Skip to main content

For organisations · Cyber security guidance

For organisations

Practical cyber security guidance for Kenyan government, critical infrastructure and small businesses, from baseline controls to incident response.

Practical guides

Find the guidance you need

Browse by topic or search for the situation you are facing.

12 guides available

Critical infrastructure · 2 min read

Sector guidance

Apply critical-infrastructure protection in the context of your specific sector and its dependencies.

Critical infrastructure · 2 min read

Vulnerability assessment framework

Find and fix weaknesses in essential systems through structured assessment and testing.

Government and counties · 2 min read

Baseline security controls

The essential technical controls that prevent or contain the most common attacks on public-sector systems.

Government and counties · 2 min read

Securing email and websites

Stop email spoofing, protect public websites and reduce the phishing that targets staff and citizens.

Government and counties · 2 min read

Incident response planning

Prepare to detect, contain, recover from and report a cyber incident before one happens.

SME cyber security guide · 2 min read

Protecting customer data

Handle the personal and payment data your customers trust you with lawfully and securely.

Government and counties · 2 min read

Identity and privileged access

Control who can access systems, enforce least privilege and protect the administrator accounts attackers want most.

Government and counties · 2 min read

Supplier and third-party assurance

Manage the cyber risk that reaches you through vendors, contractors and connected systems.

Critical infrastructure · 2 min read

Incident reporting obligations

Know what to report, to whom and how quickly when an incident affects essential services.

Critical infrastructure · 2 min read

Resilience, backup and recovery

Keep essential services running and recover quickly when systems fail or are attacked.

SME cyber security guide · 2 min read

Cyber security essentials for small business

The five low-cost controls that stop most attacks on a small or medium enterprise.

SME cyber security guide · 2 min read

Staff awareness and business email compromise

Help your team spot phishing and stop the invoice and payment-change fraud that targets small businesses.

Guidance for every kind of organisation

Cyber security is a leadership responsibility, not only a technical one. These guides translate recognised frameworks into practical steps for Kenyan organisations of different sizes and mandates. Start with your sector, then work through the controls that reduce the most risk for the least effort.

  • Government and counties — build consistent baseline controls, secure email and public services, and prepare to respond to incidents.

  • Critical infrastructure — connect operational resilience with the protection of essential services and meet sector obligations.

  • Small and medium enterprises — focus limited time and budget on the measures that keep a business running.

Where to begin

Most damaging incidents still start with an unpatched system, a stolen password or a convincing email. Protect administrator and staff accounts with multi-factor authentication, keep systems updated, back up critical data and test recovery, and know who to call when something goes wrong. These basics prevent or contain the majority of attacks regardless of your size.

Make security a routine

Assign clear ownership for systems and security decisions, review your exposure regularly, and rehearse how you would escalate and recover from an incident before you need to. Treat suppliers and connected partners as part of your attack surface. Use our incident reporting guidance and NC4 contact information to prepare before an emergency.

Useful references

Here to help

Something doesn’t look right?

Prepare an incident report with the details that matter.

Report an incident
Return focus to the top of the page