ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
2. Interpretation.
Edition: 2024-02-16 · In force
2. Interpretation.
In these Regulations, unless the context otherwise requires-"Act" means the Computer Misuse and Cybercrimes Act (Cap. 79C);"accreditation certificate" means an accreditation certificate issued by the Information and Communication Technology Authority established under the Information and Communications Technology Order (L.N. 182 of 2013);"attribution" includes the process of tracking and identifying the perpetrators of a cyber-attack;"auditor" means a person designated or appointed by the Director to conduct a cybersecurity audit of a critical information infrastructure as provided under regulation 33;"certificate practice statement" means the rules and operating practices guiding the Certification Authority in providing digital certificate services which may include a description of service offered, detailed procedures for certificate lifecycle management, operational information, legal obligations or financial liabilities;"certificate policy" means a set of rules that indicate the applicability of the certificate practice statement to a particular community or class of applications with common security requirements;"Chief Information Security Officer" means the person designated or appointed as a Chief Information Security Officer pursuant to regulation 32;"critical information infrastructure" means a system designated pursuant to section 9 of the Act and includes critical information infrastructure system or data and national critical information infrastructure;"cybersecurity" means tools, policies, security safeguards, guidelines, risk management approaches, actions, trainings, best practices, assurance and technologies utilized to protect the cyber environment;"cryptography" includes the use of system to secure information or data;"cybersecurity incident" means an occurrence that-(a)jeopardizes without lawful authority, the integrity, confidentiality, or availability of information or an information system; or(b)constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies."Cybersecurity Operations Centre" means the capability that encompasses cutting-edge technology, tools and a team of cybersecurity experts organized to protect, monitor, detect, analyse, respond and report on cybersecurity incidents and threats;"cybersecurity service provider" means a third-party individual or organization that provides security services to secure critical information infrastructure against potential cyber security threats;"designation" includes declaration of a critical information infrastructure by notice in the Kenya Gazette as contemplated by sections 11 and 13 of the Act;"digital trust" means user confidence in the security, fairness and reliability of digital environments established through actions, controls and behaviour of the personnel in an organization;"Director" means the Director of the National Computer and Cybercrimes Co-ordination Committee appointed under section 7 of the Act;"emerging technologies" means the application of new technologies and ongoing developments in the use of existing technologies that have the potential to impact cybersecurity;"establishment documents" include(a)a Statute, Charter or statutory instrument in which a body is established;(b)registration certificate;(c)trust deeds in which a trust has been established; or(d)other instruments by which a body is established including its governing and administrative structure."imminent threat" includes an occurrence that actually jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system;"information system" means an integrated set of components of technology, data and procedures for processing information which includes collecting, storing, and disseminating information;"international internet gateway" means any facility that provides an interface to send and receive electronic communication traffic between one country's domestic network facilities and those in another country;"internet gateway" means devices or systems that serve as entry and exit points between different networks, and allows data flow between networks to facilitate communication between networks that use different protocols or technologies, ensuring that information may be routed and transmitted;"internet protocol address allocation" means the allocation of the unique identifying number assigned to every device connected to the internet;"internet service provider" means a company that provides access to the internet through multiple means, including wireless and fiber-optic connections;"national internet gateway" means the internet gateway owned and operated by the Government of Kenya;"national public key infrastructure" means a system of policies, procedures, technology and services required to create, issue, manage, distribute and revoke digital certificates, used to verify the online identity of individuals, organizations or devices by use of an identifiable public key cryptography to obtain secure communication;"network equipment interface" means a device that serves as the demarcation point between the internet gateway and the customer's premises wiring;"owner of critical information infrastructure" includes the operator or authorized person in control of critical information infrastructure;"premises" includes the building and the area surrounding the building in which a critical information infrastructure is situated;"principle of least privilege" means an information security model that restricts access to the specific data, resources and applications required to undertake a task to a specific user of entity;"public key" means a technical infrastructure comprising of a root certification authority and certification authority or an Electronic Certification Service Provider;"Root Certification Authority" means the Certification Authority contained in a National Public Key Infrastructure as provided under regulation 51;"Secretariat" means the Secretariat of the Committee established under section 7 of the Act;"subscriber" means a person that has applied for and issued with a digital certificate from a Certification Authority;"system" means the digital or physical components that compromise a critical information infrastructure;"third party" means an external entity having a written or implied contractual relationship with the first-party organization and may include service providers, vendors, supply-side partners, demand-side partners, alliances, consortiums and investors;"tool engineering" includes developing and testing new designs in relation to cybersecurity and carrying out quality assurance tests;"transfer of a critical information infrastructure" includes copying or moving a program or data to-(a)any computer system, device or storage medium other than that in which it is stored;(b)a different location in the same computer system, device or storage medium in which it is stored;(c)cause it to be an output from a computer in which it is held whether by having it displayed or in any other manner; or(d)using it by causing the computer to execute a program itself a function of the program;"vulnerabilities” means weaknesses in a computer, computer system or critical information infrastructure, information system, security procedures, internal controls or implementation that may be exploited to gain unauthorized access or that may be exploited or triggered by a threat source.