ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
30. Capacity building by owners of critical information infrastructure.
Edition: 2024-02-16 · In force
30. Capacity building by owners of critical information infrastructure.
(1)The owner of a critical information infrastructure shall-(a)formulate their respective administrative instruments or standard operating procedures which may include best practices and code of ethics for adherence by users or operators of the Critical Information Infrastructure; and(b)formulate and implement a cybersecurity awareness programme to create cybersecurity awareness for all persons who use, operate and manage the critical information infrastructure including-(i)to promote awareness of relevant laws, regulations, codes of practice, policies, standards, guidelines and procedures;(ii)provide regular and timely communication covering general cybersecurity awareness messages and prevailing cybersecurity threats, impacts and mitigations; and(iii)guide individual behaviour and the security.(2)The cybersecurity awareness programme referred to under paragraph (1)(b) shall include the following topics-(b)identification and reporting suspicious activity;(c)incident management and response;(e)best practices from each Sector including physical security of the critical information infrastructure and other relevant areas on cybersecurity;(f)risk assessment including threat, vulnerability, consequence and mitigation; and(g)emerging technologies.(3)The owner of critical information infrastructure shall in consultation with the Committee periodically review the cybersecurity awareness programme to ensure that the programme is adequate and that it remains up-to-date and relevant.