ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
11. Sector Cybersecurity Operations Centres.
Edition: 2024-02-16 · In force
11. Sector Cybersecurity Operations Centres.
(1)For the avoidance of doubt —(a)the Regulator of the specific Sector as set out in the Second Schedule in which the critical information infrastructure is domiciled; or(b)where applicable, the relevant Ministry where the critical information infrastructure is domiciled, shall be deemed the Sector Cybersecurity Operation Centre.(2)A Sector Cybersecurity Operations Centre shall be responsible for monitoring, detecting, preventing, responding and investigating cyber threats, that are specific to their respective Sector.(3)Without prejudice to the generality of paragraph (2), the Sector Cybersecurity Operations Centre shall –(a)collaborate, through information and threat intelligence sharing, within the Sector;(b)coordinate advanced cyber threat analytics particularly on Sector specific threats, incidence response, joint trainings or joint exercises and other cross-sectoral cybersecurity initiatives;(c)have visibility of threats and incidents that occur in the Critical Information Infrastructure Cybersecurity Operations Centres in the Sector;(d)have the requisite capability to perform the functions of a Sector Critical Information Infrastructure Cybersecurity Operations Centre;(e)convene consultative fora through meetings, colloquiums, webinars, workshops or other platforms on sectoral issues of common interest to the sectors in order to—(i)facilitate collaboration, consultation and co-ordination for the implementation of relevant policies and laws applicable in the Sector;(ii)make recommendations to the Sector aimed at improving cybersecurity at the Sector level;(iii)promote data and information sharing within the Sector including sharing of experiences and best practices on emerging issues in the Sector;(iv)where applicable, implement the recommendations of the National Cybersecurity Operations Centre;(v)build the capacity on cybersecurity in the Sector;(f)co-ordinate sectoral threat, monitor and respond to incidences in the Critical Information Infrastructure Cybersecurity Operations Centres in their respective Sector including—(i)collecting, analysing and responding to threats reported by the Critical Information Infrastructure Cybersecurity Operations Centres;(ii)having visibility of threats and incidents that occur in the Critical Information Infrastructure Cybersecurity Operations Centres;(iii)co-operating with computer incident response teams through sharing of threat intelligence to inform response to cyber incidents, utilizing technologies and tools;(iv)receiving real-time information on cyber threats and incidents from the Critical Information Infrastructure Cybersecurity Operations Centres;(v)threat and information sharing;(vi)incidence response coordination;(vii)joint exercises and training of the Critical Information Infrastructure Cybersecurity Operations Centres;(viii)supporting supply chain risk management efforts;(g)coordinate capacity building programs, research and development activities on cyber threats and incidents in the Sector;(h)report to the National Cybersecurity Operations Centre on all cyber incidents reported by the Critical Information Infrastructure Cybersecurity Operations Centres in the Sector;(i)undertake research and development for tool engineering;(j)facilitate collaboration and cooperation amongst Critical Information Infrastructure Cybersecurity Operations Centres in the Sector;(k)utilize threat surveillance from internal and external sources to enhance its situational awareness and response capabilities; and(l)facilitate the implementation of standards operating procedures formulated by the Committee to guide the Operations of the Critical Information Infrastructure Cybersecurity Operations Centres.(4)The costs of operating each Sector Cybersecurity Operations Centre, shall be borne by the Regulator of the respective sector.