ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
31. Baseline security for critical information infrastructure.
Edition: 2024-02-16 · In force
31. Baseline security for critical information infrastructure.
(1)An owner of a designated critical information infrastructure shall adhere to the following baseline security requirements to ensure the protection of the critical information infrastructure-(a)develop and implement an internal cybersecurity policy addressing the risks associated with the critical information infrastructure risks, consistent with the provisions of the Act and these Regulations and best practices relevant to the relevant sector and which shall-(i)be reviewed, at least annually, consistent with identified risks and threats affecting the specific critical information infrastructure sector;(ii)address data protection concerns of the designated critical information infrastructure, consistent with the provision of the Data Protection Act (Cap. 411C);(b)implement and comply with the directives issued under regulation 20; and(c)appoint or designate a Chief Information Security Officer in accordance with the requirements of regulation 32.(2)The owner of a critical information infrastructure shall adopt the following technical and organizational measures for the protection of the designated critical information infrastructure-(a)identification, classification and cataloguing of all critical information infrastructure assets;(b)regulating and managing access to critical information infrastructure systems and services;(c)implementing the relevant security measures to mitigate cyber risk posed by employees, customers, suppliers, service providers, and other third-party affiliates;(d)conducting background checks all personnel handling critical information infrastructure information or data in the designated critical information infrastructure;(e)providing appropriate level of information and conducting cybersecurity awareness and training for all employees of the owner of a designated critical information infrastructure;(f)implementing appropriate security monitoring and response process for timely detection of cybersecurity incidents targeting the designated critical information infrastructure;(g)implementing relevant physical security measures for the physical protection of critical information infrastructure systems and its associated dependent assets and systems;(h)implementing relevant infrastructure and cybersecurity measures to mitigate equipment failure including maintenance and software updates;(i)developing periodic test and updating business continuity and disaster recovery plan to ensure adequacy of such plans to support incident response and security redundancy operations;(j)conducting annual cybersecurity risk assessment to identify existing vulnerabilities to which the designated critical information infrastructure is exposed as contemplated by regulation 18;(k)conducting annual cybersecurity internal audits to check compliance with the directives under regulation 20;(l)creating and maintaining a cybersecurity risk register with catalogues and profiling the various information and cyber risks targeted at the designated critical information infrastructure;(m)conducting and participating in cybersecurity exercises and drills, in collaboration with the Committee and other critical information infrastructure sectors for the purposes of verifying readiness of the owner of designated critical information infrastructure in responding to cybersecurity incidents; and(n)adopting relevant cybersecurity best practices, frameworks and standards, approved by the Committee.