ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
26. Changes to critical information infrastructure.
Edition: 2024-02-16 · In force
26. Changes to critical information infrastructure.
(1)In this regulation-"significant change" means a new system, integration of modification whose new functionalities may compromise the confidentiality, integrity and availability of the critical service.(2)An owner of a critical information infrastructure shall not make any significant changes to the design, configuration, security or operations of a critical information infrastructure, without prior notification to the Director.(3)The notification contemplated under paragraph (2), shall be in Form CMCA 2 set out in the Third Schedule and shall specify the reason for the changes to the critical information infrastructure.(4)The Director shall upon receiving the notification submitted under paragraph (3) consider the following-(a)evaluate the implications of the proposed changes to the operations, personnel, and infrastructure of the critical information infrastructure;(b)whether there may be any requirement for additional directives from the Committee to safeguard the security, confidentiality and integrity of the critical information infrastructure; or(c)any other consideration that the Committee may deem necessary.(5)The Director may, pursuant to a notification issued under paragraph (2), provide feedback to an owner of a critical information infrastructure, within seven days of receipt of the notification.(6)Any person who contravenes the provisions of this regulation commits the offence specified under section 14(2)(b)(c) and (d) of the Act.