ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
32. Designation of the Chief Information Security Officer.
Edition: 2024-02-16 · In force
32. Designation of the Chief Information Security Officer.
(1)An owner of critical information infrastructure shall designate or appoint a Chief Information Security Officer on such terms and conditions as the owner may determine.(2)Without prejudice to paragraph (1), owners of critical information infrastructure may jointly appoint a single Chief Information Security Officer, provided that the officer is accessible by each owner.(3)The Chief Information Security Officer shall amongst other duties, be—(a)responsible for-(i)cybersecurity matters in the organization in which the critical information infrastructure is domiciled;(ii)developing, implementing, and enforcing security policies to protect critical information infrastructure;(iii)analysing information technology security threats in real-time and mitigating the threats;(iv)ensuring that newly-acquired technology with the cybersecurity standards;(v)collaborating with the National Cybersecurity Operations Centre, Sector Cybersecurity Operations Centres and other relevant stakeholders to determine possible risks and risk complies management processes;(vi)advising the owner of a critical information infrastructure;(vii)creating cybersecurity awareness amongst members of staff and users; owner of a critical information(viii)assisting in detection, identification, prevention, response, and recovery measures for cyber threats risks or incidence in the organization; and(ix)ensuring compliance of the organization with the requirements of the Act and these Regulations; and(b)the point of contact for the cybersecurity matters for the organization.