Regulatory Alert | Kenya establishes the National Cybersecurity Agency

Introduction

On 6th May 2026, President William Ruto signed the National Cybersecurity Agency Order, 2026, which was published in the Kenya Gazette as Legal Notice No. 89 on 15th May 2026. Made under the State Corporations Act (Cap. 446), the Order establishes the National Cybersecurity Agency as a state corporation responsible for coordinating national cybersecurity matters.

The Order designates the Agency as the autonomous regulatory and technical body responsible for the coordination of national cybersecurity matters, operating under the direction of the Cabinet Secretary responsible for internal security. This marks a significant institutional development in Kenya’s cybersecurity governance framework.

While the Communications Authority of Kenya, through the Kenya National Computer Incident Response
Team/Coordination Centre (National KE-CIRT/CC), has historically played the lead role in national cyber incident response, and the Computer Misuse and Cybercrimes Act, 2018 continues to govern cybercrime offences and enforcement, the Order establishes a dedicated state corporation with a broader mandate for national cybersecurity coordination. It does not amend or replace the Computer Misuse and Cybercrimes Act, 2018.

Governance of the Agency

The Agency is governed by a Board chaired by a non-executive Chairperson appointed by the President. Its membership comprises senior representatives from key government institutions, including the Principal Secretaries responsible for Internal Security, the National Treasury, and ICT, the Attorney-General, the Chief of the Kenya Defence Forces, the Inspector-General of the National Police Service, the Director-General of the National Intelligence Service, Prosecutions, together with one representative each from academia and the private sector appointed by the Cabinet Secretary. The Director-General serves as an ex officio member of the Board without voting rights and is appointed by the Board through a competitive recruitment process, subject to the approval of the Cabinet Secretary.

Functions and Powers of the Agency

The Agency’s mandate is extensive. It is responsible for:

• Formulating and overseeing the implementation of national cybersecurity strategies across the public and private sectors;
• Auditing and certifying the cybersecurity resilience of designated critical information infrastructure;
• Managing the National Cybersecurity Operations Center and supporting Sectoral Cybersecurity Operations Centers;
• Conducting technical assessments and vulnerability exposure of government and private sector digital networks;
• Deploying advanced analytics and forensic tools;
• Issuing technical advisories;
• Developing professional certification programmes and technical training;
• Establishing a Cybersecurity Center of Excellence;
• Serving as the lead technical liaison between government and industry;
• Formulating and enforcing technical administrative guidelines;
• Participating in international technical cooperation; and
• Performing such other technical duties as may be assigned by the Board.

The Board is responsible for the overall policy, control and supervision of the Agency, including advising the Cabinet Secretary, approving budgets, mobilizing resources, formulating policies, recruiting staff and exercising powers to levy fees for services, enter into partnerships, administer the Agency’s assets and funds, and undertake other acts necessary for the discharge of its functions.

Key Takeaways

The establishment of the National Cybersecurity Agency signals a shift towards a more centralised institutional framework for cybersecurity governance in Kenya.

Organisations, particularly those operating designated critical information infrastructure, should monitor the operationalisation of the Agency, including the issuance of implementing frameworks, technical standards and administrative guidelines, and assess their cybersecurity governance frameworks to ensure continued compliance with evolving regulatory requirements.