ADVOKS GLOBAL · KENYA
Computer Misuse and Cybercrime (The Critical Information Infrastructure and Cybercrime Management) Regulations
47. Requirement for audit.
Edition: 2024-02-16 · In force
47. Requirement for audit.
(1)The Director shall conduct an annual audit or at any time where there is an imminent threat or an attack that amounts to an attack to a computer or computer system that may result to a cybercrime as contemplated under section 13 (2) of the Act.(2)For the purposes of this regulation, an imminent threat may include—(a)evidence of unauthorized access to the critical information infrastructure;(b)credible intelligence from law enforcement agencies indicating a planned cyber-attack targeting the infrastructure;(c)an unusual network activity suggesting a potential security breach; or(d)any other circumstances as may be determined by the Committee.(3)The Director shall notify an owner of a critical information infrastructure in Form CMCA 5 set out in the Third Schedule of –(a)the date and time in which the audit shall be carried out;(b)the identification particulars of the auditor;(c)the requirement for the owner of the critical information infrastructure to furnish the Director with the staff or contact person in the organization responsible for the overall management and control of the critical information infrastructure audit;(d)the specific documents required to be furnished to the auditor, prior to or during the audit exercise;(e)the particulars of the auditor assigned to carry out the audit prior to the date of commencement of the audit exercise; and(f)any other details relevant for the effective discharge of the audit.