ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
17. Risk assessment and evaluation of Cybersecurity Operations Centres.
Edition: 2024-02-16 · In force
17. Risk assessment and evaluation of Cybersecurity Operations Centres.
(1)An owner of a critical information shall, on an annual basis, conduct a cyber-risk assessment and business impact analysis for all relevant activities including products, services, business functions and processes.(2)Despite paragraph (1), every owner of critical information infrastructure shall undertake a risk assessment within twelve months from the date of commencement of these Regulations.(3)The cyber-risk assessment contemplated under paragraph (1) shall-(a)identify potential internal and external threats including single points of failures that may cause disruption to critical activities;(b)assess and prioritize potential risks and evaluate potential threats based on their operational impact and probability of their occurrence;(c)select required controls to manage identified risks;(d)define a treatment plan and implement business continuity management controls including-(i)information technology disaster recovery plan;(ii)crisis management plan;(iii)business continuity plan;(iv)cyber-incidences response plan; and(v)emergency response plan;(e)evaluate the organization’s security policies, procedures, codes of practice and the structuring of the security function;(f)evaluate the methodology applied in management of the security procedures and the availability of tools to ensure security of the computer system and of the mode of utilizing the tools;(g)undertake a technical analysis of the security of all components of the computer system by conducting system integrity tests to ensure system resistance to all kinds of dangers; and(h)analyse and evaluate any dangers that may operating systems with any deficiencies discovered during the risk assessment exercise.(4)The business impact analysis of infrastructure shall be based on—(a)the potential impacts of business disruptions for each prioritized business function and processes including financial, operational, customer, legal and regulatory impacts;(b)recovery time objectives, recovery point objectives and maximum acceptable outage;(c)internal and external inter-dependencies; and(d)the resources required for recovery.(5)An owner of critical information infrastructure shall, at the conclusion of the risk assessment exercise, submit a risk register to the Committee through the Director.(6)The risk register under paragraph (5) shall contain—(a)a description and complete evaluation of the security of the computer systems of the organization or critical information infrastructure;(b)the implementation of the treatment plan and adopted measures proposed in the preceding risk assessment, if any, and the deficiencies observed in the implementation of recommendations;(c)a detailed analysis of the organization’s technical deficiencies regarding the security procedures and tools adopted including an evaluation of the risks that from operating with the deficiencies discovered; and(d)proposed organizational and technical security solutions be adopted in order to address any identified deficiencies.(7)The Committee may reject a risk register where—(a)the risk assessment is carried out in contravention of the Act and these Regulations; or(b)the risk register does not contain material information deficiencies identified by the exercise.