Who it applies to
Commercial banks licensed by the Central Bank of Kenya, under the Guidance Note on Cybersecurity (2017). Payment service providers have a separate 2019 cybersecurity guideline. In September 2026 the CBK published a draft replacement guidance note for banks for public comment.
Key obligations
| Requirement | What it means in practice |
|---|---|
| Board and senior managementGuidance Note on Cybersecurity, 2017 | The board sets the tone and ensures adequate resources for cybersecurity; senior management implements the programme and the incident response plan.vCISO, GRC & Privacy |
| Chief Information Security OfficerGuidance Note on Cybersecurity, 2017 | Appoint a CISO at senior management level who reports to the CEO at least quarterly on security, policy exceptions, programme effectiveness and material events.vCISO, GRC & Privacy |
| Incident reportingGuidance Note on Cybersecurity, 2017 | Report significant and adverse cyber incidents to the CBK within 24 hours, and submit quarterly incident reports.Detection & Response |
| Payment service providersGuideline on Cybersecurity for PSPs, 2019 | Incident reporting within 24 hours (2 hours for systemically important payment systems), a mandatory CISO, and CBK notice before outsourcing, with prior approval needed to outsource security operations.Detection & ResponsevCISO, GRC & Privacy |
| Draft 2026 update (not yet final)CBK draft guidance, September 2026 | Proposes immediate 24-hour reporting plus a post-resolution report and quarterly returns, connection to a banking sector SOC with a named liaison, regular vulnerability assessment and penetration testing, and an annual external audit, alongside a companion draft on third-party technology and cloud providers.Detection & ResponseOffensive Security |
Good to know
- The 2017 Guidance Note remains in force until the 2026 draft is finalized. Comments on the draft close on 7 November 2026.
- Banks also remain subject to the Data Protection Act, including the 72-hour breach notification to the ODPC where personal data is affected.
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- Detection & Response: too many alerts and not enough visibility.
- Offensive Security: we don't know where our real weaknesses are.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.