ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
29. Obligations of owners.
Edition: 2024-02-16 · In force
29. Obligations of owners.
(1)Upon receipt of the notice and directives under regulations 20 and 21, the owner of a critical information infrastructure shall implement the directives within the time specified in the notice issued by the Director.(2)An owner of a critical information infrastructure shall implement effective measures to ensure-(a)the physical security of the hardware and other details of the critical infrastructure where the critical information infrastructure system is located;(b)limitation of access to the critical information infrastructure or information stored in the critical information infrastructure;(c)periodic maintenance and security testing;(d)the facilitation of prompt access to the critical information infrastructure by authorized persons in the event of a cybersecurity incident or during auditing for compliance under section 13 of the Act;(e)administrative control of personnel having access to various components of the critical information infrastructure;(f)limitations on use of removable storage devices;(g)preparedness against damage or unauthorized access plans in the event of a disaster, breach or loss of a critical information infrastructure;(h)conduct of risk assessment identifying risk based security factors necessary to protect public health and safety, or national socio-economic security, where applicable; or(i)utilize innovative methods available in the market of securing the critical information infrastructure against cyber-attack.(3)The owner of a critical information infrastructure may request, in writing, any support from the Director, which may be necessary for the effective implementation of the directives.