ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
46. Compliance report by owner of critical information infrastructure.
Edition: 2024-02-16 · In force
46. Compliance report by owner of critical information infrastructure.
(1)Pursuant to section 13 (1) of the Act, the compliance report shall—(a)demonstrate compliance with the critical infrastructure framework;(b)verify compliance with the requirements of the Act and these Regulations;(c)assess the adequacy and effectiveness of safeguards and measures put in place by the owner of a critical information infrastructure to satisfy the requirements of the Act and these Regulations;(d)assess whether the owner of a critical information infrastructure has in place and implements the organizational policies, standards and procedure on cyber security; and(e)identify risks and mitigation measure on a critical information infrastructure.(2)The compliance report submitted to the Director under this regulation shall contain—(a)risk assessment specifying the risks a critical information infrastructure is prone to and the mitigation measures the owner of a critical information infrastructure may apply; and(b)the risk register by the critical information infrastructure.(3)The Director shall within seven days of receipt of the compliance report submit it to the Committee.(4)Upon consideration of the compliance report under paragraph (2), the Committee shall issue recommendations and the Director shall within seven days communicate the recommendations to the owner of the Critical Information Infrastructure.(5)The recommendations by the Committee shall form the subject of evaluation by the auditor in the subsequent audit exercise.(6)The Committee shall submit its reports to the National Security Council.