Who it applies to
Deposit-taking and specified non-withdrawable deposit-taking SACCOs supervised by the SACCO Societies Regulatory Authority. ICT risk is covered in SASRA's Guideline on Risk Management Practices (2015) and related directives rather than a single cybersecurity regulation.
Key obligations
| Requirement | What it means in practice |
|---|---|
| ICT governanceRisk Management Practices Guideline, 2015 | The board approves the ICT strategy and policy; senior management keeps member data and the core system secure.vCISO, GRC & Privacy |
| Security policiesRisk Management Practices Guideline, 2015 | Policies covering information classification, access control, change control, personnel and physical security, and business continuity.Identity & Privileged AccessData Loss Prevention |
| Incident reportingRisk Management Practices Guideline, 2015 | Report significant adverse incidents to SASRA in a timely manner.Detection & Response |
| April 2026 holiday-period circular | Issued ahead of the Easter and Labour Day holidays, it directed SACCOs to keep offline backups, maintain 24/7 monitoring with response capability, guard against insider collusion, and warned that officials could be personally liable for losses from non-compliant vendor contracts.Detection & ResponseIdentity & Privileged Access |
Good to know
- SACCOs are financial services providers, so they must register with the ODPC and meet the Data Protection Act in full.
- Round-the-clock monitoring is hard for a small IT team to staff; detection platforms with AI-assisted correlation, such as XDR, cut the noise to what matters.
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- Identity & Privileged Access: too many people have too much access.
- Data Loss Prevention: sensitive data is leaving the organisation.
- Detection & Response: too many alerts and not enough visibility.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.