ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
13. Outsourced capabilities.
Edition: 2024-02-16 · In force
13. Outsourced capabilities.
(1)An owner of a critical information infrastructure who intends to outsource services from an external service provider shall, in writing, notify the Committee prior to outsourcing.(2)The owner of a critical information infrastructure shall enter into a written agreement with the external service provider and shall ensure that the outsourced capabilities do not confidentiality, integrity and the availability of the critical information infrastructure.(3)Despite paragraphs (1) and (2), the owner of a critical information infrastructure shall be held responsible for any outsourced cybersecurity capabilities.(4)Where the service involves granting access of the database to the external service provider, the owner of a critical information infrastructure shall prior to entering into an agreement with the external service provider—(a)assess the cybersecurity risks involved in the engagement; and(b)ensure that the external service provider undertakes to mitigate the risks identified under paragraph (a) and consents to-(i)limitation of the data that the external service provider may process and the permitted purposes of its use as specified in the agreement;(ii)limitation of the database systems that the external service provider may access;(iii)the nature of processing activities that the external service provider may perform;(iv)the duration of the agreement;(v)the processing of the data at the conclusion of the agreement including submission of the data to the owner of critical information infrastructure;(vi)the destruction or disposal of any material at the end of the contract and the reporting requirement to the of a critical information infrastructure;(vii)the implementation of data security obligations which apply to the processor of the database according to these Regulations, and additional data security instructions set by the owner of critical information infrastructure, if any; and(viii)the use of data and the implementation of data security measures specified in the agreement.(5)Where an owner of critical information infrastructure permits an external service provider to provide a service through another entity, it shall be the duty of the owner of critical information infrastructure to include in the agreement the obligations and all the matters detailed in these Regulations of other entity in the agreement.(6)The external service provider shall, on a quarterly basis, notify to the owner of the critical information infrastructure, on the status of implementation of their obligations under the agreement and on any cybersecurity incident.