Skip to main content

For organisations · Cyber security guidance

Critical infrastructure

Connect operational resilience with the protection of the essential digital services the country relies on.

Practical guides

Find the guidance you need

Browse by topic or search for the situation you are facing.

4 guides available

Protect what the country cannot do without

Critical information infrastructure supports essential services such as energy, finance, health, communications, water and transport. Disruption or compromise can affect public safety, the economy and national security. Protecting it means combining strong cyber security with operational resilience, so services continue even when something fails.

Understand your essential services

  • Identify the services, assets, data and dependencies that matter most to essential operations.

  • Map how they connect, including the suppliers and operational technology they rely on.

  • Define ownership, escalation and recovery responsibilities, and the impact you must avoid.

Meet your obligations

Operators of critical infrastructure in Kenya have duties under the Computer Misuse and Cybercrimes Act and the applicable critical-infrastructure regulations, including risk management, protective controls and incident reporting to the relevant national authority. Treat compliance as the floor, not the ceiling, and consult the official regulations for the framework that applies to your sector.

Make resilience routine

Review access controls, patching and response readiness continuously, and test that you can detect, withstand and recover from disruption. The guides below cover sector guidance, vulnerability assessment, incident reporting and continuity.

Useful references

Here to help

Something doesn’t look right?

Prepare an incident report with the details that matter.

Report an incident
Return focus to the top of the page