incidents and threats using Form CMCA 7.

AI-assisted research summary: Personnel at the cybercrimes desk must undergo specialized cybersecurity and digital forensics training; the Committee may recommend training to the National Police Service and must provide technical support on request.

AI-assisted research summary: The Committee and the National Police Service must run public awareness campaigns about cybersecurity and reporting; the Committee must set up, with the National Police Service, a mechanism for reporting cyber incidents to the nearest police station or post.

AI-assisted research summary: Requires the Committee, law enforcement agencies, or an organization to provide platforms for anonymous reporting of cyber incidents; obliges persons to report cyber-threats when they reasonably believe the information is true; entitles persons not to be penalized for public‑interest reporting made in confidence; makes malicious false reporting an offence under section 22 of the Act.

AI-assisted research summary: The Director must periodically identify and evaluate global cybersecurity best practices and recommend them for adoption by the Committee; the Committee may create SOPs based on those recommendations; owners of critical information infrastructure may independently identify and adopt global cybersecurity best practices.

AI-assisted research summary: Section aims to improve local, regional or global response to cyberattacks or to prevent cybercrime.

AI-assisted research summary: A person dissatisfied with a decision of the Committee or Cabinet Secretary may appeal to the High Court within thirty days; subsection (1) lists grounds (mistake apparent on the record; discovery of new and important evidence; any other sufficient reason).

AI-assisted research summary: The Data Protection Act applies to processing of personal data pursuant to the Act and these Regulations.