Cybersecurity Policy (Kenya)
CYBERSECURITY POLICY
Computer Misuse and Cybercrimes Act No. 5 of 2018 | Data Protection Act No. 24 of 2019
Organisation: [Organisation Name] (BRS No: [BRS Number])
Registered Address: [Organisation Address]
Responsible Officer: [CIS Officer]
Effective Date: [Effective Date]
Next Review Date: [Review Date]
1. PURPOSE AND LEGAL BASIS
1.1 This Cybersecurity Policy ('Policy') of [Organisation Name] establishes the rules, controls, and responsibilities for protecting the organisation's information systems, networks, data, and digital assets from unauthorised access, cyberattacks, and data breaches.
1.2 This Policy is adopted in compliance with the Computer Misuse and Cybercrimes Act No. 5 of 2018 (which criminalises unauthorised computer access under Section 3, cyber espionage under Section 6, and phishing under Section 28), the Data Protection Act No. 24 of 2019 (which requires appropriate technical and organisational security measures under Section 41), and the guidance of the National Computer and Cybercrimes Coordination Committee (NC4) and the Communications Authority of Kenya (CA).
1.3 Compliance with this Policy is mandatory for all users of the organisation's information systems.
2. SCOPE
2.1 This Policy applies to: [Covered Systems].
2.2 This Policy applies to: [Covered Users].
2.3 Data classification levels: [Data Classification]. All information assets must be classified and handled in accordance with their classification level.
3. ACCESS CONTROL
3.1 Authentication: [Password Policy]. Each user must have a unique user account. Sharing of login credentials is prohibited under Section 3 of the Computer Misuse and Cybercrimes Act No. 5 of 2018.
3.2 Access rights must be granted on a least-privilege basis — users receive only the access required to perform their job functions.
3.3 Access rights shall be reviewed [Access Review Frequency] and immediately revoked on termination of employment or engagement.
3.4 Privileged access to critical systems requires additional authorisation and logging.
4. NETWORK AND ENDPOINT SECURITY
4.1 All devices connected to the organisation's network must have up-to-date endpoint protection software and operating system patches.
4.2 All data transmitted outside the organisation's network must be encrypted using current industry-standard protocols (TLS 1.2 or higher).
4.3 Remote access to organisational systems must use a virtual private network (VPN) or equivalent secure channel.
4.4 Use of unauthorised removable storage media (USB drives, external hard drives) on organisational systems is prohibited without prior written approval from [CIS Officer].
4.5 Cloud services used by the organisation must be approved by [CIS Officer] and governed by a Data Processing Agreement under Section 43 of the Data Protection Act No. 24 of 2019.
5. INCIDENT DETECTION AND RESPONSE
5.1 All suspected cybersecurity incidents must be reported immediately to: [Incident Reporting Contact].
5.2 Data breach notification procedure: [Breach Notification Procedure].
5.3 External authorities to notify following a cybersecurity incident: [External Reporting Bodies].
5.4 Cybersecurity incidents must be documented in an incident register maintained by [CIS Officer]. A post-incident review must be completed within 30 days of every significant incident, and this Policy updated where gaps are identified.
6. EMPLOYEE TRAINING AND AWARENESS
6.1 All users must complete cybersecurity awareness training: [Training Frequency]. Training covers phishing awareness, password hygiene, safe internet use, physical device security, and incident reporting.
6.2 Completion of training is recorded by [CIS Officer] and is a condition of continued system access.
6.3 Employees who knowingly facilitate cyberoffences may be criminally liable under Section 39 of the Computer Misuse and Cybercrimes Act No. 5 of 2018.
7. THIRD-PARTY AND SUPPLIER SECURITY
7.1 All third-party suppliers, contractors, and cloud providers with access to the organisation's systems or personal data must sign a Data Processing Agreement incorporating security obligations consistent with this Policy and the Data Protection Act No. 24 of 2019.
7.2 [Organisation Name] reserves the right to audit the cybersecurity practices of third-party suppliers on reasonable notice.
8. ENFORCEMENT AND DISCIPLINARY ACTION
8.1 Violations of this Policy will be addressed as follows: [Disciplinary Consequences].
8.2 Policy violations that constitute criminal offences under the Computer Misuse and Cybercrimes Act No. 5 of 2018 will be referred to the Directorate of Criminal Investigations (DCI) Cybercrime Unit.
9. POLICY REVIEW AND GOVERNANCE
9.1 This Policy is reviewed at minimum annually, or following a significant cybersecurity incident, material technology change, or amendment to Kenyan cybersecurity law or regulatory guidance.
9.2 The responsible officer for this Policy is [CIS Officer]. All amendments require approval by the board of directors or senior management of [Organisation Name].
APPROVED BY [Organisation Name] on [Effective Date].
Chief Executive Officer / Authorised Signatory
________________
Signature
Chief Information Security Officer / Responsible Officer
________________
Signature
What Is a Cybersecurity Policy (Kenya)?
A Cybersecurity Policy in Kenya records the organisation's binding rules on the matter it addresses.
The National Computer and Cybercrimes Coordination Committee (NC4), established under Section 53 of the Computer Misuse and Cybercrimes Act No. 5 of 2018, coordinates Kenya's national cybersecurity response and provides guidance to both public and private sector organisations on minimum cybersecurity standards. The Communications Authority of Kenya (CA), established under the Kenya Information and Communications Act No. 2 of 1998, is the sector regulator for telecommunications and digital infrastructure and has published Cybersecurity Guidelines for Internet Service Providers, financial institutions, and critical information infrastructure operators in Kenya.
The Data Protection Act No. 24 of 2019, enforced by the Office of the Data Protection Commissioner (ODPC), requires every data controller and data processor in Kenya to implement appropriate technical and organisational security measures under Section 41 to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. A Cybersecurity Policy is the foundational organisational measure satisfying this requirement — it documents the security framework, assigns responsibilities, and creates an auditable record of the organisation's security posture for ODPC inspections under Section 30 of the Data Protection (General) Regulations 2021.
Financial institutions in Kenya operate under additional cybersecurity obligations. The Central Bank of Kenya (CBK) issued the Guidance on Cybersecurity for Payment Service Providers in 2021, requiring banks, payment service providers, and mobile money operators licensed under the National Payment System Act No. 39 of 2011 to maintain a documented cybersecurity policy reviewed at least annually. The Capital Markets Authority (CMA) issued cybersecurity guidance to licensed market intermediaries in 2020, requiring capital markets licensees to implement documented cybersecurity frameworks aligned with international standards.
A Kenya Cybersecurity Policy differs from a Data Breach Notification Template — which addresses the response steps after an incident has occurred — and from an Acceptable Use Policy — which governs how employees and users may use the organisation's information systems. A complete cybersecurity compliance framework requires all three instruments working together, supplemented by a Data Processing Agreement for third-party processors and a Data Subject Consent Form for personal data collection. Together these documents demonstrate to the ODPC, the NC4, and the Communications Authority of Kenya that the organisation has taken a systematic, documented approach to cyber risk management in compliance with Kenya's 2018 and 2019 digital laws.
The Kenya National Cybersecurity Strategy 2022–2027, published by the Ministry of Information, Communications and the Digital Economy, sets national targets for cybersecurity capacity building across Kenya's public and private sectors and references the Computer Misuse and Cybercrimes Act No. 5 of 2018 as the primary enforcement instrument. Organisations that suffer a material cyberattack without a documented Cybersecurity Policy face regulatory scrutiny from multiple Kenyan authorities simultaneously — the ODPC, the Communications Authority, the CBK (for financial institutions), and potentially the Directorate of Criminal Investigations (DCI) Cybercrime Unit if criminal activity is involved.
When Do You Need a Cybersecurity Policy (Kenya)?
A Kenya Cybersecurity Policy is required for any organisation that operates information systems, holds personal data, or processes financial transactions — and several Kenyan regulatory frameworks make a documented policy mandatory rather than merely advisable.
A Cybersecurity Policy is required for every data controller and data processor registered with the Office of the Data Protection Commissioner (ODPC) under Section 17 of the Data Protection Act No. 24 of 2019. The Data Protection (General) Regulations 2021 require controllers and processors to maintain documented records of their technical and organisational security measures, and an ODPC audit or investigation routinely requests the organisation's Cybersecurity Policy as the primary evidence of security governance.
A Cybersecurity Policy is needed when a financial institution — bank, microfinance institution, payment service provider, or mobile money operator — applies for or renews a licence with the Central Bank of Kenya (CBK) under the Banking Act (Cap. 488) or the National Payment System Act No. 39 of 2011. The CBK's licensing requirements include documentation of the applicant's information security framework, and the annual CBK supervisory review assesses whether the policy has been updated to address new threats.
A Cybersecurity Policy is required when an organisation applies for a licence with the Communications Authority of Kenya (CA) as an internet service provider, telecommunications provider, or content service provider under the Kenya Information and Communications Act No. 2 of 1998. The CA's Type Approval and Licensing Conditions require licensees to maintain documented cybersecurity procedures.
A Cybersecurity Policy is needed when a company tenders for government contracts in Kenya under the Public Procurement and Asset Disposal Act No. 33 of 2015. National Treasury procurement guidelines increasingly require bidders for ICT and data-handling contracts to demonstrate documented cybersecurity compliance, particularly for contracts with security-sensitive government entities.
A Cybersecurity Policy is required when an organisation onboards enterprise customers who conduct vendor due diligence before sharing commercially sensitive data. Large Kenyan corporates, multinational companies operating in Kenya, and development finance institutions such as the International Finance Corporation (IFC) routinely require suppliers and service providers to produce their Cybersecurity Policy as part of third-party risk assessments.
A Cybersecurity Policy is needed when a school, university, hospital, or NGO in Kenya handles sensitive personal data — student records, health data, or beneficiary information — and must demonstrate to donors, regulators, and accreditation bodies that personal data is protected in accordance with the Data Protection Act No. 24 of 2019 and international data governance standards.
What to Include in Your Cybersecurity Policy (Kenya)
A Kenya Cybersecurity Policy under the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Data Protection Act No. 24 of 2019 must contain the following essential elements to satisfy both regulatory requirements and practical security governance needs.
Scope and Purpose: A clear statement of the policy's scope — which systems, networks, data, employees, contractors, and third-party users it covers — and the policy's purpose by reference to the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Data Protection Act No. 24 of 2019. The policy must state that it applies to all users of the organisation's information systems, including permanent staff, temporary staff, interns, contractors, and third-party service providers.
Information Assets Inventory: A classification of the organisation's information assets — including hardware, software, data, network infrastructure, and cloud services — by sensitivity level (for example: public, internal, confidential, restricted). Kenya Revenue Authority (KRA) tax records, ODPC-registered personal data, CBK-regulated financial data, and confidential business information all require different levels of protection, and the policy must map asset classifications to the corresponding security controls.
Access Control: Rules governing who may access specific information assets, including: user authentication requirements (password standards, multi-factor authentication); role-based access control principles; procedures for granting, reviewing, and revoking access rights; and the requirement for a unique user ID for each person with system access. The policy must prohibit sharing of login credentials, consistent with the Computer Misuse and Cybercrimes Act No. 5 of 2018 prohibition on unauthorised access under Section 3.
Network and Endpoint Security: Requirements for firewall deployment and configuration; use of encryption for data in transit (TLS) and data at rest; endpoint protection software on all organisation-managed devices; patch management and vulnerability assessment schedules; and controls on the use of personal devices and removable media in connection with organisational systems.
Incident Detection and Response: Procedures for detecting, reporting, and responding to cybersecurity incidents — including suspected malware infections, phishing attacks, unauthorised access events, and ransomware. The policy must designate a cybersecurity incident response team and specify escalation paths. Where a cybersecurity incident constitutes a personal data breach, the policy must trigger the Data Protection Act No. 24 of 2019 breach notification procedure, including notification to the ODPC within 72 hours under Section 43(6).
Employee Training and Awareness: Mandatory cybersecurity training for all staff on joining the organisation and at regular intervals thereafter, covering phishing awareness, password hygiene, safe internet use, physical security of devices, and reporting suspected incidents. The Computer Misuse and Cybercrimes Act No. 5 of 2018 makes employees who knowingly support cyberoffences criminally liable under Section 39 (aiding and abetting), creating personal liability for staff who ignore security obligations.
Third-Party and Supplier Security: Requirements that all third-party suppliers, contractors, and cloud service providers who access the organisation's systems or data sign contractual security obligations — typically in a Data Processing Agreement under Section 43 of the Data Protection Act No. 24 of 2019 — and meet minimum security standards equivalent to those imposed on the organisation's own staff. The forms-legal.com Cybersecurity Policy template includes a supplier security assessment checklist aligned with the ODPC's vendor management guidance.
Business Continuity and Disaster Recovery: Backup procedures and schedules for all critical data and systems; recovery time objectives (RTOs) and recovery point objectives (RPOs); testing schedules for backup restoration; and procedures for maintaining operations during a cybersecurity incident or system outage. The Communications Authority of Kenya's Cybersecurity Guidelines recommend annual disaster recovery testing for organisations operating critical information infrastructure.
Policy Review and Governance: The policy must be reviewed and updated at least annually, or whenever a material change in the organisation's systems, operations, or the threat environment occurs. A named officer — typically the Chief Information Security Officer (CISO), Chief Technology Officer (CTO), or Data Protection Officer (DPO) registered with the ODPC — is responsible for policy maintenance and compliance monitoring. The board of directors or senior management must formally approve the policy.
Governing Law and Enforcement: Kenya law governs the policy, and compliance is enforced internally through the organisation's disciplinary procedures under the Employment Act No. 11 of 2007, and externally by the ODPC, the Communications Authority of Kenya, and the National Computer and Cybercrimes Coordination Committee (NC4) under the Computer Misuse and Cybercrimes Act No. 5 of 2018.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Cybersecurity Policy (Kenya) (Kenya) [Legal document template]. Forms Legal. https://forms-legal.com/kenya/business/policies/cybersecurity-policy-kenya
"Cybersecurity Policy (Kenya) (Kenya)." Forms Legal, 2026, https://forms-legal.com/kenya/business/policies/cybersecurity-policy-kenya.
@misc{formslegal-cybersecurity-policy-kenya,
author = {{Forms Legal}},
title = {Cybersecurity Policy (Kenya) (Kenya)},
year = {2026},
howpublished = {\url{https://forms-legal.com/kenya/business/policies/cybersecurity-policy-kenya}},
note = {Free legal document template}
}
Frequently Asked Questions
Kenyan law does not impose a universal statutory obligation on every business to maintain a named 'Cybersecurity Policy', but several overlapping regulatory frameworks effectively require one for most organisations. Section 41 of the Data Protection Act No. 24 of 2019 requires every data controller and data processor registered with the Office of the Data Protection Commissioner (ODPC) to implement appropriate technical and organisational security measures to protect personal data. A documented Cybersecurity Policy is the primary evidence of compliance with this obligation during ODPC inspections. The Central Bank of Kenya (CBK) Guidance on Cybersecurity for Payment Service Providers (2021) expressly requires banks and payment service providers to maintain a documented cybersecurity policy reviewed annually. The Communications Authority of Kenya (CA) similarly requires licensed telecommunications providers to maintain documented information security procedures. For organisations not subject to these sector-specific requirements, a Cybersecurity Policy is strongly advisable as evidence that the organisation took reasonable preventive steps, which is relevant both to criminal defences under the Computer Misuse and Cybercrimes Act No. 5 of 2018 and to civil liability for data breaches under the Data Protection Act No. 24 of 2019.
The Computer Misuse and Cybercrimes Act No. 5 of 2018 creates numerous criminal offences in Kenya. Section 3 criminalises unauthorised access to a computer system with penalties of up to KES 5,000,000 or 3 years' imprisonment, or both. Section 5 criminalises unauthorised interference with computer data. Section 6 criminalises cyber espionage — accessing a computer system to obtain data that could prejudice national security. Section 16 criminalises cybersquatting (registration of domain names similar to established organisations). Section 22 criminalises publication of false information likely to deceive or intimidate, which was the subject of constitutional litigation before the High Court of Kenya in Petition No. 206 of 2019, where the court struck down part of the provision as inconsistent with Article 33 of the Constitution of Kenya 2010 (freedom of expression). Section 28 criminalises phishing — the fraudulent acquisition of login credentials. Section 29 criminalises identity theft and impersonation. Section 38 imposes liability on corporate officers and directors whose companies commit cyberoffences with their knowledge or consent. Organisations must understand these offences to design internal controls that both prevent the organisation's systems from being used for cyberoffences and protect the organisation from criminal liability.
Cybersecurity compliance in a Kenyan organisation is typically the responsibility of multiple roles working together. The board of directors or senior management bears ultimate accountability for approving the Cybersecurity Policy and allocating adequate resources for its implementation. The Data Protection Officer (DPO), where appointed under Section 24 of the Data Protection Act No. 24 of 2019, coordinates data protection-related cybersecurity obligations including breach notification to the Office of the Data Protection Commissioner (ODPC). The Chief Information Security Officer (CISO) or IT Manager is operationally responsible for implementing technical controls, monitoring systems, managing incidents, and keeping the policy current. All employees share responsibility for following the policy — Section 39 of the Computer Misuse and Cybercrimes Act No. 5 of 2018 makes employees who knowingly enable cyberoffences criminally liable as accessories. The National Computer and Cybercrimes Coordination Committee (NC4) established under Section 53 of the Computer Misuse and Cybercrimes Act coordinates government oversight of cybersecurity across Kenya's critical sectors and may engage directly with organisations following significant incidents.
Following a cyberattack, a Kenyan organisation should take several immediate steps. First, activate the incident response plan documented in the Cybersecurity Policy — contain the breach by isolating affected systems, preserving forensic evidence, and preventing further unauthorised access or data exfiltration. Second, assess whether the incident constitutes a personal data breach under the Data Protection Act No. 24 of 2019 — if personal data has been accessed, disclosed, or destroyed without authorisation, the organisation must notify the Office of the Data Protection Commissioner (ODPC) within 72 hours under Section 43(6) of the Act and, where there is high risk to data subjects, notify affected individuals directly. Third, report the cyberoffence to the Directorate of Criminal Investigations (DCI) Cybercrime Unit and the National Computer and Cybercrimes Coordination Committee (NC4) under Section 53 of the Computer Misuse and Cybercrimes Act No. 5 of 2018. Fourth, notify the organisation's cyber insurance provider (if applicable) and legal counsel. Fifth, conduct a post-incident review to identify the root cause, remediate vulnerabilities, and update the Cybersecurity Policy. Failure to notify the ODPC within 72 hours of discovering a qualifying data breach exposes the organisation to enforcement action under Section 69 of the Data Protection Act No. 24 of 2019.
A Kenya Cybersecurity Policy should be reviewed and updated at minimum annually, and more frequently where significant changes occur in the organisation's technology environment, business operations, or regulatory requirements. The Central Bank of Kenya (CBK) Guidance on Cybersecurity for Payment Service Providers (2021) expressly requires an annual policy review for CBK-regulated entities. The Data Protection (General) Regulations 2021 require data controllers and processors to maintain current documentation of their security measures, implying that outdated policies that no longer reflect actual security practice do not satisfy the Office of the Data Protection Commissioner (ODPC) audit requirements. Reviews should be triggered by: significant new deployments of technology or cloud services; major changes in the organisation's data processing activities; new or amended regulatory guidance from the Communications Authority of Kenya, the CBK, or the ODPC; a cybersecurity incident that reveals policy gaps; or material changes in the external threat landscape such as new malware variants or attack methodologies documented by the NC4. Each version of the policy should be dated, version-numbered, and formally approved by the board or senior management, with the previous version retained for audit trail purposes.
Yes. A Kenya Cybersecurity Policy must address remote working and cloud services, both of which are now standard features of Kenyan business operations. For remote working, the policy should specify: approved device types and operating systems; mandatory use of virtual private networks (VPNs) for accessing organisational systems from outside the office; requirements for secure Wi-Fi connections; physical security of devices in home and public environments; and enhanced authentication requirements for remote access, consistent with the access control obligations under the Computer Misuse and Cybercrimes Act No. 5 of 2018. For cloud services, the policy should specify: an approved cloud service provider list; a vendor security assessment process for new cloud platforms; contractual requirements imposed on cloud providers through Data Processing Agreements under Section 43 of the Data Protection Act No. 24 of 2019; data residency and cross-border transfer controls under Section 49 of the Data Protection Act; and incident notification obligations for cloud providers. The Communications Authority of Kenya's cloud computing framework and the ODPC's guidance on cross-border data transfers are the relevant Kenyan regulatory references for cloud security governance.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Data Processing Agreement (Kenya)
A Kenya Data Processing Agreement between a data controller and data processor, compliant with the Data Protection Act No. 24 of 2019 s.45 and the Data Protection (General) Regulations 2021.
Data Breach Notification (Kenya)
A Kenya Data Breach Notification template for notifying the Office of the Data Protection Commissioner and affected data subjects following a personal data breach, compliant with the Data Protection Act No. 24 of 2019 s.43.
Data Subject Consent Form (Kenya)
A Kenya Data Subject Consent Form for obtaining valid, informed consent to process personal data, compliant with the Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations 2021.
Acceptable Use Policy (Kenya)
A Kenya Acceptable Use Policy governing employee and user access to organisational IT systems, networks, and data, compliant with the Computer Misuse and Cybercrimes Act No. 5 of 2018 and the Data Protection Act No. 24 of 2019.
Confidentiality Agreement (Kenya)
A Kenya Confidentiality Agreement (mutual or one-way) protecting trade secrets, business information, and personal data, compliant with the Law of Contract Act Cap. 23 and the Data Protection Act No. 24 of 2019.