The Government of Kenya has enacted the National Cybersecurity Agency Order 2026, under Legal Notice No. 89. This order formalizes cybersecurity as a primary component of national security policy, reflecting the country’s reliance on digital infrastructure such as mobile money platforms, e-government services, and digital banking networks.
Prior to the issuance of this Order, cybersecurity responsibilities within Kenya were distributed across multiple ministries, law enforcement agencies, and regulatory bodies. Legal Notice No. 89 addresses this fragmentation by establishing the National Cybersecurity Agency (NCSA) as an autonomous regulatory and technical authority. The NCSA is designed to serve as a centralized body coordinating efforts among government entities, private sector stakeholders, and international partners.
The NCSA is granted regulatory and operational authority across several key areas:
- Critical Infrastructure Auditing: The agency is legally mandated to evaluate and certify the cybersecurity resilience of designated critical information infrastructure. This includes networks vital to public utilities, banking, national defense, and public administration.
- Operational Oversight: The NCSA will directly manage the National Cybersecurity Operations Centre alongside coordinated, sector-specific cybersecurity hubs to monitor network vulnerabilities.
- Incident Response Coordination: In the event of significant data breaches or cyberattacks, the NCSA will coordinate the national recovery strategy to ensure a standardized response across all affected sectors.
- Capacity Building: The Order mandates the creation of a Cybersecurity Centre of Excellence to provide professional training, address the domestic technical skills gap, and support the development of localized security protocols.
To integrate technical regulation with national economic and defense policies, the NCSA operates under a multi-agency governance model. The Board of Directors includes representatives from:
- The Ministry responsible for Internal Security
- The National Treasury
- The Ministry of Information, Communications and the Digital Economy
- The Office of the Attorney-General
- The Kenya Defence Forces (KDF)