ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
39. Virtual access to critical information infrastructure.
Edition: 2024-02-16 · In force
39. Virtual access to critical information infrastructure.
(1)Regulation 38 shall, with necessary modifications, apply to any person who seeks virtual access to a critical information infrastructure.(2)In addition, the owner of a critical information infrastructure shall—(a)apply the principle of least privilege in granting access to critical information infrastructure systems;(b)implement security logging and monitoring system to capture logs from critical information infrastructure system and periodically analyse the logs to ensure integrity of the critical information infrastructure system including detection of cybersecurity threats, risks or unauthorized access;(c)install intrusion, detection and prevention systems in order to monitor network traffic, detect potential intrusions, and prevent unauthorized access; and(d)adopt procedures for conducting regular security audits and penetration testing to identify vulnerabilities and system weaknesses.