Who it applies to
Owners and operators of systems designated as critical information infrastructure by Gazette notice, with detailed duties set out in the Critical Information Infrastructure and Cybercrime Management Regulations, 2024. The Act was amended by Act No. 17 of 2025.
Key obligations
| Requirement | What it means in practice |
|---|---|
| Designation and directivesSection 9 | Designated systems are subject to directives on data classification, incident management, disaster recovery and minimum security measures.vCISO, GRC & Privacy |
| Reporting and complianceSections 11 and 13 | Report threatened attacks to the National Computer and Cybercrimes Co-ordination Committee, file an annual compliance report and cooperate with audits.Detection & ResponsevCISO, GRC & Privacy |
| Incident reportingCII Regulations 2024, reg. 65 | Report incidents to the sectoral cybersecurity operations centre within 24 hours.Detection & Response |
| Chief Information Security OfficerCII Regulations 2024, regs. 32 and 33 | Appoint a CISO who is a Kenyan citizen with at least five years' relevant experience.vCISO, GRC & Privacy |
| Risk assessment and localizationCII Regulations 2024, regs. 17 and 28 | Annual risk assessment and business impact analysis; keep critical information infrastructure in Kenya unless approved otherwise.Offensive SecurityvCISO, GRC & Privacy |
Good to know
- These duties apply only to systems formally designated as critical information infrastructure. Confirm whether any of your systems are designated.
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- Detection & Response: too many alerts and not enough visibility.
- Offensive Security: we don't know where our real weaknesses are.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.