ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
34. Mandatory requirements.
Edition: 2024-02-16 · In force
34. Mandatory requirements.
(1)An owner of a critical information infrastructure shall within six months from the date of commencement of these Regulations, formulate, review and update on an annual basis organizational policies, procedures and codes of practice to ensure the protection, preservation and management of the critical information infrastructure.(2)Without prejudice to the generality of paragraph (1), the of a critical information infrastructure shall in the instruments specified under paragraph (1) specify—(a)the storage and archiving procedures;(b)modalities for—(i)sharing of critical information infrastructure system or data within the organization;(ii)transfer of critical information infrastructure system or data to third parties; and(iii)collection, use, storage, retention, deleting, correction, transfer or sharing of critical information infrastructure system or data.(3)The owner of a critical information infrastructure may implement cybersecurity requirements relating to projects, software and their application on a critical information infrastructure, which may include—(a)using secure coding standards;(b)using trusted and licensed sources for software development tools and libraries;(c)conducting compliance tests for software against the defined organizational cybersecurity requirements;(d)securing integration between software components; or(e)conducting a configurations’ review, secure configuration and hardening and patching before deployment of software products.(4)Where an owner of a critical information infrastructure intends to change the management or make any material change to the critical information infrastructure’s projects, software and their application, the owner shall undertake—(a)vulnerability assessment and remediation; and(b)conduct a configurations’ review, secure configuration and harden and patch prior to making the changes or going live for technology projects.