Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations

24. Consideration of application for declaration of critical information infrastructure

Edition: 2024-02-16 · In force

24. Consideration of application for declaration of critical information infrastructure

Upon receiving an application for declaration of a system as critical information infrastructure under section 9 of the Act, the Director shall-(a)be guided by the criteria specified under section 9(2) of the Act in order to determine whether the system qualifies for designation as a critical information infrastructure;(b)evaluate the potential risk of the system, taking into account-(i)the probability of failure, disruption or destruction of the system in question or threat thereof;(ii)the impact and consequence of failure, disruption or destruction of infrastructure or threat thereof; and(iii)the extent to which the designation as critical.

(2)Where the Director is satisfied that the system has met the criteria for designation as a critical infrastructure, the Director shall-

(a)within seven days by notice in the Gazette designate the system as critical information infrastructure; and

(b)notify the applicant, in writing, of the designation.

(3)Where the Director declines the application for designating a system as a critical information infrastructure, the Director shall, in writing, notify the applicant of the decision with reasons within thirty days.

(4)Where an applicant is dissatisfied with the decision under paragraph (3), the applicant may apply the provision of regulation 73, on dispute resolution.

← Previous provision Next provision →

Source: Kenya Law