ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
38. Access to information infrastructure.
Edition: 2024-02-16 · In force
38. Access to information infrastructure.
(1)An owner of a critical information infrastructure shall develop a system of security clearance levels for personnel and third parties authorized to access a critical information infrastructure.(2)An owner of a critical information infrastructure shall restrict and ensure adequate measures are in place to monitor permitted access critical information infrastructure system or data.(3)Without prejudice to the generality of paragraph (2), the measures contemplated under paragraph (2) may include-(a)taking lawful steps as may be necessary, to secure a critical information infrastructure and the personnel or third parties present at the critical infrastructure;(b)issuing, in writing, procedures for permitting entry to a critical information infrastructure;(c)ensuring that a notice on permitted entry is displayed in a conspicuous manner at the entrance to the critical information infrastructure;(d)providing a visitor management system or record keeping system specifying details on identification, registration, escorting and monitoring of personnel, third parties or any visitor to the premises;(e)providing mechanisms to protect critical information systems from any disaster including use of firefighting system and climate control equipment;(f)installing surveillance cameras at suitable locations for purposes of monitoring the movements and activities within areas hosting a critical information infrastructure;(g)formulating organization and operational guidelines to guide the personnel, third parties on the physical or virtual access of the critical information infrastructure; and(h)undertaking any action necessary to restrict access to a critical information infrastructure.(4)For purposes of being granting permission to access a critical information infrastructure a person shall-(a)furnish proof of their identity including any other relevant information critical information infrastructure;(b)declare possession of any item, object or thing that may be dangerous to the safety of the critical information infrastructure;(c)declare the contents of any vehicle, suitcase, bag, handbag folder, envelope, parcel or container of any nature, which is in the possession, custody or control of the person; and(d)subject himself and anything in his possession or under his control to scrutiny and examination by either electronic or other apparatus, for purposes of determining possession of any dangerous or prohibited item, thing or object.(5)Upon granting access to a critical information infrastructure, the owner of all critical information infrastructure shall require the person granted access to comply with the conditions for access which may include-(a)carrying or displaying of the proof of permitted access;(b)adhering to the restrictions of access to certain parts of the critical infrastructure including restricted access to the personnel within the critical information infrastructure;(c)complying with the permitted duration of access to the critical information infrastructure; and(d)monitored access including being escorted while on or in the critical information infrastructure.(5)An owner of a critical information infrastructure may, at any time, remove any person who has accessed the critical information infrastructure under this regulation, if-(a)it is established that the access was unauthorized;(b)access was authorised but the person is in breach, refuses or fails to comply with any conditions for access to the critical information infrastructure; or(6)An owner of a critical information infrastructure shall, where there is a violation of any of the requirements on access to a critical information infrastructure specified under the Act of these Regulations, inform the relevant government institution investigate or prosecute a person on any offence specified under Part III of the Act.